Snapshot Samplings of the Bitcoin Transaction Network and Analysis of Cryptocurrency Growth

While we could have joined the blockchain network and downloaded a copy of the public ledger to build our network graph, we felt that it would not be an efficient method of evaluating the current status of the BTC network. As a result, we decided to utilize a web socket API from BlockChain.Info. This API allowed us to stream live transactions as they were on their way to be confirmed. Each transaction came in as a JavaScript Object Notation (JSON) file and a script was written to extract and parse out the sender address, receiver address, and the BTC amount variables. These variables were stored as a comma separated file (.csv). The web socket ran for a total of six hours and separate csv files were generated at the one hour, two hour, and six hour time points; hence the snapshots. One of our objectives was to investigate possible changes in network characteristics with different sample sizes and durations. In other words, we are interested to see if any network metrics change as the network grows within our sampling snapshots. It is important to note that the web socket performed a continuous data collection and was not interrupted when the one hour and two hour samples were taken. The resulting one hour and two hour samples are sub sets of the six hour sample with the one hour sample also being a subset of the two hour sample.

The csv files for the one, two, and six hour samplings were imported into Gephi (Bastian et al., 2009) to generate a graph of the sampled BTC network. The csv files were imported as edge list where the sending address corresponded to the “source” and the receiving address corresponded to the “target”. The amount was converted from Satoshis to BTCs, 1 BTC = $1$x$10^{-8}$ Satoshi, and stored as a float, an edge attribute. Graph files were exported as .graphml for further data processing.

Graph metrics were analyzed with R utilizing the igraph, poweRlaw, and linkcomm packages (Csardi et al., 2006). Transitivity, average degree, average distance, reciprocity, degree distribution, and maximal cliques were measured for each snapshot graph and compared to each other. The largest connected components were also extracted from each of the three sample graphs and metrics were computed with igraph. The six hour connected graph was further evaluated for the presence of communities. Using the linkcomm package and the getlinkcommunities, by Alex T. Kalinka, we were able to generate community’s nodes that linked to every node of a particular community (Csardi et al., 2006). Investigating community structures in the giant connected component may reveal BTC user financial behavior; in particular who exchanges money with whom.

Network analysis was performed on all three graphs with the purpose of investigating changes as the time and the size of the sample network increased as well as for comparison to previously reported findings. Analyzing the difference in resulting graph metrics would help in determining an appropriate sampling window that would yield a sample graph that is representative of the network as a whole. Table 1 contains the metrics calculated for all three network graphs.

Across all three sample graphs, reciprocity, global transitivity, and mean degree were consistent. These metrics changed only slightly as the graph grew over the 6 hours. Transitivity was low for all three graphs, which was to be expected. Transitivity would increase when, for example, someone sent BTC to two separate people and those two people exchanged BTC with each other. This is not a likely event and this is why we expected it to be low. All three graphs had a low mean degree with the largest mean degree value being 1.32 for the six hour sample graph. A low mean degree would help to explain a low transitivity since a low mean degree indicates that the majority of the nodes in a graph have only one edge. Nodes need a minimum of two edges for transitivity. The mean degree values for each graph indicate that most addresses execute only one transaction. The number of dyads implies that the graph is primarily composed of pairs of nodes that share only one edge. For each sample graph, dyads account for the majority of nodes in the network. Triads make up a significantly lesser portion of the graph. We did not expect to see many triads or cliques during our sampling. In the short term, it is unlikely that triads form because it would mean that some money comes back to the original sender implying that some portion of that transaction should not have been sent out in the first place. However, goods or services could have been exchanged among the triad which would explain its formation. The network is built only on BTC transactions and thus we do not know the exact motive behind each transaction. A longer sampling would probably have led to more triads and possibly greater maximal cliques. However, it is just as likely that the number of pairs of nodes would have increased at a similar rate.

Reciprocity was also low. This was expected for this type of network. It is unlikely that a node would reciprocate an edge because that would be like person A sending 1 BTC to person B in the first transaction then person B sending back, to person A, a given amount of BTC in a second transaction. The first and second transaction can be combined into one and the net amount, the difference in the amount between the first and second transaction, should be sent to the appropriate person which would eliminate an edge in one direction. The reciprocity value is small for all graphs but it is not zero which means that there are instance of reciprocating edges. The instances where a user sends the wrong amount to another user who, is kind enough to correct the transaction and send it back to the person it originated from may be an instance for reciprocation. Returning goods and getting a refund on something bought with BTC is another instance that may warrant reciprocation. Reciprocation can also be the result of gambling sites where, gamblers gamble in BTC and earn their winnings in BTC too. These instances are rare and small in comparison to the vast number of transactions constantly being received. The rarity of reciprocity is reflected in the zero value obtained for all sample graphs.

Visual representations of each samples size graph, density, and connections are show in Figure 3. The density of the graph increase as sampling time increases. Dark black spots are star like structures consisting of clusters of nods around a single node with a high degree. As time goes on, more nodes form edges to these central nodes which increase the size of the black spots. However, it does not appear that links are formed from one high degree node to another. Nodes with high degree seem to increase their degree as more nodes join the network which exhibits characteristics of preferential attachment and implies a possible scale free network (Barabási et al., 2016; Kondor et al., 2014).

