Systems and methods for monitoring and analyzing financial transactions on public distributed ledgers for suspicious and/or criminal activity

Systems and methods configured for monitoring and analyzing financial transactions on public distributed ledgers for suspicious and/or criminal activity are disclosed. Exemplary implementations may: access public third-party information for addresses involved in financial transactions; correlate a first portion of the public third-party information with transaction addresses; label the financial transactions and/or the addresses according to characteristics, such that individual ones of the addresses either have been labeled or are unlabeled; cluster the financial transactions and/or the addresses into a set of clusters that includes a first cluster; assign levels of risk for suspicious and/or criminal activity to the addresses and the financial transactions; and responsive to comparisons of levels of risk with a threshold, report transactions for suspicious and/or criminal activity.

FIELD OF THE DISCLOSURE

The present disclosure relates to systems and methods configured for monitoring and analyzing financial transactions on public distributed ledgers for suspicious and/or criminal activity.

BACKGROUND

Monitoring and analyzing financial transactions for suspicious and/or criminal activity is known, in particular for traditional electronic financial transactions between financial institutions. Conducting financial transactions on public distributed ledgers is known, in particular transactions including the exchange of amounts of cryptocurrency.

SUMMARY

One aspect of the present disclosure relates to a system configured for monitoring and analyzing financial transactions on public distributed ledgers for suspicious and/or criminal activity. The system may include one or more hardware processors configured by machine-readable instructions. The processor(s) may be configured to obtain information regarding a set of financial transactions that are recorded on a public distributed ledger. The set of financial transactions may include a first set of addresses. A first individual recorded transaction may include a first sender address and a first receiver address. A second individual recorded transaction may include a second sender address and a second receiver address. The processor(s) may be configured to access, through a network connection, public third-party information for a second set of addresses that includes one or both of the first sender address and/or the first receiver address. The public third-party information may originate from one or more public online sources that are external to the public distributed ledger. The processor(s) may be configured to correlate a first portion of the public third-party information that pertains to one or both of the first sender address and/or the first receiver address with one or both of the first sender address and/or the first receiver address. The first portion of the public third-party information may originate from a first public online source that is external to the public distributed ledger. The processor(s) may be configured to label one or more of the financial transactions and/or the addresses in the first set of addresses with labels representing characteristics of the one or more financial transactions and/or the addresses, such that individual ones of the addresses in the first set of addresses either have been labeled or are unlabeled. One or both of the first sender address and/or the first receiver address may be labeled with a first label. The first label may represent a first characteristic of the first individual recorded transaction. Labeling with the first label may be based on one or more of an entity, an activity, a platform, a correlation, and/or a product related to the first individual recorded transaction. One or both of the second sender address and/or the second receiver address may be unlabeled so far. The processor(s) may be configured to cluster one or more of the financial transactions and/or the addresses into a set of clusters that includes a first cluster. Clustering may be based on associations of different addresses. One or more addresses labeled with the first label may be clustered into the first cluster with one or both of the second sender address that is unlabeled, and/or the second receiver address that is unlabeled. Clustering into the first cluster may be based on an association between one or more addresses labeled with the first label and one or both of the second sender address and/or the second receiver address. The association may be based on one or more of a financial transaction from the set of financial transactions and/or based on the public third-party information. The processor(s) may be configured to assign levels of risk for suspicious and/or criminal activity to the first set of addresses that have been labeled with the first label, and to the second sender address and the second receiver address. The processor(s) may be configured to assign levels of risk for suspicious and/or criminal activity to the financial transactions from the set of financial transactions. A first level of risk may be assigned to the first individual recorded transaction and a second level of risk is assigned to the second individual recorded transaction. Assignment of the first level of risk may be based on at least the first label. Assignment of the second level of risk may be based on at least the assigned levels of risk of the second sender address and the second receiver address. The processor(s) may be configured to, responsive to comparisons of the first level of risk and the second level of risk with a risk threshold level, report one or both of the first and/or second individual recorded transactions for suspicious and/or criminal activity.

