Deep Learning-Based Community Detection Approach on Bitcoin Network ^†

Abstract

Community detection is essential in P2P network analysis as it helps identify connectivity structure, undesired centralization, and influential nodes. Existing methods primarily utilize topological data and neglect the rich content data. This paper proposes a technique combining topological and content data to detect communities inside the Bitcoin network using a deep feature representation algorithm and Deep Feedforward Autoencoders. Our results show that the Bitcoin network has a higher clustering coefficient, assortativity coefficient, and community structure than expected from a random P2P network. In the Bitcoin network, nodes prefer to connect to other nodes that share the same characteristics.

1. Introduction

BITCOIN has latterly captivated the utmost attention due to its underlying nature of combining cryptography [1,2], e-money system [3], and blockchain [4,5]. Bitcoin functions to propagate the balance records known as the ledger among the actors. Bitcoin actors establish direct communication in one of the most significant flooding P2P networks over TCP. Due to this distributed nature, the behavior of users determined the overall performance of the Bitcoin system. Community detection is a crucial area of research for determining and understanding distributed networks. It seeks to discover possible small groups called communities within the P2P networks and check the frequency of connection of the members of any given community. Understanding the Bitcoin network structure is critical to the robustness and security of public blockchain networks.

A group of nodes that is more densely bound than other groups in the network is a group with high modularity and is called a community. Community detection algorithms are used to examine how groups of nodes are grouped, what characteristics they have, and their tendency to strengthen or dispart in a given network. Popular Community Detection Algorithms with low runtime complexities, such as Louvain, Label Propagation, and Infomap methods, have been implemented and compared on Peer-to-peer (P2P) networks. Existing methods [6,7,8,9,10,11,12] mainly utilize only topological data and neglect the rich data obtained from the content data. As the size and complexity of P2P networks increases, more sophisticated techniques are needed to detect communities. In [9], the authors have proposed a method to monitor connections of known nodes in the network and then progressively discover other nodes through the analysis of their mutual contacts; instead of relying on the study of content characteristics or packet properties. In [10], the authors have proposed a Decentralized Iterative Community Clustering Approach (DICCA) to reveal the community structure for large networks using the LFR benchmark model. The proposed method identifies the community clusters from an entire network without the global knowledge of the network topology due to the use of the Parallel Decentralized Iterative Community Clustering Approach (PDICCA), a pipelined parallel implementation that transforms the serial process of the DICCA into a parallelized approach. Recent research [13,14,15,16,17,18,19,20] has shown that using content data also helps measure the similarity between nodes. Nodes with similar content are highly likely to belong to the same community. Hence, combining topological data with content data could remarkably affect community detection. There are primarily two methods to evaluate the fusion of different elements in the network. Firstly, the Linear Incorporating Method (LIM) hypothesizes that all components can be linearly joined and link various aspects through the linear regulators. Ruan et al. [13] proposed the Community Discovery Inferred from Content Information and Link-structure (CODICIL), a linear approach that combines topology and content data into a newly generated network. CODICIL method later computed node clusters using standard graph clustering algorithms onto the new network. Secondly, the Probabilistic Incorporation Method (PIM) presents the subjective preference for developing one piece of information by integrating different information sources. Yang et al. [14] proposed a stochastic model for the Communities from Edge Structure and Node Attributes (CESNA). CESNA connects topology and node attributes by sparse restrictions to gain the relation among node attributes and communities. They have also adopted the block coordinate descent method to optimize the model parameters. Bhih et al. [20] proposed a new method for community detection by considering both topology and content sources of information. The proposed algorithm tightly integrates the network’s attribute information, shared neighbors, and connectivity information aspects to build a hybrid similarity matrix. The generated matrix is then used to cluster the network in possible subnetworks.

Nonetheless, the above-stated approaches tolerate several drawbacks. They cannot reveal potential imperceptible links between nodes in the network. Furthermore, they cannot automatically weigh different features with adequate balanced parameters. To overcome these challenges, we proposed a method to measure the structure of the Bitcoin networks and get a deeper view of the network division, also called communities. The proposed method combines topology and content data using a Deep Learning (DL) algorithm. DL quickly examines deep non-linear connections and combines Deep Feedforward Autoencoders [21] and spectral clustering [22]. We designed each element of the proposed DL model for a particular purpose. (1) To create the Modularity Matrix (B), we used the Modularity Model (Q) to cluster topology data. (2) To generate the Markov matrix (M), we utilized the normalized-cut model (NCM) to cluster content data. (3) We applied spectral clustering (SC) to find the low rank embedding to reconstruct the spectral matrix. (4) To reproduce the input matrix, we used the Deep Feature Representations (DFR) algorithm to combine the modularity and Markov matrices. (5) We adopted Deep Feedforward Autoencoders (AFE) to combine different parameters of each node to create a profound depiction of the nodes.

1.1. Contribution

Through this research, we aim (1) to provide a quantitative examination of network properties and dynamicity in Bitcoin. The proposed method scans the network and tracks the nodes’ connectivity over time. Nodes in bitcoin can be classified as reachable and unreachable nodes, where over 30% of the active nodes are unreachable—nodes without inbound peers. While 80% of reachable nodes churn vastly, 16% of active nodes are well connected and overlap over all the measurement periods. (2) Expand the current knowledge of Bitcoin, mainly the P2P structure. Based on the total number of nodes’ inbound and outbound connections, Bitcoin active reachable nodes can be divided into three categories, light nodes with a connection count less than the default one, medium nodes with a total number of connecting equal to or over the default count, and heavy nodes with a paramount number of peers approximating or surpassing a 100. Using the proposed method, we noticed that the Bitcoin topology is centrally dense. The Bitcoin network shows more community structures compared to other random graph networks. Thus, we conclude that the Bitcoin topology is not a random graph; nodes tend to establish links with nodes like them more often than any other random network. (3) To offer a quantitative review of community structure to understand the Bitcoin underlying network better. Discovering and understanding the topology of unstructured blockchain networks is essential from various perspectives, including performance and security. The knowledge of the network properties is a basis for future protocol designs to improve information propagation speed, scale up the network size, and defend against possible malicious attacks (e.g., eclipse attacks and BGP hijacks). A more profound comprehension of the topology scheme also leads to the development of new practical algorithms. Bitcoin topology stands firmly on heavy and long-running nodes; improving the propagation mechanism using these nodes could improve the propagation delay by proximity ×25 compared to the Bitcoin default protocol. However, revealing these nodes’ information can threaten the Bitcoin ecosystem; for instance, attacking heavy and long-running nodes via the Internet routing infrastructure by BGP hijacks, intercepting traffic, or autonomous systems can intercept and manipulate a significant fraction of currency traffic.

