# Analyzing the Bitcoin Network: The First Four Years
## 3 Related Work  
Most of the recent research focuses on the de-anonymization of Bitcoin users by introducing clustering heuristics to form a user network. To gain knowledge and get novel insights about the economic relationships between users this is an essential criterion. Furthermore, linking external information, relate to executed transactions, is an important step in analyzing the Bitcoin economy. [PERSON] and [PERSON] [2] developed a clustering heuristic to form a user network by creating meaningful groups of users out of the vast amount of pseudonymous addresses (public keys) involved in transactions. The main idea is that multiple inputs of different public keys into a single transaction probably belong to the same user since the use of the corresponding private keys is highly coordinated. In order to construct the user network, all public keys that belong to the same user need to be clustered into one node or user entity. This user network represents the flow of Bitcoins between users over time. This clustering heuristic holds true if users do not share their private keys, but this is not always the case, for example in the case of web wallets that pool many private keys and would therefore mistakenly be clustered as a single user [9]. The clustering approach was extended by [PERSON] _et al._[10] who use another property in the Bitcoin protocol that is more complex but not that reliable in comparison to multi-input transactions. Since Bitcoins transacted from a single address need to be fully spent, the change is collected back to a newly generated address, the \"shadow\" or \"change\" address. In a transaction with two outputs, where one address has never appeared before in the block chain while the other address is public in the block chain, one can assume that the new address belongs to the user who initiated the transaction [10]. This approach is very reliable under the assumption that users rarely issue transactions to two different users. Pay-outs from mining pools or bets on gaming sites are examples where this is not always the case. Hence, [PERSON] _et al._[8] refined the clustering heuristics to account for these and other circumstances to increase the reliability. Beside the clustering heuristics one want to add further information (e.g., IP addresses, geo-locations, businesses, and trade data from exchanges), which are related to transactions, to the user network. In their research [PERSON] and [PERSON] [2] also proposed several methods to overcome anonymity including the integration from off-network information such as email addresses, shipping addresses, IP addresses, or bank and credit card details. This information is mainly held by businesses that accept Bitcoin as payment and other services like exchanges, laundry services and mixers. The researchers use a number of publicly available sources and integrate their information with the user network. For instance, they scraped the web site Bitcoin Faucet over time and were able to associate IP addresses with the public keys involved in the transaction. Thus, they could plot a map of geo-located IP addresses belonging to users who received Bitcoins over a period of one week and overlay it with the user network. Another approach of getting an IP address related to a transaction, was introduced by [PERSON] [11]. It exploits a leakage at the TCP/IP layer in the Bitcoin system. When a user is connected to every node in the peer-to-peer network, then the first node that publishes a transaction can be safely assumed the initiator of it; thus, the related IP address can be linked to that user [11]. [PERSON] [12] downloaded and analyzed the publicly available IP addresses related to transactions from the site Blockchain.info for a short time horizon. The data was then linked to public known IP addresses from anonymizing services such as Tor and Proxies. The results show that around one percent of transactions could be related to anonymizing services.