KR20210148040A - Clustering method for cryptocurrency wallet addresses - Google Patents

Abstract

According to an embodiment of the present invention, a computer program stored in a computer-readable storage medium is disclosed. The computer program includes instructions for causing a processor to perform the following steps. The steps are a step of determining a black market wallet address, a step of recognizing one or more transactions performed for the black market wallet address, a step of collecting wallet addresses associated with the black market wallet address based on the one or more transactions and a step of clustering the black market wallet address and the wallet addresses into one group.

Description

CLUSTERING METHOD FOR CRYPTOCURRENCY WALLET ADDRESSES

The present disclosure relates to a method of clustering cryptocurrency wallet addresses, and more particularly, to a method of clustering black market wallet addresses in which illegal transactions are performed in an escrow method.

Recently, real transactions using cryptocurrency based on block chain technology are increasing. However, due to the characteristics of blockchain technology that operates based on anonymity, cryptocurrencies can be used for money laundering and the transaction of prohibited goods such as drugs. In fact, cryptocurrencies are being abused for crimes such as illegal transactions and money laundering on the Dark Web by using the characteristics of blockchain technology that are difficult to track.

When trading cryptocurrencies (especially Bitcoin), the same wallet can perform Bitcoin transactions using multiple addresses. Therefore, it is impossible to track the wallet where illegal transactions are performed and the subject of the wallet just by tracking one address. Therefore, there is a need for a technology that enables tracking of one wallet in which illegal transactions are performed through the clustering of Bitcoin transactions and addresses where transactions are performed.

Republic of Korea Patent Registration No. 10-2058683 Republic of Korea Patent Registration No. 10-2051350

The present disclosure has been devised in response to the above-mentioned background art, and specifically aims to provide a method of clustering black market wallet addresses where illegal transactions are performed in an escrow method.

The technical problems of the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

According to an embodiment of the present disclosure for solving the above-described problems, a computer program stored in a computer-readable storage medium is disclosed. The computer program includes instructions for causing a processor to perform the following steps: determining a black market wallet address; recognizing one or more transactions performed against the black market wallet address; collecting wallet addresses associated with the black market wallet address based on the one or more transactions; and clustering the black market wallet address and the wallet addresses into one group. may include

In addition, the determining of the black market wallet address includes: a time interval between a deposit transaction related to a wallet address and a withdrawal transaction related to the wallet address, the number of transactions related to the wallet address, information on the balance of the wallet address, or determining the black market wallet address based on at least one of a time interval between withdrawal transactions; may include

In addition, the black market wallet address may be collected using a web crawler.

In addition, the web crawler may collect the black market wallet address from a web page based on the structural features of the cryptocurrency wallet address related to the black market wallet address.

In addition, the determining of the black market wallet address may include: recognizing a withdrawal transaction generated by combining a wallet address collected using the web crawler and one or more other wallet addresses; and determining each of the wallet address and the one or more other wallet addresses collected using the web crawler included in the withdrawal transaction as the black market wallet address; may include

In addition, based on the one or more transactions, collecting the wallet addresses associated with the black market wallet address may include: recognizing one or more derivative transactions derived from the one or more transactions; and collecting one or more wallet addresses included in each of the derivative transactions as the connected wallet addresses.

In addition, the step of collecting wallet addresses associated with the black market wallet address based on the one or more transactions may include a withdrawal generated by combining one or more wallet addresses included in each of the derivative transactions with one or more other wallet addresses. recognizing a transaction; and collecting each of the one or more wallet addresses and the one or more other wallet addresses included in the derivative transaction as the linked wallet addresses.

In addition, based on the one or more transactions, the wallet addresses associated with the black market wallet address may be collected using a characteristic of a mixing service wallet address related to a cryptocurrency mixing service.

In addition, the mixing service wallet address may be determined based on whether the amount included in the transaction is a wallet address matching a preset criterion.

In addition, the wallet addresses connected to the black market wallet address may be wallet addresses excluding the wallet address related to the cryptocurrency mixing service among the wallet addresses related to one or more transactions collected from the black market wallet address.

In addition, recognizing a transaction termination time of the wallet addresses clustered into the one group; and excluding from the group at least one wallet address for which the transaction end time is longer than a preset period; may further include.

According to an embodiment of the present disclosure for solving the above-described problems, a computing device is disclosed. The computing device may include: a processor; Memory; and a communication unit; wherein the processor determines a black market wallet address, recognizes one or more transactions performed for each of the one black market wallet addresses, and based on the one or more transactions, a wallet associated with the black market wallet address. Addresses may be collected, and the black market wallet address and the connected wallet addresses may be clustered into one group.

The technical solutions obtainable in the present disclosure are not limited to the above-mentioned solutions, and other solutions not mentioned are clearly to those of ordinary skill in the art to which the present disclosure belongs from the description below. can be understood

The present disclosure provides a method of clustering cryptocurrency wallet addresses, so that multiple cryptocurrency wallet addresses operated by a black market can be efficiently identified.

Effects obtainable in the present disclosure are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those of ordinary skill in the art to which the present disclosure belongs from the description below. .

Various aspects are now described with reference to the drawings, wherein like reference numbers are used to refer to like elements collectively. In the following example, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more aspects. It will be evident, however, that such aspect(s) may be practiced without these specific details.
1 is a diagram illustrating an example of a system for performing cryptocurrency wallet address clustering according to some embodiments of the present disclosure.
2 is a block diagram illustrating a configuration of a computing device according to some embodiments of the present disclosure.
3 is a diagram illustrating a transaction and balance status of a black market wallet address according to some embodiments of the present disclosure.
4 is a view showing the current state of deposit and withdrawal of a black market wallet address according to the present disclosure.
5 is a diagram illustrating an example of a web page that a web crawler uses to collect black market wallet addresses according to some embodiments of the present disclosure.
6 is a diagram illustrating a transaction and a derivative transaction according to some embodiments of the present disclosure.
7 is a diagram for representing a mixing service according to some embodiments of the present disclosure.
8 is a flowchart illustrating that the processor clusters black market wallet addresses according to some embodiments of the present disclosure.
9 is a flowchart illustrating that a processor determines a first black market wallet address according to some embodiments of the present disclosure.
10 is a flowchart illustrating that a processor collects wallet addresses associated with a black market wallet address according to some embodiments of the present disclosure.
11 is a flowchart illustrating that a processor collects wallet addresses associated with a black market wallet address according to some embodiments of the present disclosure.
12 shows a simplified, general schematic diagram of an example computing environment in which some embodiments of the present disclosure may be implemented.

Various embodiments and/or aspects are now disclosed with reference to the drawings. In the following description, for purposes of explanation, numerous specific details are set forth to provide a thorough understanding of one or more aspects. However, it will also be appreciated by one of ordinary skill in the art that such aspect(s) may be practiced without these specific details. The following description and accompanying drawings set forth in detail certain illustrative aspects of one or more aspects. These aspects are illustrative, however, and some of various methods may be employed in the principles of the various aspects, and the descriptions set forth are intended to include all such aspects and their equivalents. Specifically, as used herein, “embodiment”, “example”, “aspect”, “exemplary”, etc. are not to be construed as advantageous or advantageous over any aspect or design described herein. It may not be.

Hereinafter, the same or similar components are assigned the same reference numerals regardless of reference numerals, and overlapping descriptions thereof will be omitted. In addition, in describing the embodiments disclosed in the present specification, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical ideas disclosed in the present specification are not limited by the accompanying drawings.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other components in addition to the stated components.

Although the first, second, etc. are used to describe various elements or elements, these elements or elements are not limited by these terms, of course. These terms are only used to distinguish one element or component from another. Therefore, it goes without saying that the first element or component mentioned below may be the second element or component within the spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless clearly defined in particular.