1.2. Structure of the Paper

The paper is organized as follows. Section 2 and Section 3 introduce the Bitcoin network and preliminary deep learning model, respectively. Section 4 reports the experiment and the Bitcoin community structure analysis results. While Section 5 discusses how our findings could be used to enhance the network vitality and stability by analyzing the network resilience and security and improving the propagation mechanism. Finally, a summary of the performed work and future work directions are presented in Section 6.

2. Bitcoin & Blockchain Background

Bitcoin network is designed as a peer-to-peer (P2P) architecture on top of the Internet, where computers that run the Bitcoin protocol are peered to each other in a mesh network, forming a flat and decentralized topology. In a P2P network, nodes simultaneously provide and consume services. Within the P2P network, there are no central servers, no special nodes, and no hierarchy; nodes are all equal. An outstanding example of a P2P network architecture was the early Internet, where nodes were equal on the Internet Protocol (IP) network forming a flat topology. Nowadays, The Internet relies on a centralized, hierarchical architecture. However, the Internet Protocol is still P2P by nature. Another example of P2P technology is the file-sharing system with BitTorrent as the recent evolution of the P2P architecture.

Bitcoin is a virtual currency rooted in a distributed peer-to-peer network. In simple words, Bitcoin neither has nor requires a central server or authority. Users running Bitcoin communicate directly with each other in one of the largest P2P networks over the Internet. Through this distributed network, the behavior of its clients determines the overall performance of the Bitcoin system. Thus, Bitcoin’s P2P topology is much more than a network architecture choice. The P2P network architecture is the cornerstone of decentralization, security, and transparency.

Nodes are a significant part of Bitcoin protocols. When an actor joins the Bitcoin network to exchange (receive or send) bitcoin, the used computer acts as a node. There are various types of nodes. On the one hand, many Bitcoin nodes are light, downloading the most recent block data (ledger) required to process and verify newly generated transactions; this helps nodes run quickly and efficiently the Bitcoin client without requiring surplus storage or computational resources. On the other hand, full nodes store the complete copy of the ledger. Those nodes download all Bitcoin blocks and transactions from the Genesis Block (block 0) up to the most rest block. Lastly, miner nodes are nodes that verify and validate all the newly generated transactions and include them in the blockchain in the form of blocks; by doing so, new bitcoins are minted, and miner nodes get rewards as incentives for participation in the consensus process. A Bitcoin node can have one or many functions depending on its role in the network. All nodes have the routing function participating in the network, meaning they can discover and connect to other nodes and propagate and validate transactions and blocks. A few nodes can have a wallet function, a miner function, a copy of the entire blockchain database, or run different protocols.

In the Bitcoin network [23,24,25], nodes (actors) hold the bitcoin currency (BTC) by SHA-256 hash function, a brute-forcing dual cryptographic hash function. Participating nodes agree on a standard protocol to exchange the tokenized value maintaining an identical ledger copy. To avoid bitcoins (BTC) forging, the Bitcoin system [26] necessitates proof of work [27] from involved miners. Any newly mined block should include a hash value, a series of zeros whose length frequently changes to make coins mining computationally complex. Besides the mining process, the Bitcoin protocol offers a peer discovery mechanism to ensure node connectivity, stability, and homogeneity of ledger replicas. The ledger and its changes are publicly available in the network for all nodes, enabling them with instant majority consensus [28] to form the most current state of the system. To join the Bitcoin network, actors can run different implementations of the P2P protocol [29,30,31,32,33]. Once the node joins the P2P network, it uses the peer discovery mechanism implemented into the protocol to learn about other active nodes. Address gossiping allows the nodes to discover other potential active nodes. By default, nodes in the Bitcoin network can establish up to 125 connections. Among these, 117 connections are inbound links, and eight connections are outgoing links.

Bitcoin nodes utilize a flooding P2P broadcasting method to propagate blocks and transactions over the network participants. It is relatively straightforward to interact with active nodes in the network. Connected nodes exchange their network view (ledger stats) by sending new received/created transactions and blocks. Freshly connected nodes begin with a DNS lookup with predefined servers maintaining records of several known-active nodes. Then, the new nodes establish outbound connections with the received known-active nodes to either initialize or update the ledger. The nodes obey rules that support the consensus and influence network performance. Nodes only broadcast valid data to avoid endless and forged data broadcasting. The process of validating and rebroadcasting new data repeats until all the participating nodes in the network update their ledger. However, nodes can ban other nodes for 24 h if they misbehave by sending fallacious data, for example.

3. Proposed Methodology

In this section, we give an overview of the community detection [34,35] deep learning model, model basics, and model structure.

