A method of analyzing a cryptocurrency transaction by an electronic device including a user interface unit including an application programing interface (API), a memory storing instructions and a processor configured to execute the instructions to perform the method, the method comprising:
- a system environment setting step of setting system environment of the electronic device by receiving collection data range setting information using the API of the user interface unit;
- a blockchain management step of collecting distributed ledger information of a blockchain corresponding to a specific cryptocurrency from one or more cryptocurrency clients according to the collection data range setting information and standardizing blockchain data extracted from the distributed ledger information;
- a multi-type data management step of collecting multi-type data related to the cryptocurrency transaction from web pages by crawling of a crawler according to the collection data range setting information and standardizing the multi-type data, the multi-type data being additional information of the blockchain not included in the distributed ledger information and comprising data from one or more network services (SNS), dark web or surface web, wherein the collecting of the multi-type data comprises, based on a hyperlink existing in a web page among the crawled web pages, crawling, by the crawler, a web page linked through the hyperlink;
- a graph generation step of (i) creating a first node with a first object or first attribute extracted from the standardized blockchain data, (ii) constructing a cryptocurrency network graph by using the first node, (iii) creating a second node with a second object or a second attribute extracted from the standardized multi-type data, (iv) constructing a knowledge graph by using the second node, and (v) generating a multi-layer based transaction analysis knowledge graph by mapping the first node and the second node corresponding to each other,
- a step of receiving a cryptocurrency address associated with a flow of a fund to be tracked;
- a graph analysis step of searching for transaction information of the fund using the cryptocurrency address as an input address in the transaction analysis knowledge graph;
- and
- a step of generating a fund flow graph having the input address and an output address as nodes to track the flow of the fund;
- and
- a step of generating alerts for suspicious or anomalous transaction patterns by using machine learning,
- wherein the blockchain management step includes:
- a blockchain data collection step of collecting the distributed ledger information of the blockchain by using an application programming interface (API) of the one or more cryptocurrency clients, or parsing a block data managed by the one or more cryptocurrency clients, the distributed ledger information of the blockchain including information of a plurality of transactions of the specific cryptocurrency, and
- a blockchain data analysis step of analyzing a plurality of input addresses based on the collected distributed ledger information of the blockchain, and in response to analyzing the plurality of input addresses, (i) grouping, by using a multi-input heuristic algorithm for the specific cryptocurrency, public addresses included in a single transaction among the plurality of transactions as addresses of a same owner or (ii) grouping, by using the multi-input heuristic algorithm, public addresses in a plurality of address groups included in multiple transactions among the plurality of transactions as addresses of a same owner when each of the plurality of address groups includes a common address,
- wherein the cryptocurrency network graph is displayed on a plurality of layers classified according to different types of cryptocurrency, and the knowledge graph is displayed on a plurality of layers belonging to different categories, and
- wherein the multi-layer based transaction analysis knowledge graph has a multi-layer structure in which nodes of the cryptocurrency network graph and the knowledge graph are mapped to each other.