💻 computer science

Deanonymizing Bitcoin Transactions via Network Traffic Analysis with Semi-supervised Learning

This paper proposes NTSSL and its enhanced version NTSSL+, novel methods that combine network traffic analysis with semi-supervised learning and cross-layer collaboration to significantly improve the accuracy of deanonymizing Bitcoin transactions compared to existing approaches.

Original authors: Shihan Zhang, Bing Han, Chuanyong Tian, Ruisheng Shi, Lina Lan, Qin Wang

Published 2026-03-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shihan Zhang, Bing Han, Chuanyong Tian, Ruisheng Shi, Lina Lan, Qin Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine Bitcoin as a massive, global town square where everyone shouts out their transactions. The rule of the town is that you don't have to use your real name; you just use a nickname (a Bitcoin address). The idea is that no one knows who is who.

However, this paper describes a clever new way for a "detective" (an attacker) to figure out who is actually shouting out a specific transaction, even without knowing their real name. They do this by listening to the noise in the town square, not by reading the words.

Here is the breakdown of their method, using simple analogies:

1. The Setup: The "Spy Network"

In the past, to catch someone, you had to be the very first person to hear them shout. But the Bitcoin town has a rule: when you shout, you wait a random amount of time before telling your neighbors, just to make it hard to trace you back to the source.

The authors' trick is simpler: They don't need to be the first listener. Instead, they set up a ring of "spy" microphones (called Probe Nodes) all around the target person.

The Goal: The attacker tries to fill up all the "ears" the target person has. If the target has 114 ears, the attacker tries to occupy as many of them as possible with their own spies.
The Result: The spies hear everything the target shouts and everything the target hears from others.

2. The Clue: "The Loud Speaker" vs. "The Whisperer"

The core discovery of this paper is a behavioral difference between creating a transaction and forwarding one.

Forwarding (The Whisperer): If the target just passes along a message they heard from someone else, they are polite. They tell a few neighbors, and maybe one or two neighbors ask, "Can I hear the full message?"
Creating (The Loud Speaker): If the target created the message themselves, they are excited! They shout it out to many more neighbors immediately. Because they are the source, more people haven't heard it yet, so more people ask, "Can I have the full details?"

The Analogy:
Imagine a party.

If you are just repeating a joke you heard from the guy next to you, you tell a few people.
If you just came up with a hilarious new joke, you tell everyone in the room immediately.
The attacker's spies count how many people the target told and how many people asked for the details.

3. The Brain: "Semi-Supervised Learning" (The Smart Guessing Game)

The attacker has a lot of data (who shouted what), but they don't have a "cheat sheet" (labeled data) telling them which shouts were original and which were just repeats.

Old Way (Unsupervised): The computer tries to guess patterns on its own. It's like trying to learn a language by only listening to people speak without a teacher. It's okay, but often wrong.
The New Way (Semi-Supervised): The computer uses a "smart guess" strategy.
1. It first uses a "wild guess" algorithm to find the most obvious "Loud Speakers" (the ones that look very different from the crowd).
2. It treats these guesses as "truth" to train a smarter brain (a machine learning model).
3. This smarter brain then looks at the rest of the data and says, "Ah, this one looks a bit like the Loud Speakers, so it's probably an original too."

This is like a detective who finds one clear fingerprint, uses it to train a robot, and then has the robot scan the whole crime scene to find matching prints.

4. The Super-Boost: "Cross-Layer Detective Work" (NTSSL+)

The authors realized that listening to the noise isn't enough. They added a second layer of detective work: Transaction Clustering.

The Concept: In Bitcoin, if you send money to three different people at the same time, those three transactions are likely from the same wallet.
The Trick: The attacker groups transactions that look like they came from the same wallet.
- If the "Loud Speaker" algorithm says, "Transaction A is from the target," but the "Wallet Grouping" says, "Transaction A is part of a group where 9 out of 10 are definitely not from the target," the attacker corrects the mistake.
- It's like a jury: If one witness says "It was him," but the other 9 witnesses say "It wasn't," the jury ignores the first witness.

The Results: How Good Is It?

The Old Method: If an attacker controlled 25% of the target's connections, they were right about 40% of the time.
The New Method (NTSSL): With the same 25% control, they are right 50% of the time.
The Super Method (NTSSL+): With the extra "Wallet Grouping" trick, they are right 64% of the time.

If the attacker controls all the connections (100%), the new method is 1.6 times better than previous attempts.

Why This Matters

This paper shows that even with Bitcoin's privacy features (like random delays), your privacy isn't perfect if someone can listen to enough of your network traffic.

How to protect yourself?
The paper suggests two main defenses:

Use a Mask: Use Tor or a VPN. This hides your real "house address" (IP address) so even if they know you shouted, they don't know where you live.
Change the Rules: Use newer protocols (like Dandelion++) that change how messages are spread so that "Loud Speakers" and "Whisperers" look the same.

In summary: The authors built a system that listens to how many people a Bitcoin user talks to. By combining this listening with smart computer guessing and checking against wallet groups, they can figure out who is actually making a transaction much better than before.

1. Problem Statement

While Bitcoin addresses are pseudonymous, they do not guarantee full privacy. Network-layer deanonymization attacks aim to link a transaction to the real-world IP address of its originator.

Limitations of Existing Methods:
- Classic Approaches: Rely on timing analysis (identifying the first node to forward a transaction). These are largely ineffective against Bitcoin's randomized diffusion delays.
- Unsupervised Learning (e.g., PERIMETER/Apostolaki et al.): These methods analyze traffic patterns without labeled data. However, they suffer from low precision because they struggle to distinguish between "abnormal" originating transactions and other types of network anomalies or noise.
- Supervised Learning: Requires large amounts of labeled data. A model trained on one node often fails to generalize to others due to differences in node configurations, connection counts, and peer activity levels.
- Encryption: Recent Bitcoin Core updates (v27.1) use encrypted P2P transport, rendering passive AS-level interception ineffective.