3.1. Deep Learning Model Preliminary

A distributed network $\mathrm{G}$ with a total of nodes $\mathrm{N}$ and the edge matrix $\mathsf{\xi }$, where $a_{ij}$ equals one if the nodes $i$ and $j$ are connected; otherwise, it is equal to zero. The node’s degree is shown by ${\xi }_i={\displaystyle \sum }_i{a}_{ij}$, while $m=\frac{1}{2}{\displaystyle \sum }_i{\xi }_i$ represents the overall number of edges in the network. The cosine similarity within the nodes $i$ and $j$ is presented by $o_{ij}$, while $O=\left[o_{ij}\right] ϵ R^{n\times n}$ presents the similarity matrix. In this paper, we used N-Nearest Neighbors (NN) method to define the similarity matrix $O.$ In the proposed NN model, we set $n$ adjacent edges for each node and all other values to zero. As a result of this, we obtained the sparse similarity matrix where $=\left[s_{ij}\right] \in R^{n\times n}$. Considering two communities (for simplification purposes), to optimise the modularity matrix Q, we redefined it as follows:

$$Q=\frac{1}{4m}{\displaystyle \sum }_{ij}\left(a_{ij}-\frac{{\xi }_i{\xi }_i}{2m}\right) \left({\psi }_i{\psi }_i\right)$$

(1)

where $\psi$ is the indicator of community membership indicator (${\psi }_i=1$ or $-1$ if node $i$ is part of the first community or second one). We also optimised the modularity matrix $Q$ using eigenvectors and eigenvalues, where $B=\left[b_{ij}\right]\in R^{n\times n}$ and $b_{ij}=a_{ij}-\frac{{\xi }_i{\xi }_i}{2m}$, hence $Q$ becomes:

$$\mathrm{Q}=\frac{1}{4\mathrm{m}}{ \mathsf{\psi }}^{\mathrm{T}}\mathrm{B}\mathsf{\psi }$$

(2)

$$\psi =\left[{\psi }_{ij}\right] ϵ \left\{-1,1\right\}$$

(3)

To avoid NP-hardness problem, we set the variable ${\psi }_{ij}$ to take true values using the following equation:

$$\mathit{max}Q=\underset{\psi ϵR^{n\times n}}{\mathit{max}}Tr\left({\psi }^{T}B\psi \right)$$

(4)

where $Tr$ presents the trace function, we used the Normalized-Cut Method (NCM) to calculate the cut-cost ratio between the actual connection in one cluster for the contact graph clustering. The objective function is as follows:

$$N_{cut}\left(C_1,C_2,C_3,\dots ,C_n\right)={\displaystyle \sum }_{t=1}^k\frac{link\left(C_{t,}\overline{C_t}\right)}{vol\left(C_t\right)}$$

(5)

where $link\left(C_{t,}\overline{C_t}\right)$ denotes the total links based on content similarities from the node in $C_t$ to all nodes not in $C_t$($\overline{C_t}$), and $vol\left(C_t\right)$ is the total inbound links count within $C_t$. If node $i$ is considered as $v_i$, the objective function must be minimised as follows:

$$\underset{\varphi ϵR^{n\times n}}{\mathit{min}}Tr\left({\varphi }^{T}L\varphi \right)$$

(6)

$$\mathrm{L}=\mathrm{D}-\mathrm{S} \mathrm{where} \mathrm{D}=\mathrm{diag}\left({\mathrm{d}}_1,{\mathrm{d}}_2,{\mathrm{d}}_3,\dots ,{\mathrm{d}}_4\right)$$

(7)

where $L$ indicates the Laplacian matrix of the similarity graph, which is normalized by $D^{-1}L=I-M$, and $I$ denotes the identity matrix and $M=D^{-1}S$ represents the Markov matrix. The solution matrix $\Phi$ comprises the eigenvectors of the $k$ smallest non-zero eigenvalues of the normalized Laplacian matrix ($D^{-1}L$), for ${\varphi }_{ij}=\frac{1}{\sqrt{vol(C_{t)}}}$ if $v_iϵc_i$ or ${\varphi }_{ij}=0$ otherwise.

3.2. Model Description

As mentioned in the previous section, the Modularity Model (Q) represents the topology-based clusters, and the Normalized-Cut Model (NCM) represents content-based clusters; we noticed that Q and NCM could be considered directed at reproducing modularity matrix B and Markov matrix M. Thus, applying Deep Feedforward Autoencoders (DFAE) help combine network topology and content data in a non-linear fashion to automatically learn the balance of combining different data sources, avoiding the requirement to tune the combination coefficient. The DFAE is the critical building element in our model. Finally, spectral clustering (SC) is used to find a low rank embedding to reconstruct the spectral matrix. The proposed DFAE can support multi-layers to achieve additional features and more accurate representation from the deep structures.

For a given network A, we constructed the modularity matrix B, then for each node we select its η closest nodes in the similarity matrix O using the Nearest Neighbors algorithm (NN) resulting in the matrix S. By using the new matrix S, we built the Markov matrix M. The mixed spectral Matrix $X=\left[B, M\right]$ was fed to the auto-encoder algorithm. The auto-encoder algorithm was split into Encoding and decoding layers. The encoding layers map the input features (the $X$ matrix) to a lower-dimensional $\mathrm{H}$ matrix at the hidden layer ($\mathrm{h}$). The function used to map the matrix $X$ into the $\mathrm{H}$ matrix is as follows:

$$\mathrm{H} = \mathrm{f}\left(\mathrm{X}\right)=\Gamma \left({\mathrm{W}}^{\left(\mathrm{H}\right)}\mathrm{X}+{\mathrm{b}}^{\left(\mathrm{H}\right)}\right)$$

(8)

${\mathrm{W}}^{\left(\mathrm{H}\right)}$ and ${\mathrm{b}}^{\left(\mathrm{H}\right)}$ present the parameters of the encoder. $\Gamma$ presents the non-linear function (such as $\tan \left(x\right)=\frac{1}{(1+\exp \left(-x\right)}$). The decoder layers $\mathrm{Y}$ map back $\mathrm{H}$ to the original data $X$ as follows:

$$\mathrm{Y} = \mathrm{g}\left(\mathrm{H}\right)=\Gamma \left({\mathrm{W}}^{\left(\mathrm{Y}\right)}\mathrm{X}+{\mathrm{b}}^{\left(\mathrm{Y}\right)}\right)$$

(9)

