A Multi-Dimensional Covert Transaction Recognition Scheme for Blockchain

Abstract

Covert communication was widely studied in recent years in terms of keeping the communication of entities on the Internet secret from the point of view of information security. Due to the anonymity of accounts and the publicness of the ledger, blockchain is a natural and ideal channel for helping users establish covert communication channels. Senders can embed secret messages into certain fields in transactions, and receivers can extract those messages from the transactions without attracting the attention of other users. However, to the best of our knowledge, most existing works have aimed at designing blockchain-based covert communication schemes. Few studies concentrated on the recognition of transactions used for covert communication. In this paper, we first analyze convolutional neural network (CNN)-based and attention-based covert transaction recognition schemes, and we explore the deep relationship between the appropriate extraction of features and the embedded fields of covert transactions. We further propose a multi-dimensional covert transaction recognition (M-CTR) scheme. It can simultaneously support both one-dimensional and two-dimensional feature extraction to recognize covert transactions. The experimental results show that the precision and recall of the M-CTR in recognizing covert transactions outperformed those of existing covert communication schemes.

1. Introduction

Covert communication was first proposed by Lampson [1] in 1973. Unlike common information-hiding technologies, such as steganography, anonymous communication, and watermarks, covert communication focuses on embedding information into public communication channels. In recent years, the public blockchain, as a new, decentralized, and anonymous data storage system, has been widely used in the fields of finance, the Internet of Things, notarization, etc. Compared with traditional solutions, such as challenge–response authentication [2], the public-chain blockchains have many characteristics. Using a public blockchain to establish covert communication has several distinct advantages. First, since a public blockchain is a data storage system, all accounts can be used as senders and receivers to communicate secret messages. Second, since a public blockchain is a decentralized system, it can eliminate the need for the participation of a trusted third party and, thus, helps simplify the covert communication model. Third, since a public blockchain is an anonymous system, users are merely required to bind the addresses of their accounts with their identities. Their real identities do not need to be disclosed. Finally, since the ledger of a pubic blockchain is shared with every user, both senders and receivers can obtain all of their transactions from anywhere in the world. In summary, the decentralization, anonymity, and public ledger of blockchain can provide a secure and stable communication channel for transfering covert messages.

Partala [3] proposed the BLOCCE scheme, which was generally regarded as the first provably secure blockchain-based covert communication scheme. Following that, research on blockchain-based covert communication schemes began to be a new hotspot. In 2020, Gao et al. [4] proposed Kleptography, which used a digital signature on a blockchain. In 2021, Guo et al. [5] proposed a covert communication scheme on Monero.

Although several studies have built covert transactions on a blockchain, the way of recognizing those covert transactions is still an open challenge. Only a few researchers have worked on this. We address two main factors that make covert transaction recognition tricky. On one hand, the covert transactions embedded in the ledger of a public blockchain usually use encryption. Most of the parsed data fields in the transactions have no obvious semantic information, and they are just composed of numbers and letters. So, it is difficult to find covert transactions through conventional semantic analysis methods. On the other hand, each transaction datum consists of more than 20 data fields. The construction of covert blockchain transactions can use different fields to embed information in different ways. Therefore, the recognition of covert transactions requires one to use multiple data fields for feature extraction. This leads to high requirements for designing a machine-learning-based covert transaction recognition model.

Due to the aforementioned challenges, few works have studied the recognition of covert communications. Recently, Wang et al. [6] proposed a covert transaction recognition (CTR) model by using a text convolutional neural network (TextCNN) [7] and a back-propagation neural network (BPNN) to recognize covert transactions. They used the total amount of transaction fees, transaction scripts, the addresses of inputs and outputs, and the total numbers of the transactions for each address as the features. Their model was able to achieve high precision and recall for at least seven covert transaction construction schemes. However, it did not explain the technical reason for choosing a CNN as the recognition model well. Furthermore, due to our exploration in this paper, we found that most addresses that were used to send covert transactions had lower frequencies of generating transactions than the addresses that only sent normal transactions in Wang’s datasets [6]. In other words, the total numbers of transactions for each address were too strong to be a feature. Thus, we deliberately removed the influence of this feature. The concrete contributions of this paper can be divided into three aspects:

