Forensic tools for the analysis of virtual currencies for law enforcement agencies and fintech

The GraphSense platform is an open source platform for analyzing cryptocurrency transaction ledgers. At the moment, it supports analysis of Bitcoin, Bitcoin Cash, Litecoin, and Zcash transactions. In numerous research projects the Austrian research center AIT Austrian Institute of Technology has developed the GraphSense analysis platform to quickly extract relevant information from the blockchain using highly powerful big data technologies and sophisticated algorithms. The special feature of the development of GraphSense was the enormous volume of transaction data in the digital ecosystem Bitcoin. The address graph at Bitcoin comprised around 144 million nodes (addresses) and around 1 billion edges (transactions) at the time of platform development. Every day, 200,000 new transactions were added to the blockchain.

The techniques used to identify addresses that are likely to be assigned to the same real actor allow platform users to quickly and efficiently perform micro (payment flow tracking) and macro (anomaly analysis) investigations and extract relevant information. GraphSense can process hundreds of gigabytes in minutes. The tool GraphSense is not only suitable as a forensic tool to combat organised financial crime and illegal activities in the "Darknet“, but also has great potential for use by fintechs, banks, insurance companies, energy providers and operators of large industrial plants , because virtual currencies as a decentralised and at the same time transparent form of payment and transaction technology are finding their way into more and more industries, and because "Smart Contracts" in the blockchain allow new automated routines (e.g. error diagnoses in industry). The forensic open source platform has been further developed in several international R&D projects and today supports the investigation of the crypto currency transaction directories Bitcoin, Bitcoin Cash, Litecoin and Zcash. It offers an intuitive user interface.

• address clustering : GraphSense partitions the set of addresses observed in a cryptocurrency ecosystem into maximal subsets (clusters) that are likely to be controlled by the same real-world actor.
• network abstractions : GraphSense computes two forms of network abstractions from the underlying blockchain: the address graph, which connects addresses via transactions, and the cluster graph, which connects address clusters.
• microscopic analysis : with the GraphSense dashboard users can inspect transactions and trace currency flows by navigating along the transaction graph abstractions.
• macroscopic analysis : by directly accessing the underlying, pre-computed database it is possible to map real-world phenomena (e.g., Ransomware) onto network abstractions and run subsequent analytics tasks.
• pre-computed statistics : GraphSense pre-computes statistics and supports interactive analyses without major delays.
• BlockSci integration : GraphSense uses BlockSci for parsing blockchains and obtaining exchange rates.
• horizontal scalability : cryptocurrency blockchains are growing and new currencies appear on the horizon. GraphSense should be future-proof, because it is built on Apache Spark and Cassandra for horizontal scalability.