${\mathrm{W}}^{\left(\mathrm{Y}\right)}$ and ${\mathrm{b}}^{\left(\mathrm{Y}\right)}$ are the parameters learned in the decoder. $\Gamma$ presents the decoding layers’ mapping function (sigmoid function). The suggested DFAE represents the input features minimized by the reconstruction loss between the original and representation data. Therefore, the optimized function is defined as follows:

$$\hat{\mathsf{\theta }}= \arg \underset{\mathsf{\theta }}{\min }{\mathrm{L}}_{\mathsf{\theta }}\left(\mathrm{X},\mathrm{Y}\right)= \arg \underset{\mathsf{\theta }}{\min }{\displaystyle {{\displaystyle \sum }}_{\mathrm{i}=1}^{\mathrm{n}}}\Vert {\mathrm{x}}_{\mathrm{i}}-{\mathrm{y}}_{\mathrm{i}}{\Vert }_2$$

(10)

$\widehat{\theta }$ presents the vector of the auto-encoder, while $L_{\theta }$ denotes the Euclidean distance loss function used to measure the error rate. To minimize the objective function $J\left(\theta \right)$, we randomly initialize each parameter and use backpropagation with stochastic gradient descent. After each iteration, we update the parameters $\theta =\left\{W^{\left(H\right)},b^{\left(H\right)},W^{\left(Y\right)},b^{\left(Y\right)}\right\}$ as follows:

$$\mathrm{J}\left(\mathsf{\theta }\right)={\displaystyle \sum }_{\mathrm{i}=1}^{\mathrm{n}}\Vert {\mathrm{x}}_{\mathrm{i}}-{\mathrm{y}}_{\mathrm{i}}{\Vert }_2$$

(11)

$$W_{ji}^{\ast }=W_{ji}^{\ast }-\alpha \frac{\partial }{\partial W_{ji}^{\ast }}J\left(\theta \right)$$

(12)

$$b_j^{\ast }=b_j^{\ast }-\alpha \frac{\partial }{\partial b_j^{\ast }}J\left(\theta \right)$$

(13)

where $\alpha$ is the learning rate and the wildcard $\ast =\left\{\left(H,Y\right)\right\}$ and by defining $z^{\ast }=W^{\ast }x+b^{\ast }$, we got:

$$\frac{\partial }{\partial {\mathrm{W}}_{\mathrm{ji}}^{\ast }}\mathrm{J}\left(\mathsf{\theta }\right)={\displaystyle \sum }_{\mathrm{i}=1}^{\mathrm{n}}\frac{\partial \mathrm{J}\left(\mathsf{\theta }\right)}{{\mathsf{\delta }\mathrm{z}}_{\mathrm{j}}^{\ast }} · \frac{{\mathsf{\delta }\mathrm{z}}_{\mathrm{j}}^{\ast }}{{\mathrm{W}}_{\mathrm{ji}}^{\ast }}={\displaystyle \sum }_{\mathrm{i}=1}^{\mathrm{n}}{\mathsf{\delta }}_{\mathrm{j}}^{\ast }{\mathrm{X}}_{\mathrm{i}}^{\mathrm{T}}$$

(14)

$$\frac{\partial }{\partial {\mathrm{b}}_{\mathrm{j}}^{\ast }}\mathrm{J}\left(\mathsf{\theta }\right)={\displaystyle \sum }_{\mathrm{i}=1}^{\mathrm{n}}\frac{\partial \mathrm{J}\left(\mathsf{\theta }\right)}{{\mathsf{\delta }\mathrm{z}}_{\mathrm{j}}^{\ast }} · \frac{{\mathsf{\delta }\mathrm{z}}_{\mathrm{j}}^{\ast }}{{\mathrm{b}}_{\mathrm{j}}^{\ast }}={\displaystyle \sum }_{\mathrm{j}=1}^{\mathrm{n}}{\mathsf{\delta }}_{\mathrm{j}}^{\ast }$$

(15)

${\delta }_j^{\ast }=\frac{\partial J\left(\theta \right)}{\delta z_j^{\ast }}$ measures the error between the activation and the actual target value, the error is defined by:

$${\mathsf{\delta }}_{\mathrm{j}}^{\left(\mathrm{Y}\right)}=-{\displaystyle \sum }_{\mathrm{i}=1}^{\mathrm{n}}\left({\mathrm{y}}_{\mathrm{ij}}-{\mathrm{y}}_{\mathrm{ij}}\right)· \mathrm{s} \prime \left({\mathrm{z}}_{\mathrm{j}}^{\left(\mathrm{Y}\right)}\right)$$

(16)

$${\delta }_j^{\left(Y\right)}=\left({\displaystyle \sum }_{i=1}^n{W}_{ji}^{\left(H\right)}{\delta }_i^{\left(Y\right)}\right)·s^{\prime }\left(z_j^{\left(H\right)}\right)$$

(17)

For the preliminary training of the auto-encoder algorithm, we used the matrix $\mathrm{X}=\left[\mathrm{B},\mathrm{M}\right]$ to obtain ${\mathrm{H}}^{\left(\mathrm{i}\right)}$ and then build ${\mathrm{Y}}^{\left(\mathrm{i}\right)}$. In the proposed method, we integrated both modularity and normalized-cut models to combine topology and node content data for community detection. We trained the model with i-th auto-encoder to rebuild the appropriate hidden layer of the (i − 1)-th auto-encoder, where $\hat{\mathsf{\theta }}= \arg \underset{{\mathsf{\theta }}^{\left(\mathrm{i}\right)}}{\min }{\mathrm{L}}_{{\mathsf{\theta }}^{\left(\mathrm{i}\right)}} \left({\mathrm{H}}^{\left(\mathrm{i}-1\right)},{\mathrm{Y}}^{\left(\mathrm{i}\right)}\right)$. Finally, we selected the K-Means algorithm to be the clustering method to detect the communities. The model final complexity function is computed as follows:

$$O=\left(t_p{t}_q\gamma L\left(m+nk\right)\right)$$

(18)

where $\mathrm{L}$ presents the number of layers, $n$ denotes the number of nodes in the network, $\mathrm{m}$ is the number of edges. Thus, the average degree is given by $\frac{2m}{n}$. While $\gamma$ is the highest number of the hidden layers, $t_p$ and $t_q$ present the number of iterations and the number of parameters, respectively. We need to emphasize that the parameter $\gamma$ is a constant value related to the model dimension, not the total number of nodes in the network. Thus, the complexity is approximately linear in terms of full nodes and links in the given network. We noted that a complex structure led to only mimicking the identity function throughout the preliminary training process. The model only learned how to copy the inputs to the outputs without learning any meaningful representation of the fed data. In contrast, a simple structure led to underfitting. The suggested DL model is an auto-encoders organized with five encoding and four decoding layers as illustrated in Figure 1. In contrast, the dimension of every layer is configured to be less than both input and output space.