Another aspect of the present disclosure relates to a method configured for monitoring and analyzing financial transactions on public distributed ledgers for suspicious and/or criminal activity. The method may include obtaining information regarding a set of financial transactions that are recorded on a public distributed ledger. The set of financial transactions may include a first set of addresses. A first individual recorded transaction may include a first sender address and a first receiver address. A second individual recorded transaction may include a second sender address and a second receiver address. The method may include accessing, through a network connection, public third-party information for a second set of addresses that includes one or both of the first sender address and/or the first receiver address. The public third-party information may originate from one or more public online sources that are external to the public distributed ledger. The method may include correlating a first portion of the public third-party information that pertains to one or both of the first sender address and/or the first receiver address with one or both of the first sender address and/or the first receiver address. The first portion of the public third-party information may originate from a first public online source that is external to the public distributed ledger. The method may include labeling one or more of the financial transactions and/or the addresses in the first set of addresses with labels representing characteristics of the one or more financial transactions and/or the addresses, such that individual ones of the addresses in the first set of addresses either have been labeled or are unlabeled. One or both of the first sender address and/or the first receiver address may be labeled with a first label. The first label may represent a first characteristic of the first individual recorded transaction. Labeling with the first label may be based on one or more of an entity, an activity, a platform, a correlation, and/or a product related to the first individual recorded transaction. One or both of the second sender address and/or the second receiver address may be unlabeled so far. The method may include clustering one or more of the financial transactions and/or the addresses into a set of clusters that includes a first cluster. Clustering may be based on associations of different addresses. One or more addresses labeled with the first label may be clustered into the first cluster with one or both of the second sender address that is unlabeled, and/or the second receiver address that is unlabeled. Clustering into the first cluster may be based on an association between one or more addresses labeled with the first label and one or both of the second sender address and/or the second receiver address. The association may be based on one or more of a financial transaction from the set of financial transactions and/or based on the public third-party information. The method may include assigning levels of risk for suspicious and/or criminal activity to the first set of addresses that have been labeled with the first label, and to the second sender address and the second receiver address. The method may include assigning levels of risk for suspicious and/or criminal activity to the financial transactions from the set of financial transactions. A first level of risk may be assigned to the first individual recorded transaction and a second level of risk is assigned to the second individual recorded transaction. Assignment of the first level of risk may be based on at least the first label. Assignment of the second level of risk may be based on at least the assigned levels of risk of the second sender address and the second receiver address. The method may include, responsive to comparisons of the first level of risk and the second level of risk with a risk threshold level, reporting one or both of the first and/or second individual recorded transactions for suspicious and/or criminal activity.

As used herein, any association (or relation, or reflection, or indication, or correspondency, or correlation) involving transactions, addresses, labels, clusters, levels of risk, public online sources, and/or another entity or object that interacts with any part of the system and/or plays a part in the operation of the system, may be a one-to-one association, a one-to-many association, a many-to-one association, and/or a many-to-many association or N-to-M association (note that N and M may be different numbers greater than 1).

DETAILED DESCRIPTION

FIG. 1illustrates a system100configured for monitoring and analyzing financial transactions on distributed ledgers for suspicious and/or criminal activity, in accordance with one or more implementations. In some implementations, system100may include one or more servers102. Server(s)102may be configured to communicate with one or more client computing platforms104according to a client/server architecture and/or other architectures. Client computing platform(s)104may be configured to communicate with other client computing platforms via server(s)102and/or according to a peer-to-peer architecture and/or other architectures. Users may access system100via client computing platform(s)104. By way of non-limiting example, suspicious and/or criminal activity may pertain to fraud, sale of illegal goods, funding of terrorism, money-laundering and/or other financial activities. In some implementations, the used definition of suspicious and/or criminal activity may be governed by acts and/or regulations of international governmental bodies, national governments, the federal government, and/or other legal entities.

Distributed ledgers or decentralized ledgers may be configured to produce a secure record or registry of ownership of assets, transactions, and other information. For example, a blockchain is a distributed ledger. Blockchain technology may be used for cryptocurrencies, smart contracts, and other applications for a decentralized database. In some implementations, a distributed ledger may be a public distributed ledger if at least some of its information is publicly available. In some implementations, applications may be stored and/or executed on the distributed ledger. For example, such an application may be referred to as a distributed application. In some implementations, a distributed ledger may form the basis for a payment platform, e.g., Bitcoin, and/or other payment platforms. In some implementations, the distributed ledger may form the basis for a distributed computing platform, e.g., Ethereum, and/or other distributed computing platforms.

