Identificação de usuários maliciosos de bitcoin com floresta randômica

Abstract

The expansion and consolidation of Bitcoin as a decentralized financial system have introduced complex challenges to public safety and regulatory compliance, primarily due to pseudo-anonymity exploited by malicious actors for illicit activities such as money laundering, darknet market operations, and ransomware extortions. This study aimed to develop and evaluate a supervised machine learning model capable of classifying transactions and addresses on the Bitcoin network for the automated identification of malicious entities. The methodology utilized public records extracted from the Blockchair platform—spanning blocks 600,000 to 605,999, integrated with ground-truth labels from the Bitcoin Address Behavior Dataset (BABD-13). A Random Forest classifier was trained using balanced class weighting, followed by a contamination heuristic and adress majority voting aggregation. Feature importance analysis demonstrated that economic metrics, particularly transaction fees (fee_per_kwu and fee_per_kb) and transaction amounts in fiat currency, were the most decisive indicators of suspicious behavior. At the transaction level, the model achieved 100% accuracy, a macro precision of 96%, and a recall of 84% for illicit activities. By incorporating the address-level majority voting scheme (θ = 0.5), the system eliminated false negatives, achieving a perfect recall of 100% on malicious addresses and an overall accuracy of 99%, confirming its practical viability for digital forensics and compliance audits within blockchain ecosystems.