3.3. Topology Dynamicity Analysis

The changes in the structural position of the individual nodes in the distributed network define the topology dynamicity.

The topology dynamicity can reveal the network’s structural vulnerabilities and evolutionary changes. It mainly helps discover the contribution of nodes to network evolution and disintegration. In Bitcoin, studying the structural positions of nodes in the network can help to understand the behavior of actors and reveal how nodes switch their roles in the network over time (e.g., level of interactions with other nodes). The structural position of each node in the network was measured using the essential properties of the social network analysis, i.e., betweenness centrality (BC), closeness centrality (CC), and degree centrality (DC). To compute the degree of dynamicity (DD) of a particular node, we used the following equation:

$$D{D}^i=\frac{{{\displaystyle \sum }}_{j=1}^m\left|V_{AN}^i\right.-V_{N{G}_{\left(j\right)}}^i|}{m}$$

(19)

$D{D}^i$ indicates the degree of dynamicity shown by the $\mathrm{i}$-th nodes, $V_{AN}^i$ represents the structural position (BC, CC, or DC) in the aggregated network for the $\mathrm{i}$-th nodes, and $V_{N{G}_{\left(j\right)}}^i$ indicates the structural position for the $\mathrm{i}$-th nodes in the same given network graph ($\mathrm{NGNG}$). $m$ presents the number of graphs considered in the analysis. A Bitcoin node may not always exist in the network graphs as they can join and leave the network at any time. A node may exist in the $j$-th NG and may vanish in the $\left(j\pm 1\right)$-th $\mathrm{NGNG}$. Highlighting that a change from the existing state to the vanishing state in two successive NG will negatively influence the node’s degree of dynamicity. A node presence in two consecutive graphs shows a higher degree of dynamicity than a node seen in only one of the successive graphs. To capture the contribution of the nodes on the topological dynamicity, Equation (19) becomes:

$$D{D}^i=\frac{{{\displaystyle \sum }}_{j=1}^m{\alpha }_{j,j-1}\times \left|V_{AN}^i\right.-\left.V_{N{G}_{\left(j\right)}}^i\right|}{m}$$

(20)

${\alpha }_{j,j-1}$ represents the states of a given node in consecutive graphs. The degree of dynamicity ($D{D}^i)$ was normalised using the highest detected degree of dynamicity ($D{D}^{\mathcal{H}})$ shown by an individual node in the network. Thus, the normalised degree of dynamicity ($ND{D}^i$) was calculated as follows (Where $n$ is the total number of nodes in the graph ($NG)$.):

$$ND{D}^i=\frac{1-\left(D{D}^{\mathcal{H}}-D{D}^i\right)}{n}$$

(21)

To evaluate the level of randomness in the Bitcoin network, we compare the properties of the Bitcoin network with those of three other random networks: (1) Erdős-Rényi (ER) model, (2) Barabási-Albert (BA) model, and (3) Configuration model (CM). The Erdős-Rényi (ER) model generates graphs with an identical independent likelihood of connections. As input parameters to ER model, we use the peer count from our measurements and the default peer count from Bitcoin documentation. The Barabási-Albert (BA) model creates scale-free graphs with power-law degree distribution. We used the same number of nodes and edges found in our measurements as input parameters to the BA model. Since the degree distributions generated by the ER and BA models are not close to those observed in the Bitcoin network, we used the Configuration Model (CM) with empirical degree distribution. Finally, we calculated the topology properties in each random network and compared them with topology properties found in Bitcoin’s network. We want to emphasize that the proposed method could detect community structures in other public blockchain networks that share the same characteristics as Bitcoin.

4. Experiment & Results

In this section, we introduce the method used to collect Bitcoin topology information and content data, present the experiment setup and settings, and report the experimental results later.

4.1. Data Collection

We used the Nodes-Probe technique [23,25,36] to collect the topology and content data. Nodes-Probe was based on the flooding P2P resource discovery technique. The method reconstructs the graph around all active nodes in the network. Later it combines them to discover an approximate topology. The Node-Probe agent creates a topology snapshot by repeating the simple four steps: (1) prepare an IP list, (2) send ‘PING,’ (3) send ‘Version,’ and (4) send ‘GETADDR.’ The proposed peer inference method combines topology and content data to map the reachable nodes to peers that are possible outbound connections in real-time manner.

The peer inference method was split into two phases:

(1) Timestamp Match: To identify a possible peer relationship between nodes, we compare the timestamps of a node in interest and its candidate peers recorded when they are alive; the timestamp values can be acquired and registered from ‘ADDR’ reply messages. If both the node and peers are active during the same period, we nominate such peers to go on to the next phase of our peer inference. Furthermore, we apply unequal selection probabilities favoring peers with fresh timestamp.

(2) Ledger Status Match: According to the Bitcoin propagation protocol, when a node receives a newly mined block, it propagates it to all its outbound connections (peers) to update the ledger. Therefore, directly connected nodes likely have a similar ledger [34,35]. Thus, we compare the node in interest’s ledger status and pre-selected peers nominated in the previous phase. If both ledgers include the latest ten mined blocks, we assume that the pre-selected peer is the node’s outbound connection.