A distributed ledger may act as a decentralized database that stores a registry of assets, transactions, and/or other information across one or more networks. A given asset may be owned by a particular user. The asset may include anything of material value or usefulness that is owned by a person or company, according to some implementations. In some implementations, the distributed ledger may record ownership of assets and/or transactions that modify ownership of assets. A smart contract is a type of asset. In some implementations, once a smart contract, transaction, and/or message has been added to the distributed ledger, it may be referred to as published and/or posted. Services may be offered through a distributed application (or decentralized application) that is implemented through a distributed computing platform and based on a distributed ledger. The distributed ledger may be publicly accessible and append-only. In some implementations, existing blocks of the distributed ledger can substantially not be altered or deleted, unless multiple copies of the distributed ledger are altered. This is unlikely to happen provided that multiple copies of the distributed ledger are stored on different computing platforms, e.g. in different geographical locations. The distributed ledger may be replicated on multiple computing platforms, preferably in multiple different geographical locations.

Server(s)102may be configured by machine-readable instructions106. Machine-readable instructions106may include one or more instruction components. The instruction components may include computer program components. The instruction components may include one or more of an information obtaining component108, a third-party component110, a correlation component112, a labeling component114, a clustering component116, a risk assignment component118, a reporting component120, a cluster validation component122, and/or other instruction components.

Information obtaining component108may be configured to obtain information regarding a set of financial transactions that are recorded on one or more distributed ledgers, e.g., one or more public distributed ledgers. The set of financial transactions may include a first individual recorded transaction, a second individual recorded transaction, a third individual recorded transaction, and so forth. The set of financial transactions may include a first set of addresses. Addresses in the first set of addresses may be associated with sending and/or receiving transactions. An individual recorded transaction may include one or more sender addresses and/or one or more receiver addresses. The one or more sender addresses may include a first sender address. The one or more receiver addresses may include a first receiver address. An individual recorded transaction may include an exchange of an amount of currency, including but not limited to a cryptocurrency. In some implementations, the amount of cryptocurrency may include one or both of Bitcoin and/or Ether. By way of non-limiting example, the second individual recorded transaction may include a second sender address and a second receiver address, the third individual recorded transaction may include a third sender address and a third receiver address, and so forth. In some implementations, information obtaining component108may be configured to monitor and/or track transactions published on different public distributed ledgers.

By way of non-limiting example,FIGS. 3A-3Billustrate exemplary transaction graphs as may be used by system100. For example,FIG. 3Adepicts a transaction graph30that may be derived from and/or based on information obtained regarding a set of financial transactions that are recorded on one or more distributed ledgers. As depicted inFIG. 3A, the set of transactions may include a first transaction30dbetween a sender address30band a receiver address30a, and a second transaction30ebetween a sender address30cand receiver address30a. First transaction30dinvolves a sender associated with sender address30bpaying a receiver associated with receiver address30asome amount of currency, e.g., a first amount of cryptocurrency. Second transaction30einvolves a sender associated with sender address30cpaying the receiver associated with receiver address30asome amount of currency, e.g., a second amount of cryptocurrency. As depicted, transaction graph30may include nodes for sender/receivers (or sending addresses and receiving addresses), and edges between nodes to represent individual transactions. In some implementations, connections in a transaction graph may be directional, for example to indicate the flow of payment. In some implementations, an individual connection in a transaction graph may represent multiple transactions between two entities. In some implementations, nodes may be associated with additional information, including but not limited to a balance for a particular currency, a cumulative amount of currency received and/or sent, and/or one or more parameters indicating the rate at which currency is received and/or sent. In some implementations, edges may be associated with additional information, including but not limited to the number of transactions between two entities and/or the amount exchanged between particular entities in a particular transaction.

