Graph Neural Network를 활용한 마약 거래 목적 Bitcoin Address 식별 연구

초록

Owing to its anonymity and the difficulty of tracing transactions, Bitcoin has been exploited as a primary means of payment in Telegram-based drug trafficking. However, conventional investigative approaches for identifying Bitcoin addresses used in drug trafficking rely on manual analysis by expert investigators, which limits their scalability to large-scale data. Likewise, existing research using Graph Neural Networks (GNNs) has focused on binary licit/illicit classification or general-purpose behavioral classification, and thus fails to capture the fund-flow structure specific to a particular crime type. This study models the three-stage fund flow—[OTC] → [Retail] → [Laundering]—observed in Telegram-based drug trafficking as a Heterogeneous Bipartite Graph. The proposed model combines SAGEConv-based heterogeneous graph convolution with a Jumping Knowledge Network (JK-Net) and applies bidirectional message passing. On a dataset constructed from actual drug retail transaction addresses observed between 2022 and 2023, five-fold cross-validation shows that the proposed model achieves an F1-score of 0.7956, an AUC of 0.8910, and a false positive rate (FPR) of 0.2506. The proposed detection method enables suspected drug trafficking addresses to be identified automatically from large-scale blockchain data without the need for individual tracing by an investigator. Accordingly, it can be applied at the investigative stage to proactively discover newly emerging drug trafficking addresses, to select targets for suspending or freezing transactions, and to produce statistics on the scale of drug trafficking. Furthermore, it can be incorporated into the anti-money laundering (AML) and money-laundering risk assessment processes of virtual asset service providers, demonstrating practical applicability across both law enforcement and private-sector compliance domains.

키워드