To collect the node data, we ran Nodes-Probe on the Bitcoin Main network during a seven-days period from 8 May 2022 until 14 May 2022, which allowed us to gather over 92,300 active nodes with a daily average of 9500 active nodes. The dataset used in this work consists of 92,378 nodes and 914,694 edges, where the edges present the nodes’ outbound connections. To validate the collected data, we compare the daily peer count as measured by the proposed Nodes-Probe [36], Bitnodes [37], and Bitcoin Monitoring [38]. The comparison results showed that the quotidian number of active nodes was nearly alike among the three datasets, with a difference of ±1% and ±5% of the total found nodes by Bitcoin Monitoring and Bitnodes, respectively.

By default, nodes can establish 125 connections in the Bitcoin network—8 outbound and 117 inbound peers. According to the total number of outgoing connections, we have classified the bitcoin nodes into three categories: (1) Light nodes denote the nodes with an outbound links count of less than eight, accounting for 9.74% on average. (2) Medium nodes represent nodes with 8 to 12 outgoing links, making up approximately 73.26% of the discovered reachable nodes. (3) Heavy nodes (or well-connected nodes) point to the nodes with outbound links count surpassing 12 peers, with a paramount of peers equal to 135. Heavy nodes account for approximately 17% of the reachable nodes; 3% of Heavy nodes have more than 100 outbound connections.

4.2. Description of the Experiment

We calculate the node content similarity by applying cosine similarity to create the Bitcoin content-based topology. We guarantee that topology and content data are in the same range using the Z-score Normalization function. Then, we trained the model with well-defined parameters (Liveness, Freshness, Degree, Inbound Links, Outbound Links, BC, DC, and CC) and gained the potential description for each row in the used matrix. Furthermore, we used the k-Means algorithm for clustering the obtained description and generated the result as the average performance of experimental results. Lastly, we utilized the Normalized Mutual Information (NMI) as a community comparison matrix to evaluate the performance of the presented technique. The normalized mutual information (NMI) is defined as follows:

$$NMI\left(C,C^{\ast }\right)=\frac{\widehat{MI}\left(C,C^{\ast }\right)}{\max \left(H\left(C\right),H\left(C^{\ast }\right)\right)}$$

(22)

$$H\left(C\right)={\displaystyle \sum }_{c_i}\frac{\left|C_i\right|}{\left|C\right|}\log \left(\frac{\left|C_i\right|}{\left|C\right|}\right)$$

(23)

$$\widehat{MI}\left(C,C^{\ast }\right)={\displaystyle \sum }_{C_i,C_j}p\left(C_i,C_j^{\ast }\right)\log \frac{p\left(C_i,C_j^{\ast }\right)}{p\left(C_i\right)p\left(C_j\right)}$$

(24)

where $H\left(C\right)$ is the entropy of the communities $C$ and $\widehat{MI}\left(C,C^{\ast }\right)$ is the reciprocal data between the found Structure communities $C$ and ground-truth communities $C^{\ast }$.

4.3. Modularity Results

Modularity is a measure of the structure of networks that measures the strength of communities of a given network. As defined in Equation (1), the range of the modularity value is between −1 and 1. The value generally varies between 0.3 and 0.9 for detecting communities across different networks. We have noticed that the community structure generated by the proposed method has higher modularity of around 0.8 since the graph involved many nodes/edges and the model is based on a combination of both topology and content data. Further improvement of the proposed method could be conducted by focusing on label propagation and narrowing the focus in a graph.

4.4. Community Structure Analysis Result

To evaluate the proposed community detection model, we have trained the DFAE model using two datasets with ground-truth network communities in social and information networks [39]. The first dataset is the Amazon database contains the customer data based on the “who bought this item also bought” feature. If a given item $i$ is repeatedly co-purchased with an item $j$, the Amazon graph holds an indirect link between $i$ and j items. It also provides a ground-truth community for each category of the items. The second dataset we have used is the YouTube social network based on friend relationships and groups. For the ground-truth communities, we used the user-joined groups as references.

Before examining the community structure in the Bitcoin graphs, we first evaluate the efficiency of the suggested DFAE model in detecting communities by comparing its performance with four other well-known community detection methods: (1) SBM [40], (2) CAN [18], (3) Louvain [41], and (4) LPA random [42]. From the results of Figure 2, the proposed DFAE neatly accomplished the best performance and proved to be the best, followed by CAN and SBM. The NMI value of other methods showed a significant downtrend due to the severe randomness of the label updating process, mainly because the Bitcoin network includes approximately 10 K nodes.

One of the most crucial issues we need to consider when evaluating a specific Deep learning algorithm for real-time application is how it grows or scales; to rephrase it, how the variations in the input size affect given algorithm performance. This growth concept can be predicted using the Big O notation quantifies. This notation specifies the dominant term used to define the time complexity involved with running an algorithm, which helps identify the effect of the input size over the execution time—how quickly the runtime grows relative to the input, as the input increases. The runtime in the feed-forward algorithm is based on the number of floating-point operations per second (flop/s) required for an epoch batch multiplied by the total number of epochs needed to reach a desired level of accuracy. The number of flop/s depends on the data count (data size) and the DL network architecture. Thus, in a feed-forward algorithm, the time complexity is a function of the number of layers, the number of neurons per layer, and the feature dimensions. To demonstrate that the proposed DFAE algorithm scales well when increasing the network size, we ran it on a simulated Bitcoin network of various sizes, ranging from 5000 to 145,000 nodes. Figure 3 illustrates the execution time of running the community detection algorithm with DFAE and Louvain, with the number of iterations set to 100. While the proposed DFAE method does have a relatively small runtime compared to the Louvain algorithm, it still scales in the same manner as the Louvain algorithm.

The Bitcoin community structure results show that Bitcoin has 20 communities on average. While the ER network has five communities on average, the scale-free network (BA) and the CM network have seven communities. Compared to the other random networks, Bitcoin contains considerably more communities. Our analysis also shows that at least two large communities in every network snapshot include 16% of the discovered nodes and an occasional super community of over 30% of heavy nodes. We have also noticed that a few communities have 15 to 20 well-connected nodes, as shown in

Table 1. Community Size Distribution in Bitcoin Network.