FIG. 3Bdepicts a transaction graph31that may be derived from and/or based on information obtained regarding a set of financial transactions that are recorded on one or more distributed ledgers. As depicted inFIG. 3B, the set of transactions may include transactions between six addresses: address31a, address31b, address,31c, address31d, address31e, address31f, and/or other addresses. Some addresses only have incoming transactions associated, such as address31aor address31f. Some addresses only have outgoing transactions associated, such as address31b. Some addresses have combinations of incoming and outgoing transactions, such as address31d. In some implementations, multiple transactions in either direction may be depicted by a double-headed arrow, as shown between address31cand address31e. Analysis of a graph such as transaction graph31may reveal which addresses (and/or entities associated therewith) are more active than others (e.g., in cumulative amount of currency, in number of different transactions, in number of different direct connections, and/or in number of different connections within a predetermined number of transactions). For example, address31dis connected directly to four other addresses, while address31ais connected directly to only one other address. A direct connection may be referred to as a first-level connection. The next level of connection may be referred to as second-level connection. For example, address31ahas a first-level connection to address31b, a second-level connection to address31d, and a third-level connection to address31f. In some implementations, connection types may be further distinguished based on one or more directions of the pertinent edges. For example, the connections from address31bto address31d, to address31e, and to address31fare all in the same direction.

Referring toFIG. 1, third-party component110may be configured to access, through a network connection, public third-party information for a second set of addresses. Addresses in the second set of addresses may be associated with sending and/or receiving transactions. The second set of addresses may include different addresses than the first set of addresses, and/or vice versa. The first set of addresses may have some addresses in common with the second set of addresses. By way of non-limiting example, the second set of addresses may include one or both of the first sender address and/or the first receiver address that are associated with the first individual recorded transaction. Accessing the public third-party information may include obtaining the public third-party information through a web crawler. The public third-party information may originate from one or more public online sources that are external to the public distributed ledger. Some public online sources may be deemed more reliable than others. For example, comments from FACEBOOK™ may be deemed more or less reliable than comments from an anonymous forum. Some public online sources may be deemed more nefarious than others. For example, forums on darknet or the deep web may be deemed more nefarious than forums on the world wide web. In some implementations, portions of the public third-party information may include textual comments. Processing portions of the public third-party information may include natural language processing of the textual comments. In some implementations, comments may be alphanumerical. In some implementations, comments may include icons, emojis, and/or other visual depictions.

Correlation component112may be configured to correlate portions of the public third-party information with one or more addresses, e.g., a particular address in the first set of addresses, and/or a particular address in the second set of addresses. In some implementations, correlation component112may be configured to correlate a first portion of the third-party information that pertains to one or both of the first sender address and/or the first receiver address with one or both of the first sender address and/or the first receiver address. The first portion of the public third-party information may originate from a first public online source that is external to the public distributed ledger. In some implementations, correlation component112may be configured to correlate a second portion of the third-party information that pertains to one or both of the second sender address and/or the second receiver address with one or both of the second sender address and/or the second receiver address. The second portion of the public third-party information may originate from a second public online source that is external to the public distributed ledger. In some implementations, a particular portion of the third-party information may pertain to both the first sender address and the second sender address. In some implementations, a particular portion of the third-party information may pertain to both the first sender address and the second receiver address. In some implementations, a particular portion of the third-party information may pertain to both the first receiver address and the second sender address. In some implementations, a particular portion of the third-party information may pertain to both the first receiver address and the second receiver address.

In some implementations, correlations may be between multiple addresses. For example, a first portion of the public third-party information may refer to a first address, and a second portion of the public third-party information (that is somehow related to the first portion, e.g., by virtue of originating from the same online user) may refer to a second address. In such a case, the first address and the second address may be correlated. In some implementations, correlation may be depicted, stored, and/or otherwise processed in a manner similar to a transaction graph. For example, a connection or edge may connect the first address and the second address, even if no single transaction includes the first address and the second address as the sender address and the receiver address.

Labeling component114may be configured to label one or more of the financial transactions and/or the addresses in the first set of addresses with labels representing characteristics of the one or more financial transactions and/or the addresses, such that individual ones of the addresses in the first set of addresses either have been labeled or are unlabeled. One or both of the first sender address and/or the first receiver address may be labeled with a first label. Labeling with the first label may be further based on the correlated public third-party information pertaining to one or both of the first sender address and/or the first receiver address. The first portion of the public third-party information pertaining to one or both of the first sender address and/or the first receiver address may include textual comments. Labeling with the first label may include natural language processing of the textual comments.

The first label may represent a first characteristic of the first individual recorded transaction. By way of non-limiting example, labeling with the first label may be based on one or more of an entity, an activity, a platform, a correlation, and/or a product related to the first individual recorded transaction. One or both of the second sender address and/or the second receiver address may be unlabeled so far.

