BitAnalysis: A Visualization System for Bitcoin Wallet Investigation

Bitcoin is gaining ever increasing popularity. However, professional skills are required if people want to check bitcoin transaction information from the blockchain. As pointed out in a recent study, there is a lack of tools to support effective interactive investigation of bitcoin transactions. Therefore, we present a novel visualization system, BitAnalysis, for interactive bitcoin wallet investigation. The analytical and visualization functions of BitAnalysis are defined and developed by following the advice and requirements of a group of entrepreneurs and regulators of bitcoin-related business. BitAnalysis provides a rich set of functions and intuitive visual interfaces for the users, such as law-enforcement officers and regulators, to effectively visualize and analyze the transactions of a bitcoin wallet (i.e., a cluster of bitcoin addresses) and its related wallets, to track the flow of bitcoins, and to identify wallet correlation using our novel clustering functions. To achieve these functions, we have designed new visualization techniques for presenting bitcoin transactions information and introduced the connection diagram and bitcoin flow map as new ways of analyzing, tracking and monitoring the trading activities of a cluster of closely related wallets. We also present an extensive user study that validated the effectiveness and usability of BitAnalysis.


INTRODUCTION
A T the first, bitcoin was invented by Satoshi Nakamoto in 2008 as a payment method that people would use to make purchases through bitcoin transactions, which has become a reality. For example, people routinely purchase daily necessities with bitcoins as a means to fight inflation in Venezuela. With the tremendous increase in adoption of bitcoin for transactions, there is a corresponding increased demand to monitor and analyze bitcoin transactions, either for investment or for criminal investigation. The goal of the present paper is to meet this demand by developing a complete interactive system for intuitive visualization and effective analysis of bitcoin transactions. Note that a person, also called an entity, can possess multiple bitcoin addresses, like the way a person has multiple bank accounts. To be clear, in this paper, we refer a wallet w to be a collection of addresses clustered by Wallet Explorer [2] as owned by the same entity and a trader of w to be any wallet that have transactions with w.
Although bitcoin wallets and bank accounts are similar, they are different in terms of anonymity. As centralized institutions, banks know the owner identity of every bank account in the world using fiat currency. When a conventional financial transaction occurs, such as a wire transferring or a credit transferring, the Know-Your-Customer (KYC) principle must be strictly enforced so that customer identities are validated. This allows banks to conveniently monitor and investigate bank accounts, reducing the risk of having transactions with untrustworthy people.
In contrast, bitcoin is designed to be pseudonymous. In the world of bitcoin, no centralized institutions exist to check and validate the identities of the owners of bitcoin wallets. Therefore, no one knows the true identity of a bitcoin owner. This anonymity brings about a difficulty for both parties of a bitcoin transaction -We do not know whether we are trading with a dishonest company, a con man or a criminal in money laundry business. So in practice, for exchanging bitcoins with other individuals/institutions or making a purchase using bitcoin, checking the attributes of a bitcoin wallet in question is the only way to minimize the risk of trading with "bad guts".
Indeed, due to the anonymity and decentralization, criminal organizations are naturally interested in using bitcoin for settlement. The last step of a crime is often accomplished by the transaction of money. Hence, governments all over the world find it necessary to monitor and analyse suspicious bitcoin transactions and the associated wallets. Intuitive software tools for wallet investigation are therefore important for regulators.
Despite the anonymity of bitcoin ownership, there are certain trading patterns that can be used to characterize the behaviour of the unknown entity. For example, a newly founded company should have only a limited number of transactions, small businesses normally should not have transactions with a large bitcoin volume, and entities intentionally hiding the origins of their bitcoins are likely involved in illegal activities. Our BitAnalysis system explores these traits for effective analysis in bitcoin transaction investigation.
There have been active studies and software systems for bitcoin-related query and examination [3], [4], [5], [6], [7], [8], [9]. Among the existing works, there are only two online systems that are commonly used for exploration of individual bitcoin addresses/wallets -Wallet Explorer [2] and Blockchain.info [10]. However, both systems are only for primitive data query as they only display transaction records in a list format without an intuitive visualization or summarization, and support no high-level summary, analysis, or interactions. When using such a system to investigate a bitcoin wallet involved in many transactions, it becomes very onerous to trace all the transactions: One has to keep clicking on the next button to view pages after pages of transactions shown in lists of numerical values.
More recently, wallet-based visualizations were studied in [9], [11], [12], [13]. However, these methods cannot demonstrate the complex relationship among trading wallets with intuitive visualizations. As pointed out by a recent review on existing online bitcoin visualization tools [1], there is a stark lack of effective visualization and analysis tools that allow the user to easily and interactively investigate bitcoin transaction data for various potential users.