In addition, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or.” That is, unless otherwise specified or clear from context, "X employs A or B" is intended to mean one of the natural implicit substitutions. That is, X employs A; X employs B; or when X employs both A and B, "X employs A or B" may apply to either of these cases. It should also be understood that the term “and/or” as used herein refers to and includes all possible combinations of one or more of the listed related items.

In addition, as used herein, the terms “information” and “data” can often be used interchangeably.

Hereinafter, the same or similar components are assigned the same reference numerals regardless of reference numerals, and overlapping descriptions thereof will be omitted. In addition, in describing the embodiments disclosed in the present specification, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical ideas disclosed in the present specification are not limited by the accompanying drawings.

Although the first, second, etc. are used to describe various elements or elements, these elements or elements are not limited by these terms, of course. These terms are only used to distinguish one element or component from another. Accordingly, it goes without saying that the first element or component mentioned below may be the second element or component within the spirit of the present disclosure.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which this disclosure belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless clearly defined in particular.

The suffixes "module" and "part" for the components used in the following description are given or used in consideration of only the ease of writing the specification, and do not have distinct meanings or roles by themselves.

Objects and effects of the present disclosure, and technical configurations for achieving them will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. In describing the present disclosure, if it is determined that a detailed description of a well-known function or configuration may unnecessarily obscure the subject matter of the present disclosure, the detailed description thereof will be omitted. In addition, the terms to be described later are terms defined in consideration of functions in the present disclosure, which may vary according to intentions or customs of users and operators.

However, the present disclosure is not limited to the embodiments disclosed below and may be implemented in various different forms. Only the present embodiments are provided so that the present disclosure is complete, and to fully inform those of ordinary skill in the art to which the present disclosure belongs, the scope of the disclosure, and the present disclosure is only defined by the scope of the claims . Therefore, the definition should be made based on the content throughout this specification.

1 is a diagram illustrating an example of a system for performing cryptocurrency wallet address clustering according to some embodiments of the present disclosure.

The computing device 100 in FIG. 1 may be related to a user or a system administrator who wants to perform cryptocurrency wallet address clustering using the blockchain network 200 . That is, the cryptocurrency wallet address clustering method according to the present disclosure may be performed by a subject having system management authority using the computing device 100 . Furthermore, each node included in the blockchain network 200 may perform the cryptocurrency wallet address clustering method according to the present disclosure.

The computing device 100 may operate as a node included in the blockchain network 200 . In this example, the computing device 100 may implement at least one function of a wallet function, a miner function, and a storage function of full block chain data. For example, when the computing device 100 includes only a wallet function, it may operate as a node (eg, a Simplified Payment Verification (SPV) node) that performs transaction and validation.

The computing device 100 may issue a query or a transaction to the blockchain network 200 . The query in the present disclosure may be used to inquire contact information of a registered recipient on the blockchain network 200 . A transaction in the present disclosure may be used to perform an update (modification/change/deletion/addition) on data recorded on the blockchain network 200 .

The computing device 100 may transmit/receive an application source written in a programming language. For example, the computing device 100 may compile an application source to generate a client application. For example, the generated client application may be executed after being delivered to at least one of the blockchain networks 200 .

Since the computing device 100 includes a display unit (not shown), it is possible to receive a user input and provide an output in any form to the user in transmitting and receiving information and signals related to cryptocurrency wallet address clustering.

In some embodiments of the present disclosure, the blockchain network 200 may mean a plurality of nodes operating based on blockchain technology. Here, the block chain technology is a distributed storage technology that stores data to be managed in a plurality of nodes included in the block chain network using a storage structure in which blocks are connected in a chain form.

The blockchain network 200 may store the transaction transmitted from the computing device 100 in a block form based on a predetermined consensus algorithm. Data stored in block form may be shared by a plurality of nodes included in the blockchain network 200 .

The blockchain network 200 may include a public blockchain network in which arbitrary nodes can perform a consensus operation or a private blockchain network in which only predetermined nodes can perform a consensus operation, depending on the implementation type. .

The consensus algorithm performed in the blockchain network 200 according to some embodiments of the present disclosure is: a Proof of Work (PoW) algorithm, a Proof of Stake (PoS) algorithm, a Delegated Proof of Stage (DPoS) algorithm, and a Practical (PBFT) algorithm. Byzantine Fault Tolerance (DBFT) Algorithm, Delegated Byzantine Fault Tolerance (DBFT) Algorithm, Redundant Byzantine Fault Tolerance (RBFT) Algorithm, Sieve Algorithm, Tendermint Algorithm, Paxos Algorithm, Raft Algorithm, Proof of Authority (PoA) Algorithm, and/or Proof of (PoET) Algorithm Elapsed Time) algorithm may be included.

In some exemplary embodiments of the present disclosure, nodes in the blockchain network 200 may operate by a blockchain core package according to a hierarchical structure. The hierarchical structure is: A data layer that defines the structure of data handled in the block chain network 200 and manages data, performs mining to verify the validity of blocks and creates blocks, and fees paid to miners in the mining process Consensus layer in charge of processing, execution layer that processes and executes smart contract, common layer that implements and manages P2P network protocol, hash function, digital signature, encoding, and common storage, and various applications are created, processed and managed It may contain an application layer.

The computing device 100 has a mechanism for communicating with at least one other node included in the blockchain network 200 through the communication network 300, and any arbitrary in the system for performing the cryptocurrency wallet address clustering. It can mean a node of the form. For example, computing device 100 may include a microprocessor, mainframe computer, digital processor, portable device, personal computer (PC), laptop computer, workstation, and/or any electronic device having network connectivity. have. Also, the computing device 100 may include an arbitrary server implemented by at least one of an agent, an application programming interface (API), and a plug-in. In addition, the computing device 100 may include an application source and/or a client application.

The computing device 100 may be a computing device included in any blockchain network 200 capable of processing and storing arbitrary data, including the processor 110 , a memory, and a communication unit.

Communication network 300 according to an embodiment of the present disclosure is a Public Switched Telephone Network (PSTN), x Digital Subscriber Line (xDSL), Rate Adaptive DSL (RADSL), Multi Rate DSL (MDSL), VDSL Various wired communication systems such as (Very High Speed DSL), Universal Asymmetric DSL (UADSL), High Bit Rate DSL (HDSL), and Local Area Network (LAN) can be used.

In addition, the communication network 300 presented in the present disclosure is CDMA (Code Division Multi Access), TDMA (Time Division Multi Access), FDMA (Frequency Division Multi Access), OFDMA (Orthogonal Frequency Division Multi Access), SC-FDMA A variety of wireless communication systems may be used, such as (Single Carrier-FDMA) and other systems. The techniques described in this disclosure may be used in the networks mentioned above, as well as in any form of other communication networks.

2 is a block diagram of a computing device in accordance with some embodiments of the present disclosure.

As shown in FIG. 2 , the computing device 100 may include a processor 110 , a memory 120 , and a communication unit (not shown).

The processor 110 may include one or more cores, and a central processing unit (CPU) of a computing device, a general purpose graphics processing unit (GPGPU), and a tensor processing unit (TPU). unit) and the like, by executing instructions stored in the memory, and thus may include any type of processor for performing black market wallet address clustering. The processor 110 may perform black market wallet address clustering according to some embodiments of the present disclosure by reading a computer program stored in the memory. The processor 110 may control overall operations of components of the computing device 100 to perform the black market wallet address clustering method.

Escrow transaction refers to a trading protection service in which a third party relays commerce transactions smoothly when the credit relationship between the buyer and the seller is uncertain.