By way of non-limiting example,FIGS. 4A-4B-4Cillustrate exemplary sets of addresses and/or transactions as may be used by system100. For example,FIG. 4Adepicts a set of addresses40that may be derived from and/or based on information obtained regarding a set of financial transactions that are recorded on one or more distributed ledgers. As depicted inFIG. 4A, the set of addresses40may include a first address40a, a second address40b, a third address40c, a fourth address40d, and a fifth address40e. The set of addresses40may be entirely unlabeled as depicted inFIG. 4A. Transactions between addresses in set of addresses40are not shown.

For example,FIG. 4Bdepicts a set of addresses41that may be derived from and/or based on information obtained regarding a set of financial transactions that are recorded on one or more distributed ledgers, e.g., based on set of addresses40ofFIG. 4A. InFIG. 4B, address40a, address40b, and address40cmay be labeled with a label40g. In some implementations, label40gmay be based on information pertaining to the transactions of address40a, address40b, and address40c. In some implementations, label40gmay be based on one or more of an entity, an activity, a platform, a correlation, and/or a product related to one or more transactions among address40a, address40b, and address40c. By way of non-limiting example, labels may include one or more of “malware”, “ransom”, “phishing”, “darknet”, “Coinbase”, “Walmart”, “Satoshi Dice”, “gambling”, and/or other labels. In some implementations, label40gmay be based on correlations made by correlation component112, in particular based on one or more portions of the public third-party information. In some implementations, combinations of information recorded on one or more distributed ledgers may be combined with one or more portions of the public third-party information, such that the combination forms the basis for labeling addresses and/or transactions with one or more labels. In some implementations, a single address may be labeled with multiple labels. In some implementations, a single transaction may be labeled with multiple labels. InFIG. 4B, address40eand address40bfor a set40hof unlabeled addresses.

Clustering component116may be configured to cluster one or more of the financial transactions and/or the addresses into a set of clusters that includes a first cluster. Clustering may be based on associations of different addresses. One or more addresses labeled with the first label may be clustered into the first cluster with one or both of the second sender address that is unlabeled, and/or the second receiver address that is unlabeled. Clustering into the first cluster may be based on an association between one or more addresses labeled with the first label and one or both of the second sender address and/or the second receiver address. The association may be based on one or more of a financial transaction from the set of financial transactions and/or based on the public third-party information.

In some implementations, a result of clustering a previously unlabeled address may be to label that address, e.g., with one or more of the same labels as other addresses within the same cluster.

By way of non-limiting example,FIG. 4Cdepicts a set of addresses42that may be derived from and/or based on information obtained regarding a set of financial transactions that are recorded on one or more distributed ledgers, e.g., based on set of addresses41ofFIG. 4B. InFIG. 4C, address40a, address40b, and address40cmay be labeled with label40g. The addresses associated with label40gmay be clustered with an unlabeled address such as address40e, into a cluster40h. In some implementations, the clustering of cluster40hmay be based on one or more associations between a labeled address and an unlabeled address. In some implementations, the clustering of cluster40hmay be based on information pertaining to the transactions of the associated addresses. In some implementations, the clustering of cluster40hmay be based on one or more of an entity, an activity, a platform, a correlation, and/or a product related to one or more transactions among the associated addresses. In some implementations, the clustering of cluster40hmay be based on correlations made by correlation component112, in particular based on one or more portions of the public third-party information. In some implementations, combinations of information recorded on one or more distributed ledgers may be combined with one or more portions of the public third-party information, such that the combination forms the basis for clustering addresses in particular clusters. In some implementations, a single address may be labeled with multiple clusters. In some implementations, a single transaction may be labeled with multiple clusters.

