  Due to the pseudo-anonymity of the Bitcoin network, users can hide behind
their bitcoin addresses that can be generated in unlimited quantity, on the
fly, without any formal links between them. Thus, it is being used for payment
transfer by the actors involved in ransomware and other illegal activities. The
other activity we consider is related to gambling since gambling is often used
for transferring illegal funds. The question addressed here is that given
temporally limited graphs of Bitcoin transactions, to what extent can one
identify common patterns associated with these fraudulent activities and apply
them to find other ransomware actors. The problem is rather complex, given that
thousands of addresses can belong to the same actor without any obvious links
between them and any common pattern of behavior. The main contribution of this
paper is to introduce and apply new algorithms for local clustering and
supervised graph machine learning for identifying malicious actors. We show
that very local subgraphs of the known such actors are sufficient to
differentiate between ransomware, random and gambling actors with 85%
prediction accuracy on the test data set.