• We first analyze two CNN-based covert communication recognition schemes and one attention-based covert communication recognition scheme, and we explain why these three schemes have different values of precision and recall for different covert communication schemes. That is, we explore the deep relationship between the appropriate feature extraction and the embedded fields of covert transactions through an experimental analysis.
• We further propose a multi-dimensional covert transaction recognition (M-CTR) scheme. This hybrid M-CTR scheme extracts both one dimension and two dimensions of the features.
• Our experiments demonstrate that the precision and recall of the covert transaction recognition are higher than those of existing schemes for four different blockchain-based covert communication schemes.

The rest of this paper is organized as follows. Section 2 provides a review of related works. Section 3 briefly introduces the preliminaries. In Section 4, we explore the relationship of the CNN-based and attention-based covert communication recognition schemes with the embedded fields of covert transactions. In Section 5, we propose the multi-dimensional covert transaction recognition scheme. Section 6 describes how the experiments were run, and Section 7 draws the conclusions.

2. Related Works

In this section, we review the existing covert communication construction schemes and covert transaction recognition schemes.

2.1. The Construction of Covert Communications

Most covert communication construction schemes embed secret messages by using the address field, the digital signature field, the smart contracts of transactions, and the time intervals of the generation of transactions.

The address field was the first to be used to embed secret messages. In this type of covert communication scheme, the two parties in a communication use different input and output addresses in transactions, which are the carriers of the secret messages. The BLOCCE scheme [3] was the earliest blockchain-based covert communication scheme. It used the least significant bit (LSB) of the receiver’s address to transfer secret messages. Similarly, the V-BLOCCE scheme [8] used the addresses generated by Vanitygen to embed secret messages. This improved the embedding efficiency and reduced the number of addresses required for secret messages with the same length. Huang [9] proposed a scheme for embedding hidden data into a public key hash by using an encryption algorithm and proposed a key update mechanism. However, this method did not have forward security. Following that, Cao et al. [10] proposed the hash-chain-based covert data embedding (HC-CDE) scheme, which used a special address generation algorithm to transfer secret messages. The binary of the secret messages was used to take part in constructing the addresses. Receivers could recover the secret messages by secretly checking the transaction chain for the constructed addresses. Luo et al. [11] generated an index matrix of addresses according to the transaction generation time. Receivers could decode the secret messages by locally sorting the transactions. Tian et al. [12] generated special addresses with dynamic labels based on the statistical distribution of normal transactions in the OP_RETURN field. They used those addresses to transfer secret messages.

Apart from the address field in transactions, the digital signature field is also famous for the embedding of secret messages. In this type of covert communication scheme, the digital signature of an input or output is used to embed secret messages. The digital signature algorithm (DSA) [13] scheme was the first scheme to propose a digital-signature-based model for constructing covert channels. The unspendable output [14] scheme embedded C&C (command-and-control) instructions into bitcoin transactions by generating unspendable outputs to achieve botnet C&C communication. At the same time, the author also realized the use of OP_RETURN via key leakage and created subliminal channels to realize botnet C&C communication. Frkat et al. [15] constructed a covert channel in botnets by using the elliptic curve digital signature algorithm (ECDSA) in the Bitcoin system. Guo et al. [5] and Lan et al. [16] combined the ring signature algorithm in Monero to build covert channels.

Smart contracts were also used to embed secret messages. This type of covert communication scheme involves viewing smart contracts as the information carriers. Basuki et al. [17] applied smart contracts as sensor gateways and combined them with image steganography to construct covert communications. Zhang et al. [18] used different options in voting contracts and different bid numbers in bidding contracts to transfer secret messages.