The Core Challenge: How can an attacker identify originating transactions with high precision when they only control a subset of a target node's incoming connections (not a full eclipse attack) and cannot rely on labeled training data?

2. Methodology

The authors propose NTSSL (Network Traffic Analysis via Semi-supervised Learning) and its enhanced version, NTSSL+.

A. Threat Model & Data Collection

Attacker Capability: The attacker deploys "probe nodes" to establish incoming connections to a target full node. They do not need to control 100% of connections; controlling a subset (e.g., 25%) is sufficient.
Traffic Capture: The probe nodes capture plaintext P2P messages (Inv, Getdata, Tx) between themselves and the target node.
Key Observation: Nodes exhibit "abnormal" behavior when broadcasting their own transactions compared to forwarded transactions. Specifically, originating transactions are broadcast to a larger number of peers, resulting in distinct message counts.

B. Feature Extraction

The system extracts four key features from the captured traffic for each transaction hash:

Inv Count: Total Inv messages sent by the target node (Higher for originating tx).
Getdata Count: Total Getdata messages received by the target node (Higher for originating tx).
Ratio: Getdata / Inv ratio.
Sum: Total Inv + Getdata messages.
Note: Time-based features are excluded because Bitcoin's diffusion mechanism randomizes broadcast timing.

C. The NTSSL Algorithm (Semi-Supervised Learning)

NTSSL uses an "Unsupervised + Supervised" architecture to overcome the lack of labeled data:

Phase 1 (Pseudo-Labeling): Three unsupervised anomaly detection algorithms (Isolation Forest, Auto Encoder, One-Class SVM) are run on the data. The intersection of their "anomaly" predictions is treated as high-confidence positive samples (originating transactions).
Phase 2 (Label Expansion): To address class imbalance, the system generates pseudo-labels for the entire dataset. A sample is labeled as positive (1) if:
- Its anomaly score is $\ge$ the lowest score of the Phase 1 positives.
- Its Inv count is $\ge$ the lowest Inv count of Phase 1 positives.
- Its Getdata count is $\ge$ the lowest Getdata count of Phase 1 positives.
Phase 3 (Feature Augmentation): The anomaly score from Isolation Forest is added as a new feature to the original vector.
Phase 4 (Supervised Training): An XGBoost classifier is trained on this augmented dataset with the generated pseudo-labels to predict originating transactions.

D. NTSSL+ (Cross-Layer Collaborative Analysis)

To further improve accuracy, NTSSL+ integrates Transaction Layer data:

Clustering: It uses multi-input heuristics to cluster transactions belonging to the same wallet.
Time-Window Refinement: Transactions within a cluster that occur within a short time window are assumed to originate from the same full node.
Correction Mechanism:
- If a cluster is dominated by "originating" labels, any "forwarded" labels in that cluster are corrected to "originating" (reducing False Negatives).
- If a cluster is dominated by "forwarded" labels, any "originating" labels are corrected to "forwarded" (reducing False Positives).

3. Key Contributions

Novel Algorithm (NTSSL): The first application of semi-supervised learning to Bitcoin transaction deanonymization. It achieves high performance without requiring pre-labeled datasets by generating reliable pseudo-labels.
Cross-Layer Integration (NTSSL+): A novel collaborative analysis method that combines network-layer traffic features with transaction-layer clustering results to refine classification accuracy.
Robustness to Encryption: Unlike passive AS-level attacks, this method uses active probe nodes to capture plaintext traffic, bypassing the encryption introduced in Bitcoin Core v27.1.
Partial Control Effectiveness: Demonstrates that an attacker does not need to eclipse a node (control 100% of connections); controlling as little as 25% of incoming connections yields significant results.

4. Experimental Results

Experiments were conducted on the Bitcoin Mainnet and Testnet using self-deployed nodes.

Performance Metrics: Evaluated using Recall, Precision, FPR, and F1-Score.
Comparison with Baseline (PERIMETER):
- PERIMETER (Unsupervised): Achieved an F1-score of ~0.53 even with 100% connection control.
- NTSSL: With 100% connection control, achieved an F1-score of 0.74 (Recall: 70.2%, Precision: 79%).
- NTSSL+: Further improved performance by 20%–40% over NTSSL.
Low-Control Scenario (25% Connections):
- NTSSL: F1-score of 0.50.
- NTSSL+: F1-score of 0.64.
- Improvement: NTSSL+ delivers a 1.6x improvement over the existing unsupervised approach (PERIMETER) under the same low-control conditions.
Supervised Learning Limitation: Experiments confirmed that a supervised model trained on a single node fails to generalize to other nodes in the Mainnet due to heterogeneity in node configurations, validating the need for the semi-supervised approach.

5. Significance and Implications

Privacy Threat: This research highlights a critical vulnerability in Bitcoin's privacy model. Even with randomized diffusion and encrypted P2P transport, active probe nodes combined with semi-supervised learning can effectively deanonymize users.
Scalability: The attack is highly scalable. Probe nodes can be reused to target multiple nodes, and the method works even with partial connection control.
Countermeasures: The paper suggests that users can mitigate this risk by:
- Using Tor or VPNs to hide the real IP address.
- Upgrading to privacy-enhancing propagation protocols like Dandelion++ or Erlay, which restrict transaction propagation to outgoing connections only, rendering probe-based collection ineffective.

In conclusion, the paper demonstrates that the combination of network traffic analysis and semi-supervised learning creates a powerful deanonymization tool that significantly outperforms previous unsupervised methods, posing a serious threat to Bitcoin user privacy unless specific countermeasures are adopted.