Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers - - PowerPoint PPT Presentation

Generalizing BlockSci to Cross-Chain Analyses

• f Forked Ledgers

Master’s Thesis Defensio, September 14th 2020 Martin Plattner, Universität Innsbruck

martin@mplattner.at

Agenda

• Motivation
• Implementing the Multi-Chain Mode for BlockSci
• Cross-Chain Address Clustering
• Conclusion

Motivation

and Preliminaries

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

Motivation

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Ledger

Motivation

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Ledger Single-chain analysis

Motivation

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Ledger Single-chain analysis BlockSci

Blockchain analysis tool

Motivation

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Ledger

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Forked Ledger BlockSci

Blockchain analysis tool

Single-chain analysis

Bitcoin Cash (Aug 2017)

Hard-Fork

due to changed rules

Motivation

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Ledger

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Forked Ledger BlockSci

Blockchain analysis tool

Single-chain analysis

Bitcoin Cash (Aug 2017)

Hard-Fork

due to changed rules I O I

Motivation

BlockSci

Blockchain analysis tool BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Ledger Forked Ledger Cross-chain analysis

Bitcoin Cash (Aug 2017)

Hard-Fork

due to changed rules

Motivation

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

Generalizing BlockSci to Cross-Chain Analyses of Forked Ledgers

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Ledger Forked Ledger BlockSci

Blockchain analysis tool + multi-chain mode

Cross-chain analysis Main contribution Multi-chain mode for BlockSci

Motivation

BlockSci

BlockSci parser

BlockSci

BlockSci parser Optimized blockchain data

• n disk

BlockSci

Optimized blockchain data (in memory)

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BlockSci parser Optimized blockchain data

• n disk

mmap()

BlockSci

Optimized blockchain data (in memory)

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BlockSci parser Optimized blockchain data

• n disk

mmap()

Goal

Optimized blockchain data (in memory)

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BlockSci parser Optimized blockchain data

• n disk

mmap()

Implementing the Multi-Chain Mode

Requirements, Required Changes, Evaluation

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

A3 A3 A3

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

A3 A3 A3

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

A3 A3 A3

BLOCK x

tx1, tx2, ...

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

I O I

Output.getSpendingInputs() → [ , ]

O I I

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

Requirements

Type No. Requirement Priority Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

# /bch/config.json "chainConfig": { "coinName": "bitcoin_cash", "dataDirectory": "/bch/", "parentChainConfigPath": "/btc/config.json", "firstForkedBlockHeight": 478559, "pubkeyPrefix": [0], "scriptPrefix": [5], "segwitActivationHeight": 481824, "segwitPrefix": "bc" }

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

A3 A3 A3

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

I O I

Required Changes

Parser Data layout Analysis library Config file

support links between chains multi-chain mode cross-chain address de-duplication chain-specific data shareable data handle new layout share common data in memory

BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

I O I

Usage

Evaluation

Type No. Requirement Priority Result Functional 1 Normalized addresses MUST 2 BTC and BCH support MUST 3 Flexible configuration MUST 4 Anticipate cross-chain queries MUST Non-functional 1 Optimize memory consumption MUST 2 Maintain high performance SHOULD 3 Backwards compatibility (API) SHOULD 4 Extensibility SHOULD

Evaluation

• Performance

○ Benchmarked 8 real-world queries ○ On avg. 7% slower

Cross-Chain Address Clustering

Method, Results

Cross-Chain Address Clustering

A1 A2 A3 A4

BTC

single-chain clustering

Cross-Chain Address Clustering

A1 A2 A3 A4

BTC

single-chain clustering BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

I O

Cross-Chain Address Clustering

A1 A2 A3 A4

BTC

single-chain clustering

A1 A2 A3

BCH

single-chain clustering BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

O I

Cross-Chain Address Clustering

A1 A2 A3 A4

BTC

single-chain clustering

A1 A2 A3

BCH

single-chain clustering BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

O I

Addresses are normalized in the new multi-chain mode

Cross-Chain Address Clustering

A1 A2 A3 A4

BTC

single-chain clustering

A1 A2 A3

BCH

single-chain clustering

A1 A2 A3 A4

BTC ← BCH

cross-chain clustering BLOCK 1

tx1, tx2, ...

BLOCK 2

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

BLOCK 3

tx1, tx2, ...

BLOCK x

tx1, tx2, ...

O I

Cross-Chain Address Clustering: Results

A1 A2 A3 A4

BTC

single-chain clustering

A1 A2 A3

BCH

single-chain clustering

A1 A2 A3 A4

BTC ← BCH

cross-chain clustering

1.05 million additional cluster merges (new edges) as of Dec 2017

Affects 100,000 users with 30 million addresses (3% of all Bitcoin addresses)

Conclusion

Conclusion

• Forks offer a powerful data source due to the links between chains
• Implemented multi-chain mode for cross-chain analyses of forked ledgers
• Cross-chain clustering: found that privacy of users can be hurt across chains
• Contributed my work to USENIX Security ‘20 paper [1]

[1] Kalodner, H., Möser, M., Lee, K., Goldfeder, S., Plattner, M., Chator, A., & Narayanan, A. (2020). Blocksci: Design and applications of a blockchain analysis platform. In 29th USENIX Security Symposium (pp. 2721-2738).

Conclusion

• Forks offer a powerful data source due to the links between chains
• Implemented multi-chain mode for cross-chain analyses of forked ledgers
• Cross-chain clustering: found that privacy of users can be hurt across chains
• Contributed my work to USENIX Security ‘20 paper [1]

[1] Kalodner, H., Möser, M., Lee, K., Goldfeder, S., Plattner, M., Chator, A., & Narayanan, A. (2020). Blocksci: Design and applications of a blockchain analysis platform. In 29th USENIX Security Symposium (pp. 2721-2738).

Thanks.

Questions, thoughts, feedback?

Acknowledgments 1. TITANIUM: Tools for the Investigation of Transactions in Underground Markets. (EU H2020) 2. VIRTCRIME: Forensic Methods and Solutions for the Analysis of Criminal Transactions in Post-Bitcoin Cryptocurrencies. (Austrian Research Promotion Agency FFG)