In particular, in the case of e-commerce services, in the case of e-commerce, it means 'deposit of payment', and it is used as a system to check the delivery of goods and pay the seller after entrusting the transaction amount to a third party. Specifically, the escrow service may be operated in such a way that the consumer stores the product value in a trusted third party, such as a bank, and then deposits the product into the seller's account when the delivery is normally completed.

A wallet in cryptocurrency based on blockchain technology can be one of the means of interacting with the blockchain network. The wallet does not actually store cryptocurrency, however, the wallet can generate the necessary information when sending and receiving cryptocurrency through a blockchain transaction. This information may consist of one or more public and private key pairs.

A wallet may also contain a public address, which is an alphanumeric identifier that is generated based on a public and private key, and this address may represent a specific “location” on the blockchain where coins can be transferred. Thus, certain entities may share a public address in order to receive funds. The movement of funds can be achieved by transferring cryptocurrency from one address to another.

The processor 110 according to the present disclosure may determine a black market wallet address suspected of being used for illegal transactions or money laundering.

Specifically, the black market wallet address may be determined based on an address published on the dark web where illegal transactions are mainly performed.

For example, the processor 110 uses a program that recognizes a cryptocurrency wallet address published for illegal transactions on the dark web, such as a web crawler, for illegal transactions on the dark web. data can be collected.

In addition, the processor 110 may determine the collected address data for illegal transactions as a black market wallet address, and recognize wallet addresses connected thereto. In the present disclosure, the processor 110 may form one group by clustering wallet addresses connected to the black market wallet address.

A program for recognizing the wallet address, such as the web crawler, may be stored in advance in the memory 120 and executed by the processor 110 .

The communication unit (not shown) may include a wired/wireless Internet module for network connection. The communication unit (not shown) may communicate with at least one of the nodes included in the block chain network 200 . As the wireless Internet technology, wireless LAN (WLAN) (Wi-Fi), wireless broadband (Wibro), world interoperability for microwave access (Wimax), high speed downlink packet access (HSDPA), etc. may be used. As the wired Internet technology, Digital Subscriber Line (XDSL), Fibers to the home (FTTH), Power Line Communication (PLC), or the like may be used.

The above-described components are exemplary, and the scope of the present disclosure is not limited to the above-described components. That is, additional components may be included or some of the above-described components may be omitted depending on implementation aspects for the embodiments of the present disclosure.

The computing device 100 may further include a memory 120 . The memory may store a program for the operation of the processor 110 and may temporarily or permanently store input/output data. The memory includes a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (eg SD or XD memory, etc.), and a random access memory (RAM). Memory, RAM), SRAM (Static Random Access Memory), ROM (Read-Only Memory, ROM), EEPROM (Electrically Erasable Programmable Read-Only Memory), PROM (Programmable Read-Only Memory), magnetic memory, magnetic disk, optical disk It may include at least one type of storage medium. Such a memory may be operated under the control of the processor.

3 is a diagram illustrating a transaction and balance status of a black market wallet address according to the present disclosure.

Referring to FIG. 3 , the transaction status of the mixing service wallet address determined as the black market wallet address can be viewed. As described above, in the wallet address used for illegal transactions in the black market, the act of withdrawing the deposited amount to another account as it is for mixing is repeatedly performed.

Accordingly, it can be seen that, despite 36 transactions (Transactions, 36), the total amount deposited (Total Received) and the total amount withdrawn (Total Sent) are the same.

The processor 110 may determine the black market wallet address in consideration of various factors as well as the access status of the overall amount as shown in FIG. 3 , which will be described later.

The wallet 400 in cryptocurrency based on blockchain technology may be one of the means of interacting with the blockchain network. The wallet does not actually store cryptocurrency, however, the wallet can generate the necessary information when sending and receiving cryptocurrency through a blockchain transaction. This information may consist of one or more public and private key pairs.

That is, the cryptocurrency wallet 400 may mean a tool for storing and managing a private key used for generating and signing transaction transaction data recorded in the blockchain distributed ledger.

A wallet may also contain a public address, which is an alphanumeric identifier that is generated based on a public and private key, and this address may represent a specific “location” on the blockchain where coins can be transferred. Thus, certain entities may share a public address in order to receive funds. The movement of funds can be achieved by transferring cryptocurrency from one address to another.

Referring to FIG. 3 , the cryptocurrency wallet 400 according to the present disclosure has a wallet address 410 , the number of transactions performed for the wallet 420 , the total amount deposited through the transaction 430 , and the total amount withdrawn 440 and balance 450 information.

Since all information about the transaction performed for the individual cryptocurrency wallet 400 is recorded on the blockchain network 200, the information 410 to 450 can be easily accessed through an Internet site such as BlockExplorer. can be queried.

Hereinafter, it will be described in detail.

In the present disclosure, the wallet address 410 may refer to data composed of a series of letters and numbers used to transmit cryptocurrency based on a transaction recorded on a blockchain network.

In the present disclosure, the wallet address 410 may be linked with the QR code on the left.

The cryptocurrency wallet 400 may be associated with the total number of transactions 420 performed for that cryptocurrency wallet 400 . Accordingly, the processor 110 may inquire information on the number of transactions for the cryptocurrency wallet 400 from a site that records block chain transaction information.

The processor 110 may inquire the total amount 430 deposited by the cryptocurrency wallet 400 from another cryptocurrency wallet from an internet site that records the block chain transaction information through a communication unit (not shown).

As with the deposit amount, the processor 110 withdraws the total amount 440 of the cryptocurrency wallet 400 withdrawn from the internet site that records the block chain transaction information through a communication unit (not shown) to another cryptocurrency wallet. ) can be viewed.

The processor 110 may inquire the final balance 450 of the cryptocurrency wallet 400 from an Internet site that records the block chain transaction information through a communication unit (not shown).

In general, in the cryptocurrency wallet 400 used in the black market, the total amount deposited 430 and the total amount withdrawn 440 are the same, and thus the balance 450 may be 0. In addition, there may be a feature of having a large number of transactions 420 for a short period of time compared to general cryptocurrency wallets. In addition, it may have a characteristic that it is not used anymore after being used for a certain period of time.

The processor 110 according to the present disclosure may track the cryptocurrency wallet used in the black market based on such characteristics. It will be described in detail below.

4 is a view showing the current state of deposit and withdrawal of a black market wallet address according to the present disclosure.

Referring to FIG. 4 , specific details of individual transactions related to the black market wallet address can be checked.

From the black market wallet address, the deposited amount is withdrawn and transferred to another account. Just before the amount indicated in the circle is withdrawn, you can see that the same amount has been deposited into the corresponding wallet address in the transaction below it.

Accordingly, the processor 110 can know that the wallet address having the above-described characteristics is the wallet address used by the subject operating the black market.

Due to the characteristics of the Hierarchical Deterministic Wallet, which is widely used in the current cryptocurrency wallet system, different addresses can be used for different transactions even in the same wallet. However, due to the nature of the black market, except for transactions by buyers and sellers, cryptocurrencies are highly likely to be transferred only between black market wallets. Accordingly, the processor 110 may cluster the wallet addresses connected to the plurality of black market wallet addresses by tracking the connected transactions based on the transaction details of one black market wallet address as a starting point to correspond to one wallet.

4 shows a transaction history 500 performed for an arbitrary cryptocurrency wallet 400 , queried by the processor 110 .

The transaction history 500 shown in FIG. 4 shows only a part of the transaction performed for the cryptocurrency wallet 400 . In addition, the transaction performance aspect shown in FIG. 4 is only an aspect of transaction generation performed for the cryptocurrency wallet 400 .

