Anonymous Networking Detection in Cryptocurrency Using Network Fingerprinting and Machine Learning

Cryptocurrency such as Bitcoin supports anonymous routing (Tor and I2P) due to the application requirements of anonymity and censorship resistance. In permissionless and open networking for cryptocurrency, an adversary can spoof to pretend to use Tor or I2P for anonymity and privacy protection, while, in reality, it is not using anonymous routing and is forwarding its networking directly to the destination peer to reduce networking overheads. Using profile detection based on deterministic features to detect anonymous routing and false claims is vulnerable to spoofing, especially in permissionless cryptocurrency bypassing registration control. We thus designed and built a method of network fingerprinting, using networking behaviors to detect and classify networking types. We built a network sensor to collect data on an active Bitcoin node connected to the Mainnet and applied supervised machine learning to identify whether a peer node was using IP (direct forwarding without the relays for anonymity protection), Tor, or I2P. Our results show that our scheme is effective in accurately detecting networking types and identifying spoofing attempts through supervised machine learning. We tested our scheme using multiple supervised learning models, specifically CatBoost, Random Forest, and HistGradientBoosting. CatBoost and Random Forest performed best and had comparable accuracy performance in effectively detecting false claims, i.e., they classified the networking types and detected fake claims of Tor usage with 93% accuracy and false claims of I2P with 94% accuracy in permissionless Bitcoin. However, CatBoost-based detection was significantly quicker than Random Forest and HistGradientBoosting in real-time testing and detection.