Risk assignment component118may be configured to assign levels of risk for suspicious and/or criminal activity to addresses, including but not limited to a set of addresses. In some implementations, risk assignment component118may be configured to assign levels of risk to a one or more addresses that have been labeled with a particular label, and/or clustered within a particular cluster. For example, in some implementations, a particular level of risk may be assigned based on the particular label or labels associated with an address. For example, in some implementations, a particular level of risk may be assign based on a particular cluster associated with an address. In some implementations, a particular level of risk may be assigned based of a graph analysis of a transaction graph for a set of addresses and/or transactions. For example, referring toFIG. 3B, assuming that address31dhas been labeled with a particular label representing highly suspicious and/or criminal activity (e.g., “ransomware”), then addresses directly connected to address31d, such as address31f, may be assigned with a higher level of risk by virtue of the connectivity of the transactions within a set of transactions. In some implementations, levels of risk may be represented numerically, e.g., with a risk score ranging from 1 to 100. Different labels may be associated with different risk scores. For example, “darknet” may be assigned a risk score of 50, whereas “ransomware” may be assigned a risk score of 95. Through graph analysis, a risk level or score may be determined and/or assigned to a specific address that has, e.g., a first-level connection to an address labeled “darknet” and a second-level connection to an address labeled “ransomware,” having a value between 50 and 95. Depending on the implementation, the specific address may be assigned a risk score of 78 (or, in other words, closer to 95 than to 50).

In some implementations, risk assignment component118may be configured to assign levels of risk to the one or more public online sources such that a risk level is assigned to an individual public online source.

In some implementations, risk assignment component118may be configured to assign levels of risk for suspicious and/or criminal activity to the financial transactions from the set of financial transactions. A first level of risk may be assigned to a first individual recorded transaction (having a first sender address and a first receiver address) and a second level of risk may be assigned to a second individual recorded transaction (having a second sender address and a second receiver address). Assignment of the first level of risk may be based on at least a first label (of the first sender address and/or the first receiver address). Assignment of the second level of risk may be based on at least the assigned levels of risk of the second sender address and the second receiver address (e.g., after clustering of the second sender address and the second receiver address). One or both of the assignment of the first level of risk and/or the assignment of the second level of risk may be further based on the risk level of the first public online source from which information originated that was used to determine pertinent labels and/or clusters. In some implementations, a transaction associated with multiple levels of risk (e.g., due to the particular public online source, the assigned label, the assigned cluster, etc.) may be assigned a single level of risk (e.g., a risk score) by apply weights to the individual associated levels of risk.

Reporting component120may be configured to report recorded transactions for suspicious and/or criminal activity. In some implementations, reporting component120may be configured to, responsive to comparisons of one or more levels of risk with one or more risk threshold levels, report recorded transactions for suspicious and/or criminal activity. In some implementations, reporting component120may be configured to, responsive to comparisons of the first level of risk and the second level of risk with a risk threshold level, report one or both of the first and/or second individual recorded transactions for suspicious and/or criminal activity.

Cluster validation component122may be configured to validate labels and/or clusters. For example, cluster validation component122may be configured to validate a particular cluster, e.g., the first cluster. In some implementations, validation may include transferring a particular amount of cryptocurrency to one or more addresses labeled with a particular label and/or clustered within a particular cluster. Subsequently, validation may include monitoring one or more balances associated with the particular label or the particular cluster, to determine whether the particular amount of cryptocurrency was added to a pertinent address and/or balance.

External resources126may include sources of information outside of system100, external entities participating with system100, and/or other resources. In some implementations, some or all of the functionality attributed herein to external resources126may be provided by resources included in system100.

Processor(s)130may be configured to provide information processing capabilities in server(s)102. As such, processor(s)130may include one or more of a digital processor, an analog processor, a digital circuit designed to process information, an analog circuit designed to process information, a state machine, and/or other mechanisms for electronically processing information. Although processor(s)130is shown inFIG. 1as a single entity, this is for illustrative purposes only. In some implementations, processor(s)130may include a plurality of processing units. These processing units may be physically located within the same device, or processor(s)130may represent processing functionality of a plurality of devices operating in coordination. Processor(s)130may be configured to execute components108,110,112,114,116,118,120, and/or122, and/or other components. Processor(s)130may be configured to execute components108,110,112,114,116,118,120, and/or122, and/or other components by software; hardware; firmware; some combination of software, hardware, and/or firmware; and/or other mechanisms for configuring processing capabilities on processor(s)130. As used herein, the term “component” may refer to any component or set of components that perform the functionality attributed to the component. This may include one or more physical processors during execution of processor readable instructions, the processor readable instructions, circuitry, hardware, storage media, or any other components.