The processor 110 may recognize the characteristics of the black market wallet addresses previously stored in the memory 120 . Accordingly, the processor 110 may recognize whether various characteristics of the transaction performed for the cryptocurrency wallet 400 correspond to characteristics of the black market wallet addresses. Based on this, the processor 110 may determine whether the cryptocurrency wallet 400 corresponds to a cryptocurrency wallet operated by a black market.

Referring to FIG. 4 , the transaction history 500 may include transaction occurrence times 511 and 512 , a withdrawal amount 521 , a deposit amount 522 , a deposit transaction 531 , and a withdrawal transaction 532 .

Hereinafter, each will be described in detail.

With respect to any cryptocurrency wallet, transaction history 500 may include deposit transactions. The deposit transaction 531 shown in FIG. 4 shows that the transfer of cryptocurrency from one wallet address to a plurality of wallet addresses is performed. In the deposit transaction 531, from one wallet address listed on the left of the arrow located in the center of the transaction, about 17.33 BTC of Bitcoin was distributed and transferred to a plurality of wallet addresses listed on the right of the arrow. Among them, the wallet address related to the transaction history 500 is the third wallet address from the bottom among a plurality of wallet addresses listed on the right side of the arrow, and it can be confirmed that 0.00306600 BTC of Bitcoin has been deposited to the wallet address.

General cryptocurrency transfer can be done from one wallet to one wallet. Accordingly, in the case of a transaction in which withdrawals are made to a plurality of wallet addresses, the plurality of wallet addresses to which cryptocurrency is received by the transaction can be regarded as wallets owned by the same operating entity.

In addition, black market wallet addresses perform deposits and withdrawals only with each other other than deposits and withdrawals for buyers and sellers.

Based on this feature, if cryptocurrency is transferred from one black market wallet address to a plurality of cryptocurrency wallet addresses, it can be determined that the plurality of wallet addresses receiving cryptocurrency are wallet addresses connected to the black market wallet address. have. Accordingly, the processor 110 may cluster the connected wallet addresses.

Alternatively, the processor 110 may determine a plurality of wallet addresses to receive cryptocurrency as a black market wallet address serving as a starting point for performing a clustering operation. In this case, the processor 110 may discover more black market wallet addresses at the same time by applying the clustering technique according to the present disclosure to each of the plurality of wallet addresses.

Using this feature, even if only one black market wallet address is specified, multiple black market wallet addresses can be discovered at once. Therefore, it may be easy to track illegal trading activities in the black market.

The above contents are substituted for the deposit transaction 531 shown in FIG. In the deposit transaction 531 of FIG. 4 , a plurality of wallet addresses on the right side of the arrow were deposited as separate addresses, but the plurality of wallet addresses can all be considered to be owned by one cryptocurrency user.

Based on these characteristics, the processor 110 may determine the plurality of wallet addresses as wallet addresses connected to the black market wallet address. Accordingly, the processor 110 may cluster the black market wallet address and the connected wallet addresses for one cryptocurrency user. That is, as in the deposit transaction 531 , when a deposit is performed by a plurality of wallet addresses within one transaction, the plurality of wallet addresses may be clustered for one subject.

With respect to any cryptocurrency wallet, transaction history 500 may include withdrawal transactions. The withdrawal transaction 532 shown in FIG. 4 shows that the transfer of cryptocurrency from a plurality of wallet addresses to one wallet address has been performed. In the withdrawal transaction 532, approximately 0.1137 BTC of Bitcoin was transferred from a plurality of wallet addresses listed to the left of the arrow located in the center of the transaction to one wallet address listed to the right of the arrow. Among them, the wallet address related to the transaction history 500 is the wallet address located second from the top among the plurality of wallet addresses listed on the left of the arrow, and it can be confirmed that 0.00439600 BTC of Bitcoin has been deposited to the wallet address.

Client programs related to general blockchain and cryptocurrency wallets can support multiple addresses to create one transaction by combining them. However, these clients may not generally support multiple users to create one transaction. Therefore, even in the case of a transaction in which withdrawals are made from multiple wallet addresses, it can be considered that the transaction is generated by one user. Therefore, in this case, it can be seen that a plurality of wallet addresses from which withdrawals are made are associated with one user.

In addition, black market wallet addresses perform deposits and withdrawals only with each other other than deposits and withdrawals for buyers and sellers.

Based on this feature, when cryptocurrency is transferred from a plurality of wallet addresses including the black market wallet address to one cryptocurrency wallet address, the plurality of wallet addresses from which withdrawals are made are called wallet addresses connected to the black market wallet address. can judge Accordingly, the processor 110 may cluster the connected wallet addresses.

Alternatively, the processor 110 may determine a plurality of wallet addresses from which cryptocurrency is withdrawn as a black market wallet address serving as a starting point for performing a clustering operation. In this case, the processor 110 may discover more black market wallet addresses at the same time by applying the clustering technique according to the present disclosure to each of the plurality of wallet addresses.

Using this feature, even if only one black market wallet address is specified, multiple black market wallet addresses can be discovered at once. Therefore, it may be easy to track illegal trading activities in the black market.

The above contents are substituted for the withdrawal transaction 532 shown in FIG. 4 . In the withdrawal transaction 532 of FIG. 4, withdrawal was performed by a plurality of wallet addresses on the left side of the arrow. However, as described above, due to the characteristics of the cryptocurrency client, the plurality of wallet addresses can all be considered to be owned by the same blockchain or cryptocurrency user.

Based on these characteristics, the processor 110 may determine the plurality of wallet addresses as wallet addresses connected to the black market wallet address. Accordingly, the processor 110 may cluster the black market wallet address and the connected wallet addresses for one cryptocurrency user.

That is, as in the withdrawal transaction 532 , when withdrawal is performed by a plurality of wallet addresses in one transaction, the plurality of wallet addresses may be clustered for one user.

Since this is only one example of a method for clustering a plurality of wallet addresses for a user, the method for clustering is not limited thereto.

Individual transactions included in the transaction history 500 may include the time the corresponding transaction was performed. In a withdrawal transaction, the withdrawal time information 512 may be included, and in the deposit transaction, the deposit time information 512 may be included.

Individual transactions included in the transaction history 500 may include information about the amount of cryptocurrency transmitted by the transaction.

When withdrawal is performed from the cryptocurrency wallet related to the transaction history 500, - is displayed in front of the amount of cryptocurrency. When a deposit is made to a cryptocurrency wallet related to the transaction history 500, + is added in front of the amount of cryptocurrency. Since this is only an exemplary expression, the method of expressing whether cryptocurrency is deposited or withdrawn from the cryptocurrency wallet may vary.

4, when the cryptocurrency wallet related to the transaction history 500 is related to the black market, in the case of the cryptocurrency wallet operated by the black market, the withdrawal amount 521 ) and the deposit amount 522 may be the same. Accordingly, if a plurality of transactions in which the withdrawal amount 521 and the deposit amount 522 are the same are included in the transaction history 500, the processor 110 determines the cryptocurrency wallet 400 associated with the transaction history 500 and the cryptographic The currency wallet address 410 may be determined as a cryptocurrency wallet operated by a black market and a black market wallet address.

However, this is only an example of a factor to consider for determining a cryptocurrency wallet operated by a black market and a black market wallet address. Therefore, the factors to be considered for determining the cryptocurrency wallet operated by the black market and its address are not limited thereto.

5 is a diagram illustrating an example of a web page that a web crawler uses to collect black market wallet addresses according to some embodiments of the present disclosure.

In the present disclosure, a web crawler may refer to a module that takes data from the Internet and processes it into a form that is easy to analyze data.

For example, the processor 110 according to the present disclosure may collect black market wallet addresses using the web crawler. Hereinafter, an example will be described.