The rest of the covert communication construction schemes applied the P2P (peer-to-peer) broadcast mechanism to transfer secret messages. Covert transactions can use the spatial characteristics of the transactions to embed secret messages to build covert channels. Abdulaziz et al. [19] proposed the first spatial covert communication scheme on Ethereum. Then, Zhang et al. [20] and Zhang et al. [21] also designed covert communication schemes to improve the covertness and security. Recabarren et al. [22] utilized the Gossip protocol in the Bitcoin system to build covert channels by using Tithonus, a Bitcoin-based censorship resilience client.

2.2. The Recognition of Covert Transactions

In recent years, researchers have attempted to use machine learning and deep learning models to recognize covert transactions. Theoretically, some patterns would be different for normal transactions and covert transactions in a blockchain because of their different purposes. The former are used to transfer money, while the latter are used to transfer secret messages. Hence, unsupervised and supervised learning models that are proposed for abnormal detection are probably also valid for recognizing covert transactions.

From the viewpoint of unsupervised learning models, Monamo et al. [23] presented a pruned K-means clustering algorithm for detecting abnormal transactions in the Bitcoin system. Pham et al. [24] created a transaction relationship graph by linking the input and output addresses in Bitcoin transactions. Based on this graph, the support vector machine (SVM) and K-means clustering algorithms were used to detect abnormal transactions. Sirine et al. [25] collected similar attacks by using the K-means clustering and SVM algorithms to detect outlier transactions.

From the viewpoint of supervised learning models, Bartoletti et al. [26] proposed RIPPER. They built a Bayesian network and a random forest classifier to analyze abnormal transactions. Weber et al. [27] used logistic regression (LR), a random forest (RF), a multilayer perceptron (MLP), and a graph convolutional network (GCN) to detect abnormal transactions. Hu et al. [28] built an Adaboost classifier to distinguish abnormal transactions, and they combined it with a graph embedding algorithm, node2vec, to handle unknown transactions.

3. Preliminaries

This section first introduces two existing convolutional neural network (CNN)-based classification schemes, which are named the TextCNN [7] and ResNet [29], and an attention-based classification scheme, which is called the Swin transformer [30]. Then, we present a TextCNN and back-propagation neural network (BPNN)-based covert transaction recognition scheme [6].

3.1. TextCNN for Classification

The TextCNN [7] is a breakthrough in the application of CNNs that were previously used for text classification in the area of natural language processing. Compared with traditional CNNs, the TextCNN makes the structure of the neural network simpler. It has only one convolutional layer and one maximum pooling layer. The pooling layer is concatenated with the softmax function. The architecture of the TextCNN is shown in Figure 1. Here, the input layer of the TextCNN is a one-dimensional sentence or a piece of text with a length of n, which can be expressed as in Equation (1).

$${\mathbf{x}}_{1:n}=x_1\oplus x_2\oplus \dots \oplus x_n$$

(1)

where ⊕ is the concatenation operator. After the text is segmented, embedding is performed on each word to complete word vector encoding. The number of words is the length of the input data, while the dimension of the embedding is the width of the input data. After embedding, a matrix of [seq_len, embedding_dim] can be obtained. The convolutional layer of TextCNN consists of two layers of filters. The window_size of each layer of filters is 3, 4, and 5, respectively. Each filter performs the convolution operation on the input data to obtain the feature map C, as shown in Equations (2) and (3).

$$c_i=f\left(\mathbf{w}·{\mathbf{x}}_{i:i+h-1}+b\right)$$

(2)

$$C=\left[c_1,c_2,\dots ,c_{n-h+1}\right]$$

(3)

Here, $b\in \mathbb{R}$ is a bias term and f is a nonlinear function, ${\mathbf{x}}_{i:i+j}$ refers to the concatenation of words ${\mathbf{x}}_i,{\mathbf{x}}_{i+1},\dots ,{\mathbf{x}}_{i+j}$. The obtained feature C is then the pooled layer, the pooling method chosen for the TextCNN is maximum pooling, and the maximum value $\widehat{C}$ is obtained after pooling:

$$\widehat{C}=max\left\{C\right\}$$

(4)

Then, all of the maximum values are spliced into a one-dimensional vector and input into the softmax function to complete the classification.