Scale free networks are characterized by having a power-law degree distribution. We investigated the degree distribution in Figure 5. Here we see that the degree distribution for all sample networks is heavily tailed to the right which is characteristic of power-law distributions.

The degree distributions for each graph was plotted in conjunction with exponential, log normal, power law, and Poisson best fit lines. Results in Figure 6 would indicate that the one hour and two hour graphs do not fit any particular trend. However, when $X$min was set at 4, the six hour distribution seemed to fit the power law distribution. Kolmogorov-Smirnov test results in a p value of 0.46 which indicates that we cannot reject the hypothesis that the six hour distribution fits a power law (Csardi et al., 2006).

Evidence of a power law distribution were seen in our largest graph which was sampled for the longest period of time. It would appear that smaller samplings of the network do not resemble a scale-free network however, the largest sampling started to show evidence of a power law distribution which is indicative of a scale-free network. It is likely that a longer sampling window would yield a larger graph in which a power law is more apparent.

Although the graphs are mainly composed of pairs of nodes, we were interested in the presence of communities. We extracted the largest connected component from the sample graphs. This left us with graphs that excluded the many isolated pairs of nodes. Metrics were calculated and are shown in Table 2.

Directedness was not taken into account when extracting the giant components from each graph. Each sub graph is significantly smaller than its original graph implying again that the graphs are primarily made up of isolated pairs of nodes. This means that, during the sampling window, addresses only sent one transaction. For the giant component subgraphs, the metrics were not consistent across all giant component subgraphs, as seen in the original graphs.

Our analysis showed that the six hour graph showed to be the best representative sample network. Therefore, we chose to run community detection on the six hour giant component subgraph. The resulting graphs can be viewed in the appendix. Figures 7 are sub graphs of the graph, Figure 8, in the appendix.

Both graphs represent the two biggest communities contained in the six hour giant component graphs and they have slightly different structure. Figure 7(a) illustrates a community in which many nodes share edges with one central node. This creates a star like structure seen in most of the other communities. The second community in Figure 7(b) does not contain a single node with a high degree. Most of the nodes have the same degree and yet they form a community. This would imply that the nodes are more interconnected to each other, as there is no distinct hub or authority. Figure 7(b) represents more of a decentralized community.

Community structures provide clues as to what types of individual or entity may be contained within a network. For communities that resemble that of Figure 7(a), it is possible that the high degree node may be a type of vendor or a spender depending whether or not there is a high in-degree or out-degree. A high in-degree would mean that one address is receiving a lot of transactions while a high out-degree would mean that an address is paying a lot of other individuals. Figure 7(b) resembles a different type of community. It is difficult to draw conclusions about the nature of the nodes in this community. Gambling is one possible instance in which many transactions occur among a community of individuals. However, it is also likely this community is a bunch of nodes doing business together. Given that it was a six hour window, it is unlikely that business would execute that many transactions with each other. Further analysis is needed to determine the nature of the individuals but community detection is a good starting point.

A deeper investigation into the owners of each address would aid in a more comprehensive analysis of the bitcoin transaction network. Certain security feature most likely lead to some level of skewness in the data set. The feature which allows users to change the sending and receiving address is a powerful security feature but it could lead to a misrepresentation of the amount of actual bitcoin users participating in the network. Since all transactions are kept on a public ledger, addresses associated with a transaction involving a lot of bitcoin may become targets of malicious attacks. Some bitcoin wallets allow users to generate new public addresses in order to maintain a level of anonymity on the network. This feature may explain the large number of pairs of nodes in our network samples. It could be that individuals change their address for every transaction and a new address is used for subsequent transactions. Situations are present where an address cannot be changed or it would be inconvenient and this is why we see nodes with high degrees despite the fact that an address can be changed. For example, if a vendor accepts bitcoins as payment it would be inconvenient for the vendor and patrons if the vendor constantly changed addresses because patrons, especially “regulars”, would have to constantly check that the address is current and that they are sending money to the right address.

Individuals are allowed to have multiple bitcoin wallets just as someone may have multiple bank accounts or credit cards. Multiple wallets per individual would lead to a similar phenomenon to generating new addresses however; one more thing needs to be considered. Money can be sent from one wallet to another wallet but one individual may have ownership to both wallets; it is like transferring funds between two bank accounts you own. To acknowledge this transfer the, the network needs to verify it and thus it would show up as a transaction in the network.

Community detection may help to investigate ownership of a particular address because multiple addresses in a particular community may belong to one individual. Combining these addresses would lead to a better resolution of the network. The way it stands now, our network primarily resembles the movement of bitcoin. Building a transaction network in which the nodes represent a single individual or entity rather than a single address would result in a network that would resemble how people spend bitcoin. Separating the identity from the bitcoin address was in the original design of the network to protect individual