In FIG. 5 , a web page 600 providing information for payment for a product to a purchaser is shown. Such a web page 600 may exist not only on the Internet, but also on the Dark Web where a black market is generally established.

The web page 600 may include a cryptocurrency wallet address 610 for receiving product payment.

The cryptocurrency wallet address included in the web page 600 may have certain structural features. As shown in FIG. 5 , the cryptocurrency wallet address 610 included in the web page 600 may be in the form of a string including a number of numbers and characters. The cryptocurrency wallet address 610 may be different depending on the type of cryptocurrency used to receive the product price in the black market. For example, in the case of Bitcoin, which is a type of cryptocurrency, a wallet address is a random string of 26 to 33 characters starting with 1 or 3, consisting of a to z, A to Z, and the numbers 0 to 9. .

Using this, it is possible to collect the black market wallet address from a web page based on the structural characteristics of the wallet address of the cryptocurrency related to the black market wallet address. It will be described in detail below.

The processor 110 may collect the cryptocurrency wallet address 610 from the web page 600 as shown in FIG. 5 by using a communication unit (not shown) and the web crawler. Hereinafter, an example will be described.

The web crawler according to some embodiments of the present disclosure may recognize whether the inquired web page 600 includes the cryptocurrency wallet address 610 based on a regular expression (Regular Expression).

A regular expression is a formal language used to express a set of strings with specific rules. The processor 110 may search whether the cryptocurrency wallet address 610 exists in the web page 600 by using a regular expression corresponding to a rule of the type of cryptocurrency wallet address to be collected. When the cryptocurrency wallet address 610 exists in the web page 600 , the processor 110 may collect it and determine it as a black market wallet address.

For example, in the case of Bitcoin, which is a type of cryptocurrency, the cryptocurrency wallet address 610 starts with 1 or 3, and a random string of 26 to 33 characters consisting of a to z, A to Z, and numbers 0 to 9. am. The processor 110 may search whether a character string having such a rule exists in the web page 600 using the regular expression. If such a string exists, the processor 110 may collect the string and determine it as a black market wallet address.

6 is a diagram illustrating a transaction and a derivative transaction according to some embodiments of the present disclosure.

6 shows a first transaction 710a in the withdrawal wallet and a second transaction 710b in the deposit wallet of the transaction with the transaction hash value (de711eaa2707f1d...).

The first transaction may be an aspect in the withdrawal wallet of the transaction having the transaction hash value, and the second transaction may be an aspect in the deposit wallet of the transaction having the transaction hash value. Essentially the first transaction and the second transaction may be the same transaction.

According to the first transaction 710a and the second transaction 710b, it can be confirmed that 0.06131465 BTC has been deposited into the wallet address 411 .

In the present disclosure, the derivative transaction 800 may refer to a newly created transaction based on a previous transaction deposited to a cryptocurrency wallet address.

For example, according to the second transaction 710b, it can be confirmed that 0.06131465 BTC is deposited in the wallet address 411. And, it can be seen through the left arrow of the derivative transaction 800 that the wallet address 411 already additionally holds 0.30815704 BTC.

The subject related to the wallet address 411 may create a new transaction by combining the amount already held by the wallet address 411 with the amount deposited through the second transaction 710b, and a derivative transaction 800 is an example of that.

As described above, the black market wallet addresses have the characteristic of transmitting cryptocurrencies only to each other. Therefore, it is highly likely that all wallet addresses where deposits and withdrawals are performed in the derivative transaction are owned by the subject related to the black market wallet address. Accordingly, the processors 110 may cluster all cryptocurrency wallet addresses included in the derivative transaction 800 for one subject.

7 is a diagram for representing a mixing service according to some embodiments of the present disclosure.

In the present disclosure, cryptocurrency mixing can be defined as a technology that hides information about where to receive cryptocurrency and where to send cryptocurrency by mixing cryptocurrency transaction details.

The cryptocurrency mixing service may be a service that makes it possible to hide the connection relationship between a wallet address for sending cryptocurrency and a wallet address for receiving cryptocurrency, based on the above-described technology.

An entity operating a black market may try to avoid tracking by hiding the wallet addresses it owns and the connection relationship between the wallet addresses. Accordingly, the entity operating the black market can use the mixing service.

Accordingly, the processor 110 may use the characteristics of the wallets used for the mixing service to select wallets used for the mixing service from among the wallet addresses identified in the entire transaction transaction history. Through this, it is possible to select and cluster the black market wallet address and the wallet addresses connected to the black market wallet address among the wallet addresses identified in the entire transaction transaction history.

As described above in FIGS. 3 to 6 , it is assumed that one specified black market wallet address 910 is recognized by the processor 110 .

The specified cryptocurrency wallet address can continuously perform deposits and withdrawals. As shown in Figs. 4 and 6, when the derivative transactions generated from the cryptocurrency wallet address are chained, all cryptocurrency wallet addresses 920, 930 and 940 related to the specified cryptocurrency wallet address can be found

In the present disclosure, the mixing service wallet address 920 may mean wallet addresses used for the above-described mixing service. The processor 110 may recognize the characteristics of the mixing service wallet addresses from the memory 120 . Based on this, the processor 110 may recognize the mixing service wallet addresses 920 among all cryptocurrency wallet addresses related to the specified black market wallet address 910 .

For example, in the mixing service wallet address 920, the balance 450 of the wallet address or the amount of cryptocurrency included in the transaction related to the mixing service wallet address 920 may correspond to the following [Equation 1].

Since the cryptocurrency wallet address clustering technique according to the present disclosure has the purpose of clustering and grouping the black market wallets that provide the escrow service, the wallet used for the mixing service may not be the object to be grouped in the method according to the present disclosure. Accordingly, the processor 110 may classify wallet addresses having balance information as in [Equation 1] into the mixing service wallet addresses 920 and exclude them from clustering.

The processor 110 may recognize the withdrawal wallet address 930 from among the entire wallet addresses 910 , 920 , 930 and 940 . In addition, the processor 110 may determine that the remaining wallet addresses excluding the specified black market wallet address 910, mixing service wallet address 920, and withdrawal wallet address 930 correspond to the black market wallet address, This may be collected and clustered as a wallet address 940 associated with the black market wallet address.

8 is a flowchart illustrating that the processor clusters black market wallet addresses according to some embodiments of the present disclosure.

Referring to FIG. 8 , the processor 110 may determine a black market wallet address ( S100 ).

In the present disclosure, the black market wallet address may mean an address of a cryptocurrency wallet/cryptocurrency wallet owned and used by a real entity operating a black market to provide an escrow service.

The processor 110 according to some embodiments of the present disclosure provides information on a time interval between a deposit transaction related to a wallet address and a withdrawal transaction related to the wallet address, the number of transactions related to the wallet address, and the balance of the wallet address Alternatively, the black market wallet address may be determined based on at least one of a time interval between withdrawal transactions.

As mentioned in FIG. 3 , the cryptocurrency wallet 400 generally used in the black market may have a characteristic that the time interval between the deposit transaction and the withdrawal transaction is short or that the withdrawal transaction is performed at a predetermined time interval. In addition, there may be a feature of having a large number of transactions 420 for a short period of time compared to general cryptocurrency wallets. In addition, the total amount deposited 430 and the total amount withdrawn 440 may be the same, and thus the balance 450 may be 0. In addition, it may have a characteristic that it is not used anymore after being used for a certain period of time.

The processor 110 may determine whether a specific cryptocurrency wallet address is operated by a black market using the above-described features. For example, if an arbitrary cryptocurrency wallet address has more than a preset ratio (eg, half) among the features of the black market wallet address, the processor 110 may determine it as the black market wallet address.