3.2. ResNet for Classification

The ResNet [29] has been widely used in the tasks of anomaly detection, image classification, object recognition, etc. Since the internal residual block of the ResNet uses the technique of a shortcut, it can alleviate the problem of gradient disappearance, which is usually caused by increasing the depth of neural networks. Thus, the ResNet is conveniently optimized by increasing the depth of the hidden layers.

ResNet34 [29] is one of the classical ResNet networks. The input image size of this model is 224 × 224 pixels, and it includes one convolutional network and four residual convolution blocks. Each internal residual convolution block includes a different number of convolution blocks. Finally, a fully connected layer is used at the end of the network. The whole architecture of ResNet34 is shown in Figure 2.

The 34 layers of the convolutional neural network can be divided into different residual network blocks, and a shortcut is added to each residual network block. The structure of an internal residual network block is shown in Figure 3.

For a residual block with the same dimensions of $\mathcal{F}\left(\mathbf{x}\right)$ and $\mathbf{x}$, the output of this block can be expressed as shown in Equation (5).

$$\mathbf{y}=\mathcal{F}\left(\mathbf{x},\left\{W_i\right\}\right)+\mathbf{x}$$

(5)

where $\mathbf{x}$ and $\mathbf{y}$ are the input and output of the residual block. The function $\mathcal{F}\left(\mathbf{x},\left\{W_i\right\}\right)$ represents a residual mapping, where $\mathcal{F}=W_2\sigma \left(W_1\mathbf{x}\right)$, $\sigma$ represents the ReLU activation function, and the biases are omitted for simplification.

For a residual block whose $\mathcal{F}\left(\mathbf{x}\right)$ and $\mathbf{x}$ dimensions are not the same, its formula is expressed as:

$$\mathbf{y}=\mathcal{F}\left(\mathbf{x},\left\{W_i\right\}\right)+W_s\mathbf{x}$$

(6)

where $W_s$ is used for the size matching of $\mathcal{F}\left(\mathbf{x},\left\{W_i\right\}\right)$ and $\mathbf{x}$.

3.3. Swin Transformer for Classification

The Swin transformer [30] applies an attention mechanism to build a neural network. Compared with other transformer-like models, the Swin transformer has two outstanding features. On one hand, it has a rich hierarchical structure. This enables the Swin transformer to extract the features of different levels of a picture. Moreover, as the hierarchy increases, the resolution of the image is gradually reduced, which can allow downsampling to be achieved for the model. On the other hand, the Swin transformer contains a shifted local-window attention mechanism. Unlike the previous global-window attention mechanism, this mechanism can divide the input into multiple small windows. The features can be extracted from the global input data by continuing to move the small window. In this way, the calculation of the global window is divided into that of small windows. This can greatly reduce the computational overhead. At the same time, by shifting the local window, two adjacent windows can interact with each other. Thus, the Swin transformer can also achieve the attention effect of a global window.

3.4. The TextCNN [7] and BPNN for Covert Transaction Recognition

Wang et al. [6] constructed a TextCNN [7] and BPNN-based covert transaction recognition (CTR) scheme by distinguishing the different patterns of normal transactions and covert transactions. The architecture of the CTR scheme is shown in Figure 4.

The CTR scheme mainly consisted of two neural networks. The first neural network was a text convolutional neural network (TextCNN) [7], which was used to extract features from the text field of transactions. These features covered the fields of hashes, hexes, inputs, outputs, scripts, and OP_RETURN. The second neural network was a back-propagation neural network (BPNN), which was used to handle the numerical characteristics of blockchain transactions. These features include the fields of “vin sz, vout sz, transaction value, transaction fee” in transactions, and they additionally extracted the average over all of the historical transactions for the input and output addresses. The outputs of the two neural networks were concatenated and then went through a two-layer fully connected neural network to obtain the final result.