# of Community	Nodes% 1	Heavy Nodes% 2
1	4.44	0.9
2	3.76	0.9
3	7.71	19.99
4	6.49	10.75
5	3.76	0.9
6	1.46	0.9
7	5.71	0.9
8	5.56	0.9
9	3.16	0.9
10	1.65	0.9
11	6.12	4.83
12	5.47	0.9
13	1.78	0.9
14	2.68	0.9
15	4.36	0.9
16	4.17	0.9
17	1.39	0.9
18	1.32	0.9
19	4.81	0.9
20	1.8	0.9
21	1.94	0.9
22	6.26	8.66
23	1.19	0.9
24	0.39	0.9
25	3.64	0.9
26	8.98	36.87

¹ Percent of active and ² percent of heavy nodes (Snapshot token on 14 May 2022).

. The rest of the communities have less than six well-connected nodes. Furthermore, we have noticed an overlapping between the discovered communities where the top 5 well-connected nodes participate in all the founded communities.

Figure 2. Normalized Mutual Information (NMI) performance curves balanced with coefficient λ.

Figure 2. Normalized Mutual Information (NMI) performance curves balanced with coefficient λ.

Figure 3. Analysis of time complexity. Comparison of the runtime between the proposed method DFAE and Louvain on various network sizes, ranging from 5000 to 145,000 nodes, with a number of iterations set to 100.

Figure 3. Analysis of time complexity. Comparison of the runtime between the proposed method DFAE and Louvain on various network sizes, ranging from 5000 to 145,000 nodes, with a number of iterations set to 100.

4.5. Bitcoin Network Properties

As shown in

Table 2. Network Properties of Bitcoin and Other Generated Networks.

	Bitcoin Network	ER Network	Bitcoin Network	ER Network
Diameter	6	5	5	5.897
Degree	16.576	15.98	15.81	15.98
Clustering coef.	0.068	0.045	0.044	0.044
Path length	3.621	3.163	3.366	3.570
Assortativity coef.	0.337	0.209	0.198	0.204

, the calculated value of each network property metric is higher in the Bitcoin network than in the generated random networks. In Bitcoin, the diameter is equal to 6, whereas the closest one is the diameter of the CM graph with a value of 5.897. Eliminating the heavy nodes from both graphs decreased the diameter to 5 and became similar in both networks. The results in [38] show that the Bitcoin test-net has a diameter equal to 5, and the average clustering coefficient is equal to 0.052. In contrast, our results show that the average clustering coefficient in the main net is equal to 0.068. Furthermore, the average of both the clustering coefficient and assortativity coefficient in the Bitcoin graph was higher than expected from any generated random graphs. The topology in the Bitcoin network is very dense, ensuring connectivity among all nodes. In addition, Bitcoin nodes tend to establish connections with nodes like them more often than any other random network. Since the Bitcoin network is extensive and the topology is very dense. To better show the community structure results, we selected to provide the graph of the top 10 Bitcoin communities. Figure 4 illustrates the visualization of the top 10 communities in the snapshot taken on 14 May 2022 from the Bitcoin main network.

5. Discussion

Our findings could be used to enhance the network vitality and stability by analyzing the network resilience and security and improving the propagation mechanism. Our measurement results show that active reachable Bitcoin nodes play an essential role in the vitality and resilience of Bitcoin’s network. They allow the new joining nodes to connect to other peers and provide them with the current ledger state. For more efficient and fast data propagation, the role played by Well-connected nodes in the network could be extended. Well-connected nodes can be considered as Bitcoin Master nodes and used to improve the propagation delays. The transactions and blocks could be propagated in two steps: (1) from one cluster to other adjacent clusters in the network and (2) from Master nodes to typical peers in each cluster. For efficient data transfer between different clusters in step (1), utilizing Boundary Master nodes would avoid any redundancy in the data propagation. The powerful influence of Well-connected nodes shown by the dynamicity analysis may threaten the Bitcoin network operation. More thorough studies are required on the dynamics of Well-connected nodes to specify the danger posed to Bitcoin.

5.1. Performance Improvement

The community structure measurement results show that active reachable Bitcoin’s nodes play an essential role in the vitality and resilience of Bitcoin’s network, as they allow the new joining nodes to connect to other peers and provide them with the current ledger state. Specifically, the role played by Well-connected nodes (nodes with more than default peer count and up-to-date ledger) could possibly be extended for more efficient and fast data propagation. Here, we provide an exemplary improvement suggestion and preliminary simulation results when applied to the network.

In our proposal, Well-connected nodes can be considered as Bitcoin Master nodes and used to improve the propagation delay as follows: Considering that $N\left\{n_{1,}{n}_{2,}, \dots , n_{i,}\right\}$ is a set of nodes in the Bitcoin network where $i$ presents the number of total nodes. $MN\left\{m{n}_1,m{n}_{2,}, \dots , m{n}_{j,}\right\}$ presents the Master nodes set where $j$ presents the number of total Master nodes ($MN \subseteq N$).

Considering that $m{n}_x\left\{m{n}_x, p_1,p_2,\dots ,p_k\right\}$ where $m{n}_x$ presents the set of Master nodes in the given $x$th cluster, $k$ is the total number of peers in the cluster. Thus, we have $m{n}_x \subseteq N$ and $N=m{n}_1\cup m{n}_2 \cup \dots \cup m{n}_x$. Now, when a new node $q$ wants to join the network, it first connects to a Special Node $\left(SN\right)$ learned from the $DNS$ seeds. The $SN$ provides node $q$ with the list of the available Master nodes to establish a connection with. Node $q$ selects one master node $m{n}_i$ where $\forall m{n}_i\in MN$ and $distance\left(q, m{n}_i\right)\le distance\left(q, m{n}_x\right)$. Knowing some peers can be part of different clusters. Considering that, the following two clusters $C=c_1, c_2, \dots , c_n$ and $G=g_1, g_2, \dots , g_n$, and $\left[c_y, g_y\right]$ presents the boundary nodes of both clusters where $c_y \in C and g_y \in G$. Thus, all peers of both clusters where $c_n \ne c_y,g_n \ne g_y, c_n ϵ S, and g_{n }ϵ G$, we have $distance \left(c_n, g_n\right)\ge distance \left(c_y, g_y\right)$. We need to emphasize here that the $distance \left(x, y\right)$ point out the geo-internet distance of the two nodes x and y in the Bitcoin network.