The black market wallet address of the present disclosure is any one of the wallet addresses included in the wallet address 410 of FIG. 3 , the deposit transaction 531 and the withdrawal transaction 532 of FIG. 4 , and a password included in the web page of FIG. It may be collected and determined as at least one of the currency wallet addresses 610 .

The above is only an example of a method for collecting and determining a black market wallet address, and the method for collecting and determining a black market wallet address is not limited thereto.

These wallet addresses may be diagrammed as a black market wallet address 910 in FIG. 7 .

The processor 110 may recognize one or more transactions performed for the black market wallet address (S200).

The processor 110 may recognize one or more transactions performed on the determined black market wallet address by reviewing the transaction details of the black market wallet address determined in step S100 .

As an example, the transaction details of the black market wallet address may be the transaction details 500 shown in FIG. 4 . The processor 110 may recognize individual transaction deposit transactions 531 and withdrawal transactions 532 included in the transaction details 500 . However, this is only an example of a method for recognizing one or more transactions performed on a black market wallet address. Accordingly, the method for recognizing one or more transactions performed against a black market wallet address is not limited thereto.

The processor 110 may collect wallet addresses connected to the black market wallet address based on one or more transactions ( S300 ).

In the present disclosure, the connected wallet addresses may refer to wallet addresses that have performed an action, such as receiving cryptocurrency from the determined black market wallet address or transferring cryptocurrency to the determined black market wallet address.

These linked wallet addresses may be collected by tracking all transactions related to the determined black market wallet address.

Taking the above-mentioned drawings as an example, the connected wallet addresses according to the present disclosure may include wallet addresses included in the deposit transaction 531 and the withdrawal transaction 532 of FIG. 4 .

The processor 110 may cluster the black market wallet address and the collected wallet addresses into one group (S400).

In the present disclosure, clustering may mean including the cryptocurrency wallet addresses owned and used by the black market operator in one group.

The processor 110 may perform clustering by including the black market wallet address and the connected wallet addresses collected through step S300 into one group.

Accordingly, illegal transactions made on the black market can be tracked based on blockchain technology and cryptocurrency. In addition, just by knowing one wallet address used in the black market, it is possible to identify multiple related wallet addresses at once. The tracking and sanctions of illegal transactions and related cryptocurrency wallets can be facilitated.

The processor 110 may recognize the transaction termination time of the wallet addresses clustered into one group (S500).

In general, it is known that black market operators only use the generated cryptocurrency wallet address for a certain period of time and no longer use it. This allows operating entities to avoid tracking by investigative and judicial authorities.

Correspondingly, the processor 110 may recognize a transaction termination time of each of the clustered wallet addresses in order to identify wallets that are no longer used among the clustered wallet addresses.

The processor 110 may exclude from the group at least one wallet address for which the transaction end time is longer than a preset period (S600).

When wallet addresses that have not been transacted for more than a certain period of time are continuously stored in a group, the amount of computation of the processor 110 may be unnecessarily increased during additional tracking and clustering.

Accordingly, by periodically selecting wallet addresses for which transactions have been terminated (which are no longer operated by the black market) and excluding them from the group, it is possible to efficiently perform black market wallet address tracking according to the present disclosure.

9 is a flowchart illustrating that a processor determines a first black market wallet address according to some embodiments of the present disclosure.

The processor 110 may recognize a withdrawal transaction generated by combining a wallet address collected using a web crawler and one or more other wallet addresses (S110).

As described above in FIG. 5 , in the present disclosure, a web crawler may refer to a module that takes data from the Internet and processes the data into a form that is easy to analyze data.

For example, the processor 110 according to the present disclosure may collect black market wallet addresses using the web crawler.

If you use a web crawler to collect black market wallet addresses, you can automatically collect black market wallet addresses for numerous web pages. Accordingly, the number of black market wallet addresses and wallet addresses associated therewith that can be simultaneously collected may increase. Accordingly, tracking and sanctions for illegal transactions performed by the black market can be facilitated.

Client programs related to general blockchain and cryptocurrency wallets can support multiple addresses to create one transaction by combining them. However, these clients may not generally support multiple users to create one transaction. Therefore, even in the case of a transaction in which withdrawals are made from multiple wallet addresses, it can be considered that the transaction is generated by one user. In this case, it can be considered that a plurality of wallet addresses from which withdrawals are made are associated with one user.

The processor 110 may determine each of the wallet address and one or more other wallet addresses collected using the web crawler included in the withdrawal transaction as the black market wallet address (S120).

In addition to the above-described characteristics, black market wallet addresses have a characteristic that deposits and withdrawals are performed only with each other other than deposits and withdrawals for buyers and sellers.

Based on this feature, when cryptocurrency is transferred from a plurality of wallet addresses including a black market wallet address to a single cryptocurrency wallet address, a plurality of wallet addresses from which withdrawals are made is a wallet operated by a black market operating entity. address can be considered.

Accordingly, the processor 110 may determine a plurality of wallet addresses from which cryptocurrency is withdrawn as a black market wallet address serving as a starting point for performing the clustering operation. In this case, the processor 110 may discover more black market wallet addresses at the same time by applying the clustering technique according to the present disclosure to each of the plurality of wallet addresses.

Using this feature, even if only one black market wallet address is specified, multiple black market wallet addresses can be discovered at once. Therefore, it may be easy to track illegal trading activities in the black market.

Since this is only one example of a method for clustering a plurality of wallet addresses for a user, the method for clustering is not limited thereto.

10 is a flowchart illustrating that a processor collects wallet addresses associated with a black market wallet address according to some embodiments of the present disclosure.

Referring to FIG. 10 , the processor 110 may recognize one or more derivative transactions derived from one or more transactions ( S310 ).

In the present disclosure, a derivative transaction may mean a transaction newly created based on a previous transaction deposited to a cryptocurrency wallet address.

Referring back to FIG. 6 , it can be confirmed that 0.06131465 BTC has been deposited into the wallet address 411 through the second transaction 710b. And, it can be seen through the left arrow of the derivative transaction 800 that the wallet address 411 already additionally holds 0.30815704 BTC.

The subject related to the wallet address 411 may create a new transaction by combining the amount already held by the wallet address 411 with the amount deposited through the second transaction 710b, and a derivative transaction 800 is an example of that.

As described above, the black market wallet addresses have the characteristic of transmitting cryptocurrencies only to each other. Therefore, it is highly likely that all wallet addresses where deposits and withdrawals are performed in the derivative transaction are owned by the subject related to the black market wallet address. Accordingly, the processors 110 may cluster all cryptocurrency wallet addresses included in the derivative transaction 800 for one subject.

Referring back to FIG. 10 , the processor 110 may collect one or more wallet addresses included in each of the derivative transactions as connected wallet addresses ( S320 ).

Black market wallet addresses perform deposits and withdrawals only with each other, except for deposits and withdrawals for buyers and sellers.

Based on this feature, when cryptocurrency is transferred from a plurality of wallet addresses including the black market wallet address to one cryptocurrency wallet address, the plurality of wallet addresses from which withdrawals are made are called wallet addresses connected to the black market wallet address. can judge

Even in the case of the derivative transaction 800, if at least one of the cryptocurrency wallet addresses included in the derivative transaction 800 is a black market wallet address or a wallet address connected thereto, the remaining wallet addresses included in the derivative transaction 800 are also black. It may be a wallet address associated with the market wallet address. Accordingly, the processor 110 may determine all wallet addresses included in the derivative transaction 800 as the connected wallet addresses and cluster them into one group.

Using this feature, even if only one black market wallet address is specified, multiple black market wallet addresses can be discovered at once. Therefore, it may be easy to track illegal trading activities in the black market.