It should be appreciated that although components108,110,112,114,116,118,120, and/or122are illustrated inFIG. 1as being implemented within a single processing unit, in implementations in which processor(s)130includes multiple processing units, one or more of components108,110,112,114,116,118,120, and/or122may be implemented remotely from the other components. The description of the functionality provided by the different components108,110,112,114,116,118,120, and/or122described below is for illustrative purposes, and is not intended to be limiting, as any of components108,110,112,114,116,118,120, and/or122may provide more or less functionality than is described. For example, one or more of components108,110,112,114,116,118,120, and/or122may be eliminated, and some or all of its functionality may be provided by other ones of components108,110,112,114,116,118,120, and/or122. As another example, processor(s)130may be configured to execute one or more additional components that may perform some or all of the functionality attributed below to one of components108,110,112,114,116,118,120, and/or122.

FIG. 2illustrates a method200configured for monitoring and analyzing financial transactions on public distributed ledgers for suspicious and/or criminal activity, in accordance with one or more implementations. The operations of method200presented below are intended to be illustrative. In some implementations, method200may be accomplished with one or more additional operations not described, and/or without one or more of the operations discussed. Additionally, the order in which the operations of method200are illustrated inFIG. 2and described below is not intended to be limiting.

An operation202may include obtaining information regarding a set of financial transactions that are recorded on a public distributed ledger. The set of financial transactions may include a first set of addresses. A first individual recorded transaction may include a first sender address and a first receiver address. A second individual recorded transaction may include a second sender address and a second receiver address. Operation202may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to information obtaining component108, in accordance with one or more implementations.

An operation204may include accessing, through a network connection, public third-party information for a second set of addresses that includes one or both of the first sender address and/or the first receiver address. The public third-party information may originate from one or more public online sources that are external to the public distributed ledger. Operation204may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to third-party component110, in accordance with one or more implementations.

An operation206may include correlating a first portion of the public third-party information that pertains to one or both of the first sender address and/or the first receiver address with one or both of the first sender address and/or the first receiver address. The first portion of the public third-party information may originate from a first public online source that is external to the public distributed ledger. Operation206may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to correlation component112, in accordance with one or more implementations.

An operation208may include labeling one or more of the financial transactions and/or the addresses in the first set of addresses with labels representing characteristics of the one or more financial transactions and/or the addresses, such that individual ones of the addresses in the first set of addresses either have been labeled or are unlabeled. One or both of the first sender address and/or the first receiver address may be labeled with a first label. The first label may represent a first characteristic of the first individual recorded transaction. Labeling with the first label may be based on one or more of an entity, an activity, a platform, a correlation, and/or a product related to the first individual recorded transaction. One or both of the second sender address and/or the second receiver address may be unlabeled so far. Operation208may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to labeling component114, in accordance with one or more implementations.

An operation210may include clustering one or more of the financial transactions and/or the addresses into a set of clusters that includes a first cluster. Clustering may be based on associations of different addresses. One or more addresses labeled with the first label may be clustered into the first cluster with one or both of the second sender address that is unlabeled, and/or the second receiver address that is unlabeled. Clustering into the first cluster may be based on an association between one or more addresses labeled with the first label and one or both of the second sender address and/or the second receiver address. The association may be based on one or more of a financial transaction from the set of financial transactions and/or based on the public third-party information. Operation210may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to clustering component116, in accordance with one or more implementations.

An operation212may include assigning levels of risk for suspicious and/or criminal activity to the first set of addresses that have been labeled with the first label, and to the second sender address and the second receiver address. Operation212may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to risk assignment component118, in accordance with one or more implementations.

An operation214may include assigning levels of risk for suspicious and/or criminal activity to the financial transactions from the set of financial transactions. A first level of risk may be assigned to the first individual recorded transaction and a second level of risk is assigned to the second individual recorded transaction. Assignment of the first level of risk may be based on at least the first label. Assignment of the second level of risk may be based on at least the assigned levels of risk of the second sender address and the second receiver address. Operation214may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to risk assignment component118, in accordance with one or more implementations.

An operation216may include responsive to comparisons of the first level of risk and the second level of risk with a risk threshold level, reporting one or both of the first and/or second individual recorded transactions for suspicious and/or criminal activity. Operation216may be performed by one or more hardware processors configured by machine-readable instructions including a component that is the same as or similar to reporting component120, in accordance with one or more implementations.