4. The Relationship between the Dimensions of Features and Covert Communication Construction

We explore the relationship between the dimensions of features and covert communication construction in this section. Here, we first integrated several datasets with positive samples from multiple covert communication construction schemes and negative samples from the ledger of a public blockchain. The four positive sample datasets that we selected—specifically, BLOCCE [3], Unspent outputs [14], DSA [13], and HC-CDE [10]—were all from Wang et al. [6]. The data contained in each dataset had the same format as that of the normal transactions on the blockchain, and the field content that was irrelevant to covert communications had similar characteristics and distribution rules to those of normal transactions. Our negative sample was the normal transactions on a blockchain. In this paper, we set the proportion of training, validating, and testing data samples to 7:1:2.

We then selected fields that the sender of a covert transaction could change and several key fields. Specifically, these features were selected from 14 data fields of the transactions.

We list all of these data fields below.

the hash of the transaction: Each transaction is uniquely identified by a hash in the blockchain.

total value: The total number of Satoshis that are recorded in a transaction.

transaction fee: The total number of fees collected by miners in a transaction.

vin_sz: The total number of inputs in a transaction.

vout_sz: The total number of outputs in a transaction.

inputs.prev_hash: The hash of the unspent output of the previous transaction.

inputs.script: Raw hexadecimal encoding of the script.

inputs.value: The value of the output being recorded in the previous transaction.

inputs.addresses: An array of addresses associated with the output of the previous transaction.

outputs.value: The value of the output being recorded in a transaction.

outputs.script: Raw hexadecimal encoding of the encumbrance script for the output.

outputs.addresses: Addresses that correspond to the output.

outputs.script_type: The type of encumbrance script that is used for the output.

outputs.data_string: An ASCII representation of an OP_RETURN data field.

We adopted the following four metrics as performance indicators.

• Accuracy: The proportion of correct predictions.

  $$\mathrm{Accuracy}=\frac{tp+tn}{tp+fp+tn+fn}$$

  (7)
• Precision: The number of true positives divided by the sum of the number of true positive and false positive samples.

  $$\mathrm{Precision}=\frac{tp}{tp+fp}$$

  (8)
• Recall: The number of true positives divided by the sum of the number of true positive and false negative samples.

  $$\mathrm{Recall}=\frac{tp}{tp+fn}$$

  (9)
• F1-score: Represents the harmonic mean of the precision and recall.

  $$\mathrm{F}1-\mathrm{score}=\frac{2\mathrm{Precision}*\mathrm{Recall}}{\mathrm{Precision}+\mathrm{Recall}}$$

  (10)

We first used the TextCNN [7] to identify the four covert transaction construction schemes. We chose TextCNN for two reasons. First, after the decoding of ordinary Bitcoin transactions, the contents of different fields have different meanings, and some fields of hidden transactions and normal transactions may have obvious differences in their text content. The main purpose of covert communication on a blockchain is to build covert channels, which may require the continuous transmission of information. So, we hypothesize that there may be correlations between different covert transactions, such as the same address, the same amount, etc., which makes this similar to the task of text classification with the same keyword. Therefore, we believe that from the technical point of view, the covert transaction recognition and text classification tasks have certain similarities, and we can use a text classification model for covert transaction recognition. Second, before this, Wang et al. [6] used the TextCNN to identify hidden transactions. From their experimental results, we can see that the TextCNN really worked when recognizing covert transactions and could achieve better recognition accuracy.

However, we believe that Wang et al. [6] had limitations in terms of field selection. Based on the CTR [6] model, this paper first deleted the extraction of the average over all of the historical transactions for the input and output addresses in the data extraction stage. The reason for deletion was that these data did not exist in the blockchain transactions and belonged to the data after statistical analysis by using third-party tools. Moreover, the address used for covert transactions is often a newly generated address. The average value of historical transactions of this type of address does not have much reference value. The deleted CTR model is equivalent to the TextCNN [7], so we first used the TextCNN to identify the four covert transaction construction schemes.