Since this is only one example of a method for clustering a plurality of wallet addresses for a user, the method for clustering is not limited thereto.

11 is a flowchart illustrating that a processor collects wallet addresses associated with a black market wallet address according to some embodiments of the present disclosure.

Referring to FIG. 11 , the processor 110 may recognize a withdrawal transaction generated by combining one or more wallet addresses included in the derivative transaction with one or more other wallet addresses ( S330 ).

Client programs related to general blockchain and cryptocurrency wallets support the creation of one transaction by combining multiple addresses. However, these clients generally do not support multiple users to create one transaction (as of the filing date). Therefore, even in the case of a transaction in which withdrawals are made from multiple wallet addresses, it can be considered that the transaction is generated by one user. Therefore, in this case, it can be seen that a plurality of wallet addresses from which withdrawals are made are associated with one user.

Referring back to FIG. 4 , in the withdrawal transaction 532 , withdrawal was performed by a plurality of wallet addresses on the left side of the arrow. However, as described above, due to the characteristics of the cryptocurrency client, it can be seen that the plurality of wallet addresses are all owned by the same blockchain or cryptocurrency user.

Based on these characteristics, the processor 110 may determine the plurality of wallet addresses as wallet addresses connected to the black market wallet address. Accordingly, the processor 110 may cluster the black market wallet address and the connected wallet addresses for one cryptocurrency user. That is, as in the withdrawal transaction 532 , when withdrawal is performed by a plurality of wallet addresses in one transaction, the plurality of wallet addresses may be clustered for one user.

Since this is only one example of a method for clustering a plurality of wallet addresses for a user, the method for clustering is not limited thereto.

Referring back to FIG. 11 , the processor 110 may collect one or more wallet addresses and one or more other wallet addresses included in the derivative transaction, respectively, as connected wallet addresses ( S340 ).

In the present disclosure, the linked wallet addresses may refer to wallet addresses that have performed an action, such as receiving cryptocurrency from the determined black market wallet address or transferring cryptocurrency to the determined black market wallet address.

These linked wallet addresses may be collected by tracking all transactions related to the determined black market wallet address.

Taking the above-mentioned drawings as an example, the connected wallet addresses according to the present disclosure may include wallet addresses included in the deposit transaction 531 and the withdrawal transaction 532 of FIG. 4 .

As described above, even if only one black market wallet address is specified, a plurality of black market wallet addresses can be found at once. Therefore, it may be easy to track illegal trading activities in the black market.

12 shows a simplified, general schematic diagram of an example computing environment in which some embodiments of the present disclosure may be implemented.

The computer 1102 shown in FIG. 12 may correspond to at least one of the computing device 100 and the computing device included in the blockchain network 200 .

Although the present disclosure has been described above generally in the context of computer-executable instructions that may be executed on one or more computers, those skilled in the art will appreciate that the present disclosure may be implemented as a combination of hardware and software and/or in combination with other program modules. you will know

Generally, modules herein include routines, procedures, programs, components, data structures, etc. that perform particular tasks or implement particular abstract data types. In addition, those skilled in the art will appreciate that the methods of the present disclosure can be applied to single-processor or multiprocessor computer systems, minicomputers, mainframe computers as well as personal computers, handheld computing devices, microprocessor-based or programmable consumer electronics, etc. (each of which is It will be appreciated that other computer system configurations may be implemented, including those that may operate in connection with one or more associated devices.

The described embodiments of the present disclosure may also be practiced in distributed computing environments where certain tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

Computers typically include a variety of computer-readable media. Media accessible by a computer includes volatile and nonvolatile media, transitory and non-transitory media, removable and non-removable media. By way of example, and not limitation, computer-readable media may include computer-readable storage media and computer-readable transmission media.

Computer readable storage media includes volatile and nonvolatile media, temporary and non-transitory media, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. includes media. A computer-readable storage medium may be RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital video disk (DVD) or other optical disk storage device, magnetic cassette, magnetic tape, magnetic disk storage device, or other magnetic storage device. device, or any other medium that can be accessed by a computer and used to store the desired information.

Computer readable transmission media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and Includes all information delivery media. The term modulated data signal means a signal in which one or more of the characteristics of the signal is set or changed so as to encode information in the signal. By way of example, and not limitation, computer-readable transmission media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above are also intended to be included within the scope of computer-readable transmission media.

An example environment 1100 implementing various aspects of the disclosure is shown including a computer 1102 , the computer 1102 including a processing unit 1104 , a system memory 1106 , and a system bus 1108 . do. A system bus 1108 couples system components, including but not limited to system memory 1106 , to the processing device 1104 . The processing device 1104 may be any of a variety of commercially available processors. Dual processor and other multiprocessor architectures may also be used as processing unit 1104 .

The system bus 1108 may be any of several types of bus structures that may further interconnect a memory bus, a peripheral bus, and a local bus using any of a variety of commercial bus architectures. System memory 1106 includes read only memory (ROM) 1110 and random access memory (RAM) 1112 . A basic input/output system (BIOS) is stored in non-volatile memory 1110, such as ROM, EPROM, EEPROM, etc., the BIOS is the basic input/output system (BIOS) that helps transfer information between components within computer 1102, such as during startup. contains routines. RAM 1112 may also include high-speed RAM, such as static RAM, for caching data.

The computer 1102 may also include an internal hard disk drive (HDD) 1114 (eg, EIDE, SATA) - this internal hard disk drive 1114 may also be configured for external use within a suitable chassis (not shown). Yes—a magnetic floppy disk drive (FDD) 1116 (eg, for reading from or writing to removable diskette 1118), and an optical disk drive 1120 (eg, a CD-ROM) for reading from, or writing to, disk 1122, or other high capacity optical media, such as DVD. The hard disk drive 1114 , the magnetic disk drive 1116 , and the optical disk drive 1120 are connected to the system bus 1108 by the hard disk drive interface 1124 , the magnetic disk drive interface 1126 , and the optical drive interface 1128 , respectively. ) can be connected to Interface 1124 for external drive implementation includes, for example, at least one or both of Universal Serial Bus (USB) and IEEE 1394 interface technologies.

These drives and their associated computer-readable media provide non-volatile storage of data, data structures, computer-executable instructions, and the like. In the case of computer 1102, drives and media correspond to storing any data in a suitable digital format. Although the description of computer-readable storage media above refers to HDDs, removable magnetic disks, and removable optical media such as CDs or DVDs, those skilled in the art will use zip drives, magnetic cassettes, flash memory cards, cartridges, It will be appreciated that other tangible computer-readable storage media and the like may also be used in the exemplary operating environment and any such media may include computer-executable instructions for performing the methods of the present disclosure. .

A number of program modules may be stored in the drive and RAM 1112 , including an operating system 1130 , one or more application programs 1132 , other program modules 1134 , and program data 1136 . All or portions of the operating system, applications, modules, and/or data may also be cached in RAM 1112 . It will be appreciated that the present disclosure may be implemented in various commercially available operating systems or combinations of operating systems.

A user may enter commands and information into the computer 1102 via one or more wired/wireless input devices, for example, a pointing device such as a keyboard 1138 and a mouse 1140 . Other input devices (not shown) may include a microphone, IR remote control, joystick, game pad, stylus pen, touch screen, and the like. Although these and other input devices are connected to the processing unit 1104 through an input device interface 1142 that is often connected to the system bus 1108, parallel ports, IEEE 1394 serial ports, game ports, USB ports, IR interfaces, and the like may be connected by other interfaces.

A monitor 1144 or other type of display device is also coupled to the system bus 1108 via an interface, such as a video adapter 1146 . In addition to the monitor 1144, the computer typically includes other peripheral output devices (not shown), such as speakers, printers, and the like.