To evaluate our proposed propagation method, we simulate the network using the same node count measured from the Bitcoin main network in our previous work [36]. Within the conducted experiment, the transaction generated by a given Master Nodes (MN) is propagated from MN to each directly connected node (where a few are boundary nodes). Then, the neighboring (master, boundary, and normal) nodes record the latency by which all the peers would receive the transaction. For example, when a Bitcoin node $BN$ with $n$ direct connections (neighboring peers) broadcasts a transaction at time $t_{\mathrm{BN}}$, the sent data is received at different times ($t_1, t_2, \dots , t_n$) by $BN$’s neighboring peers, where $t_n>t_{n-1}>\dots >t_2>t_1$. Thus, the time differences between the broadcast event and the arrivals of data at each peer ($\Delta t_{BN,1}$, $\Delta t_{BN,2}, \dots , \Delta t_{BN,n}$) is calculated as follows:

$$\Delta t_{BN,i}=t_i-t_{BN}$$

(25)

Now, $\Delta t_{BN,i}$ refers to the time taken for the Bitcoin node $BN$ to finish data propagation to all its peers.

The simulation results indicate that information propagation using Master nodes could improve the propagation delay by proximity ×25 compared to the Bitcoin default protocol, as shown in Figure 5. The most plausible explanation for the significant improvement in the propagation delay compared to Bitcoin’s default protocol is that Master nodes propagation takes advantage of the correlation results shown in the communication cost long computed using the distance of boundary nodes between Bitcoin clusters. We need to emphasize that since in the main network, the latency might be affected by many events such as loss of connections. To increase the accuracy of the collected latencies, we run the simulation 100 times and provide the average of the gotten results. We notice that after 100 runs, the latency remains the same irrespective of the changes made on the number neighboring peers of the master node if all clusters are fully connected.

5.2. Analysis of Security Vulnerabilities

Bitcoin is a pseudo-anonymous network since each actor owns a public address that theoretically could be mapped to an IP address through proper network analysis. Any successful mapping of actors’ IP addresses to a real-world identity [24,43,44] can threaten the anonymity concept in the Bitcoin network and the privacy of its actors, which represents a crucial defect in the cryptocurrency ecosystem. With the considerable adaptation and use of Bitcoin and a Market Cap at a current level of 358.81B, a few sophisticated techniques were proposed to map the Bitcoin public address to IP addresses and real-world identities. In the bitcoin network, nodes keep broadcasting their IP addresses allowing other nodes to maintain their presence in the network. Collecting revealed IP addresses can be easily done by scanning the Bitcoin main network. Thus, grouping those addresses using geo-graphic regions (geolocation) or autonomous systems (AS) is as simple as collecting them. Considering the K-anonymity attack, where “K” presents the total count of nodes belonging to a particular AS or a particular geo-region “X,” the anonymity of nodes resident in the given AS/geo-region becomes K-out-of-X. A previous study [30] showed that over 6% of the ASes participating in the Bitcoin network have a single node, in such cases, the anonymity of the node converges to a minimal one-out-of-one. Thus, we can easily link the Bitcoin public addresses to the IP address and trace back all transactions from those public addresses to the real user ID.

Bitcoin is a pseudo-anonymous network since each actor owns a public address that theoretically could be mapped to an IP address through proper network analysis. Any successful mapping of actors’ IP addresses to a real-world identity can threaten the anonymity concept in the Bitcoin network and the privacy of its actors, which represents a crucial defect in the cryptocurrency ecosystem. With the considerable adaptation and use of Bitcoin and a Market Cap at a current level of 358.81B, a few sophisticated techniques were proposed to map the Bitcoin public address to IP addresses and real-world identities. In the bitcoin network, nodes keep broadcasting their IP addresses allowing other nodes to maintain their presence in the network. Collecting revealed IP addresses can be easily done by scanning the Bitcoin main network. Thus, grouping those addresses using geo-graphic regions (geolocation) or autonomous systems (AS) is as simple as collecting them. Considering the K-anonymity attack, where “K” presents the total count of nodes belonging to a particular AS or a particular geo-region “X,” the anonymity of nodes resident in the given AS/geo-region becomes K-out-of-X. A previous study [30] showed that over 6% of the ASes participating in the Bitcoin network have a single node, in such cases, the anonymity of the node converges to a minimal one-out-of-one. Thus, we can easily link the Bitcoin public addresses to the IP address and trace back all transactions from those public addresses to the real user ID.

6. Conclusions

In this work, we proposed a deep non-linear method that combines topology data and content data of a distributed network to detect community structure. The proposed approach integrates a deep feature representation algorithm (DFR) founded on Deep Feedforward Autoencoders (DAFE). Our results regarding the community structure showed that the Bitcoin graph displays a higher community structure, high assortativity coefficient, and clustering coefficient than expected from a randomly distributed network. In Bitcoin, nodes tend to establish links with nodes like them more often than any other random network. Moreover, the presented results indicate that well-connected nodes take a leading role in the vitality and resilience of the Bitcoin network.

Our future work is being split into two directions. On the one hand, we aspire to improve the proposed method by focusing on the label propagation mechanism and narrowing the focus in a graph. On the other hand, we intend to enhance the data propagation using a community-based propagation algorithm and focus on the threat posed to Bitcoin due to the existing well-connected nodes.