Here, the input of the TextCNN was the long text of covert transactions, without distinguishing data fields, while the input format was a one-dimensional matrix with a length of 1400. The recognition results are shown in the first row of

Table 1. Results of convert transaction recognition.

Recognition Scheme	Data Dimension	Recognition Object	Accuracy	Precision	Recall	F1-Score
TextCNN [7]	one-dimensional	BLOCCE [3]	69.194	69.115	69.194	69.054
		Unspent outputs [14]	66.915	66.948	66.915	66.882
		DSA [13]	71.429	77.136	71.429	68.937
		HC-CDE [10]	69.617	69.688	69.617	69.633
Swin-Transformer [30]	two-dimensional	BLOCCE [3]	68.585	68.267	67.969	68.049
		Unspent outputs [14]	65.743	65.623	65.716	65.628
		DSA [13]	63.636	63.769	62.919	62.712
		HC-CDE [10]	98.789	98.918	98.663	98.775
ResNet34 [29]	two-dimensional	BLOCCE [3]	65.877	66.144	65.877	65.891
		Unspent outputs [14]	65.423	65.499	65.423	65.392
		DSA [13]	65.714	65.521	65.714	65.146
		HC-CDE [10]	99.282	99.292	99.282	99.282

.

In order to compare the differences among different models for recognizing covert transaction construction schemes and to find a scheme with a better recognition effect, the Swin transformer [30] was selected in this paper, as it has had outstanding performance in the recognition field in recent years; so, it was chosen as the second recognition model for recognizing four types of covert transactions. Similarly, the input of the Swin transformer was partitioned according to the embedding fields of the transactions, the input format was a two-dimensional matrix, and the matrix size was 224 × 224. The recognition results are shown in the second row of Table 1.

From the first two rows of Table 1, it can be seen that the BLOCCE [3], Unspent outputs [14], and DSA [13] schemes had higher accuracy when using the TextCNN for recognition. For the HC-CDE [10] scheme, the accuracy of recognition when using the Swin transformer was much higher than that when using the TextCNN, with an accuracy of 98%, which was 41.9% higher than with the TextCNN. Based on the aforementioned results, we explored the different advantages of different neural network types and different data input methods when recognizing different covert communication construction schemes. More specifically, the TextCNN with a one-dimensional data input CNN model was more suitable for identifying covert communication construction schemes, such as BLOCCE, Unspent outputs, and DSA, while the two-dimensional data input Swin transformer model could better identify covert communication construction schemes such as HC-CDE with correlations between different transactions.

We went on to select a third type of neural network to validate the above exploration. Here, we selected the 2D data input CNN model ResNet34 [29] for verification. We chose ResNet34 for two reasons. First, since covert transactions need to be sent continuously, we assumed that there must be some correlation between different covert transactions. Similarly, we also assumed that there would be a correlation between the input and output of the same transaction. In the image classification task, the similarity of the pixels in different parts of an image needs to be recognized, the correlations between the pixels of the image sample need to be learned under a certain classification, and the distribution rule needs to be obtained. Only the specific value of the pixel point is needed, and the specific meaning is not necessary. The encrypted semantic-free sequence of covert transactions has similar characteristics. We believe that in terms of technology, the covert transaction recognition and image classification tasks also have certain similarities. An image classification model can be used to identify covert transactions. Second, ResNet34 is a classic model in the field of computer vision, and it has shown good performance in image classification and recognition. Moreover, if a residual network block is added, it can eliminate the negative impact of in-depth training. This was also useful in covert transaction recognition when we trained our AI model in the experiments.

The input of ResNet34 was a two-dimensional matrix of sub-fields, and the matrix size was 224 × 224. This model was used to extract two-dimensional features from the data fields of covert transactions, and the feature extraction method of the Swin transformer [30] was retained.