Computer 1102 may operate in a networked environment using logical connections to one or more remote computers, such as remote computer(s) 1148 via wired and/or wireless communications. Remote computer(s) 1148 may be workstations, server computers, routers, personal computers, portable computers, microprocessor-based entertainment devices, peer devices, or other common network nodes, and are generally Although including many or all of the components described, only memory storage device 1150 is shown for simplicity. The logical connections shown include wired/wireless connections to a local area network (LAN) 1152 and/or a larger network, eg, a wide area network (WAN) 1154 . Such LAN and WAN networking environments are common in offices and companies, and facilitate enterprise-wide computer networks, such as intranets, all of which can be connected to a worldwide computer network, for example, the Internet.

When used in a LAN networking environment, the computer 1102 is coupled to the local network 1152 through a wired and/or wireless communication network interface or adapter 1156 . Adapter 1156 may facilitate wired or wireless communication to LAN 1152 , which LAN 1152 also includes a wireless access point installed therein for communicating with wireless adapter 1156 . When used in a WAN networking environment, the computer 1102 may include a modem 1158 , connected to a communication server on the WAN 1154 , or otherwise establishing communications over the WAN 1154 , such as over the Internet. have the means A modem 1158 , which may be internal or external and a wired or wireless device, is coupled to the system bus 1108 via a serial port interface 1142 . In a networked environment, program modules described for computer 1102 , or portions thereof, may be stored in remote memory/storage device 1150 . It will be appreciated that the network connections shown are exemplary and other means of establishing a communication link between the computers may be used.

The computer 1102 may be associated with any wireless device or object that is deployed and operates in wireless communication, for example, a printer, scanner, desktop and/or portable computer, portable data assistant (PDA), communication satellite, wireless detectable tag. It operates to communicate with any device or place, and phone. This includes at least Wi-Fi and Bluetooth wireless technologies. Accordingly, the communication may be a predefined structure as in a conventional network or may simply be an ad hoc communication between at least two devices.

Wi-Fi (Wireless Fidelity) makes it possible to connect to the Internet, etc. without a wired connection. Wi-Fi is a wireless technology such as cell phones that allows these devices, eg, computers, to transmit and receive data indoors and outdoors, ie anywhere within range of a base station. Wi-Fi networks use a radio technology called IEEE 802.11 (a,b,g, etc) to provide secure, reliable, and high-speed wireless connections. Wi-Fi can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 or Ethernet). Wi-Fi networks may operate in unlicensed 2.4 and 5 GHz radio bands, for example, at 11 Mbps (802.11a) or 54 Mbps (802.11b) data rates, or in products that include both bands (dual band). have.

Those of ordinary skill in the art of the present disclosure will recognize that the various illustrative logical blocks, modules, processors, means, circuits, and algorithm steps described in connection with the embodiments disclosed herein include electronic hardware, (convenience For this purpose, it will be understood that it may be implemented by various forms of program or design code (referred to herein as "software") or a combination of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. A person skilled in the art of the present disclosure may implement the described functionality in various ways for each specific application, but such implementation decisions should not be interpreted as a departure from the scope of the present disclosure.

The various embodiments presented herein may be implemented as methods, apparatus, or articles of manufacture using standard programming and/or engineering techniques. The term “article of manufacture” includes a computer program, carrier, or media accessible from any computer-readable device. For example, computer-readable storage media include magnetic storage devices (eg, hard disks, floppy disks, magnetic strips, etc.), optical disks (eg, CDs, DVDs, etc.), smart cards, and flash drives. memory devices (eg, EEPROMs, cards, sticks, key drives, etc.). The term “machine-readable medium” includes, but is not limited to, wireless channels and various other media that can store, hold, and/or convey instruction(s) and/or data.

It is to be understood that the specific order or hierarchy of steps in the presented processes is an example of exemplary approaches. Based on design priorities, it is to be understood that the specific order or hierarchy of steps in the processes may be rearranged within the scope of the present disclosure. The appended method claims present elements of the various steps in a sample order, but are not meant to be limited to the specific order or hierarchy presented.

The description of the presented embodiments is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the embodiments presented herein, but is to be construed in the widest scope consistent with the principles and novel features presented herein.

Claims (10)

A computer program stored on a computer-readable storage medium, the computer program comprising instructions for causing a processor to perform the following steps, the steps comprising:
Recognizing whether or not a cryptocurrency wallet address is included in a web page related to the black market using a web crawler based on a regular expression expressing a set of strings with specific rules;
determining the cryptocurrency wallet address as a black market wallet address when the cryptocurrency wallet address exists on the web page;
recognizing one or more transactions performed against the black market wallet address;
collecting wallet addresses associated with the black market wallet address based on the one or more transactions; and
clustering the black market wallet address and the wallet addresses into one group;
containing,
A computer program stored in a computer-readable storage medium.
The method of claim 1,
The step of determining the black market wallet address includes:
based on at least one of a time interval between a deposit transaction associated with a wallet address and a withdrawal transaction associated with the wallet address, the number of transactions associated with the wallet address, information about a balance of the wallet address, or a time interval between withdrawal transactions. determining a black market wallet address;
containing,
A computer program stored in a computer-readable storage medium.
The method of claim 1,
The step of determining the black market wallet address includes:
recognizing a withdrawal transaction generated by combining a wallet address collected using the web crawler and one or more other wallet addresses; and
determining each of the wallet address and the one or more other wallet addresses collected using the web crawler included in the withdrawal transaction as the black market wallet address;
containing,
A computer program stored in a computer-readable storage medium.
The method of claim 1,
Collecting wallet addresses associated with the black market wallet address based on the one or more transactions includes:
recognizing one or more derivative transactions derived from the one or more transactions; and
collecting one or more wallet addresses included in each of the derivative transactions as the linked wallet addresses;
containing,
A computer program stored on a computer-readable storage medium.
5. The method of claim 4,
Collecting wallet addresses associated with the black market wallet address based on the one or more transactions includes:
recognizing a withdrawal transaction generated by combining one or more wallet addresses included in each of the derivative transactions with one or more other wallet addresses; and
collecting each of the one or more wallet addresses and the one or more other wallet addresses included in the derivative transaction as the linked wallet addresses;
further comprising,
A computer program stored in a computer-readable storage medium.
The method of claim 1,
Based on the one or more transactions, the wallet addresses associated with the black market wallet address are:
Collected using the characteristics of the mixing service wallet address related to the cryptocurrency mixing service,
A computer program stored in a computer-readable storage medium.
7. The method of claim 6,
The mixing service wallet address is,
Determined based on whether the amount included in the transaction related to the mixing service wallet address is a wallet address that matches a preset criterion,
A computer program stored in a computer-readable storage medium.
7. The method of claim 6,
The wallet addresses associated with the black market wallet address are,
Among the wallet addresses related to one or more transactions collected from the black market wallet address, it is a wallet address excluding the mixing service wallet address,
A computer program stored in a computer-readable storage medium.
The method of claim 1,
recognizing a transaction termination time of the wallet addresses clustered into the one group; and
excluding from the group at least one wallet address for which the transaction end time is longer than a preset period;
further comprising,
A computer program stored in a computer-readable storage medium.
processor;
Memory; and
communication department;
including,
The processor is
It uses a web crawler to recognize whether a black market-related web page contains a cryptocurrency wallet address based on a regular expression that expresses a set of strings with specific rules,
If the cryptocurrency wallet address exists on the web page, the cryptocurrency wallet address is determined as a black market wallet address,
recognizing one or more transactions performed on the black market wallet address, collecting wallet addresses associated with the black market wallet address based on the one or more transactions, and
clustering the black market wallet address and the connected wallet addresses into one group,
computing device.

Images