The third row of Table 1 shows the recognition results of the ResNet34-based [29] convert transaction recognition scheme for four types of covert communication data. Because in BLOCCE [3], Unspent outputs [14], and DSA [13], the embedded messages are not related to the transaction order, but are only embedded in a certain field of a transaction, in theory, the training model effect of a one-dimensional data input will be better than that of a two-dimensional input. On the contrary, because a message in HC-CDE [10] is embedded in multiple sequential transactions with a time-series correlation, in theory the training model effect of a two-dimensional data input will be better than that of one-dimensional data from the perspective of correlation. The experimental results were consistent with our hypothesis. From Table 1, it can be seen that although ResNet34 and the Swin transformer had different model types, ResNet34 with the two-dimensional data input and the Swin transformer with the two-dimensional data input showed the same high recognition of the HC-CDE-type covert communication construction schemes.

The above experimental results show that the dimension of the input data greatly affects the recognition accuracy of the covert communication construction scheme. A two-dimensional data input model can capture features that cannot be captured by a one-dimensional model, and it can complement the one-dimensional model in order to further improve the recognition accuracy of the covert communication construction scheme.

5. Multi-Dimensional Covert Transaction Recognition

Based on the above exploration, we propose a new multi-dimensional covert transaction recognition (M-CTR) scheme. The M-CTR scheme can support both one-dimensional and two-dimensional feature extraction.

We first introduce the model architecture, then explain its mechanism, and, finally, present the experimental results of the model when applied to a covert communication dataset.

Figure 5 shows the architecture of the M-CTR scheme. It consists of a one-dimensional convolutional neural network and a two-dimensional convolutional neural network. The structure of the one-dimensional convolutional neural network is similar to that of the TextCNN [7]. On the basis of the TextCNN, we removed the two-channel filtering and replace it with single-channel filtering. Meanwhile, we changed three filters and set their kernel_sizes to 20, 30, and 40, respectively. The original kernel_sizes of the six filters were 3, 3, 4, 4, 5, and 5. Here, we enlarged the size to capture associations in a larger range of long texts. The kernel_sizes of the six filters in the M-CTR scheme were 3, 4, 5, 20, 30, and 40. The two-dimensional convolutional neural network in the M-CTR scheme adopted the network structure of ResNet34. It constructed a two-dimensional data input matrix by embedding different data fields.

The M-CTR scheme used 14 data fields of transactions, including the hash, total value, transaction fee, vin_sz, vout_sz, inputs.prev_hash, input.script, input.value, input.addresses, output.value, output.script, output.addresses, output.script_type, and output.data_string fields. The extracted data fields are expressed as follows:

$$X_i=\left[x_{i1},x_{i2},\cdots x_{i{l}_i}\right]$$

(11)

where i represents the i-th data field, and $l_i$ represents the number of characters in the i-th field.

For the one-dimensional CNN model, its input was a one-dimensional matrix composed of simple connections of each data field. The equation is as follows:

$$X_{1D}=X_1\oplus X_2\oplus \dots \oplus X_{14}$$

(12)

where ⊕ is the concatenation operator. Referring to the structure of the TextCNN, we performed a zero-fill operation on the one-dimensional input data and unified the lengths of all input data to 1400 characters. Once the data fields in the transactions contained the hash-encrypted data, semantic analysis could not be directly performed on them. Therefore, the M-CTR scheme constructed a dictionary of features based on their frequency of occurrence to complete the word embedding process.

The TextCNN model contained six filters. The window sizes of the filters were 3, 4, 5, 20, 30, and 40. The process of feature extraction of the input data by the filter is shown in Equations (2)–(4), where the activation function involved in Equation (2) was selected as the ReLU function. The pooled results of the six filters are denoted as ${\widehat{C}}_h$:

$${\widehat{C}}_h=max\left\{C\right\},h\in (3,4,5,20,30,40)$$

(13)

where h represents the window size of the filter. The features generated by different filters were connected to obtain S, which was followed by a fully connected layer with an activation function to obtain the predicted label of the one-dimensional model.

$$S={\widehat{C}}_3\oplus {\widehat{C}}_4\oplus {\widehat{C}}_5\oplus {\widehat{C}}_{20}\oplus {\widehat{C}}_{30}\oplus {\widehat{C}}_{40}$$

(14)

$$Z_1=f\left(S\right)$$

(15)

The one-dimensional CNN model can be expressed as:

$$Z_1=f_{1D}\left(X_{1D}\right)$$

(16)

For the two-dimensional CNN model, the M-CTR scheme used ResNet34 [29]. The input content was still the 14 fields mentioned above, but we divided each field into layers, changed the input data into a two-dimensional matrix $X_{2D}$, embedded different fields into different rows of the matrix, and filled the rest of the matrix with 0. This was specifically expressed as:

$$X_{2D}=\left[\begin{array}{c}{X}_1\\ X_2\\ ⋮\\ X_i\end{array}\right]=\left[\begin{array}{ccc}{x}_{11},x_{12},\cdots ,x_{1l_1},& 0,\cdots & 0\\ x_{21},x_{22},\dots ,x_{2l_2},& 0,\cdots & 0\\ ⋮& ⋮& \\ x_{i1},x_{i2},\cdots ,x_{i{l}_i},& 0,\cdots & 0\\ 0& \cdots & 0\\ ⋮& ⋮& \\ 0& \cdots & 0\end{array}\right]$$

(17)

ResNet34 consisted of 17 residual network blocks. The network structure diagram is shown in Figure 2. The overall model can be expressed as

$$Z_2=f_{2D}\left(X_{2D}\right)$$

(18)

Finally, we compared the results obtained by the one-dimensional model and the two-dimensional model to obtain the final classification. The overall recognition model can be expressed as:

$$\widehat{Z}=f_{\mathrm{combine}}\left(f_{1D}\left(X_{1D}\right)\odot f_{2D}\left(X_{2D}\right)\right)$$

(19)

The experimental models all used the cross-entropy loss function as the loss function of the classifier, and the formula was as follows:

$$L=\frac{1}{N}\sum _i-\left[Z_{i}log{\widehat{Z}}_i+\left(1-Z_i\right)log\left(1-{\widehat{Z}}_i\right)\right]$$

(20)

where $Z_i$ represents the label predicted by the model, the positive sample is 1, and the negative sample is 0.

6. Performance Analysis

In this section, we compare the performance of the M-CTR scheme with that of the methods in existing works. We conducted experiments on four kinds of covert communication construction schemes, and the experimental results are shown in

Table 2. Results of the M-CTR scheme.

Recognition Scheme	Data Dimension	Recognition Object	Accuracy	Precision	Recall	F1-Score
M-CTR	one-dimensional & two-dimensional	BLOCCE [3]	70.853	70.745	70.853	70.779
		Unspent outputs [14]	75.373	75.425	75.373	75.376
		DSA [13]	78.242	78.325	78.242	78.145
		HC-CDE [10]	99.282	99.292	99.282	99.282

.

As can be seen from Table 2, when comparing with the TextCNN scheme, the M-CTR scheme outperformed the existing works. The accuracy when recognizing transactions constructed with the HC-CDE [10] scheme improved from 69.617% to 99.282%. In addition, for the BLOCCE [3], Unspent outputs [14], and DSA [13] schemes, the accuracy, precision, recall, and F1-score were increased by 2.39% (69.194% to 70.853%), 12.64% (66.915% to 75.373%), and 9.53% (71.429% to 78.242%), respectively. The experimental results show that the M-CTR scheme was more accurate than the methods in existing works.

7. Conclusions

This paper first analyzed and explored the relationship between the dimensions of features and the embedded fields of covert transactions. Namely, we explained why no neural networks can maintain high accuracy for different covert transaction construction schemes. Next, we proposed a multi-dimensional covert transaction recognition (M-CTR) scheme. This scheme extracts features from both one dimension and two dimensions. Therefore, the accuracy was stable for four different covert transaction construction schemes. The experimental results support this finding.

In the future, we can attempt to explore other relationships of covert transactions, such as by building an address relationship graph, to make the existing schemes more general. We can also test the covert transaction recognition schemes on more blockchain platforms and systems, such as Ethereum, etc.