A bitcoin wallet under investigation can be involved in thousands of transactions in a short period of time. It is therefore a challenging task to develop a visualization and analysis system for bitcoin wallet investigation that is capable of visualizing all the involved transactions, related wallets and activities in a clear, ordered, and efficient manner. To understand the requirements for the functions of such an interactive visualization system for bitcoin wallet analysis, we have conducted interviews with numerous bitcoin experts, entrepreneurs in cryptocurrency, and regulators investigating bitcoin-oriented money laundering. Based on these interviews, we summarize the requirements as follows: (1) visually intuitive browsing of wallet summary; (2) efficient analysis of transactions patterns; (3) tracking of bitcoin flows; and (4) continuous monitoring of suspicious transactions.
We have designed and developed our BitAnalysis system base on these requirements. The main interface of BitAnalysis is shown in Fig. 1. BitAnalysis facilitates bitcoin wallet investigation by providing the following functions: (1) Easy browsing and visualization of a wallet summary from different perspectives, such as the top trading wallets, period of peak trading activities, balance variations, etc; (2) Visualization, analyzing and clustering wallets based on transaction patterns; (3) Tracking how bitcoins flow between wallets; and (4) Monitoring interested wallets in real time and alerting the user to new suspicious transactions.
We have conducted a user study to validate the efficacy of the system BitAnalysis . 15 participants have been recruited. Among whom, five have helped us perform the needs assessment. The user study strongly indicates that our system meets the requirements of the domain experts. The details of the user study will be discussed in Section. 9.1.
Our contributions are summarized as follows: We present a visualization system,BitAnalysis, for bitcoin wallets analysis. This system facilitates efficient wallet preview, new transactions alerting, wallets analysis and bitcoin flow tracking. Interactive functions are also provided to assist the wallet investigation procedure. We present a novel connection diagram to demonstrate the connections between wallets as well as design several clustering methods based on bitcoin characteristics. These methods can be used to identify wallet similarity and infer wallet ownership. We present a novel flow map to clearly trace and visualize bitcoin flows among a cluster of related wallets. We provided an accompanying video in the supplementary materials to help illustrate the visualization functions of BitAnalysis .
We also observe that an important category of researches on bitcoin analysis relies on transaction pattern analysis. Moser et al. [17] provided a systematic inquiry on evaluating bitcoin as a money laundering tool and presented outlines of anti-money laundering strategies based on bitcoin transaction information. Reid and Harrigan [25] analysed the anonymity of bitcoin by investigating bitcoin flow. Ranshous et al. [26] constructed directed hyper-graphs of exchangecentred transactions to understand potential money-laundering behaviour. Most recently, Wu et al. [27] proposed a bitcoin transaction network analytic method for facilitating Blockchain forensic investigation based on an extended safe Petri Net. Our system also provides transaction pattern analysis. But note that the existing works mentioned above mainly focus on the analytical process of network patterns rather than visualization capabilities to facilitate the analysis.
Recently, analysis-oriented visualization becomes an active research direction. Christin et al. [34] investigated Silk Road related data via a comprehensive measurement analysis. Battista et al. [7] and McGinn [8] provided block-level visualizations for anomaly detection. Bistarelli [35] presented to find specific transactions or addresses with customizable filters. Besides, Kondofr et al. [36] and Maesa et al. [37] proposed to analyse the overall bitcoin transaction network by measuring the network characteristics and visualize the results. Meanwhile, a visualization for analysing interexchange behaviour has been proposed as well [6]. More recently, Zhong et al. [9] proposed a SilkViser system to visualize cryptocurrency transaction data from the blockchain perspective. Our BitAnalysis are different from the above works from different aspects. SilkRoadTravel [34] only focused on the specific silk road analysis, but BitAnlaysis is design to support custom wallet analysis. BlockChainVis [35] proposed predefined filters to filter out undesired information for transactions visualization while we emphasize on wallet relationship analysis and find out their relevance. Different from blockbased anomaly detection [7], [8], we rely more on visualizing transaction patterns for analysis. Different from overall blockchain visualizations from the macro perspective [36], [37], we aims at bitcoin investigation from the micro perspective. Compared with the exchanges-oriented visualization [6], our BitAnalysis can be applied to analyse wallets not limited to those belonged to exchanges. Though SilkViser [9] also visualized transaction data, it focused on demonstrating transaction data on a block-basis rather than emphasizing the relationship analysis between wallets as our BitAnalysis . In Addition, comparing to the existing wallet-based visualizations [11], [12], BitAnalysis can facilitate wallet analysis from the temporal dimension as well as the relationship dimension, providing more advanced investigations.

Network Visualization
Network visualization is another related area which has been actively studied. In [38], Heer and Boyd used a nodelink diagram to represent the relation between end-users in online social networks. Wang and Mueller [39] visualized causal networks with path diagrams. Christina et al. [40] adopted a Sankey diagram to visualize dynamic network for data journalists. Besides layout design, researchers also attempted to adopt different technologies to better illustrate a network. Some previous works [41], [42] used edge bundling to simplify a graph. Wang et al. [43] proposed a visual technique to reveal ambiguities. Langevin [44] presented a visual analytical approach to leverage cluster computing by retrieving hierarchical communities from the input data. However, despite of the exist techniques, a network will be hardly readable with increasing complexity. Therefore, we design a connection diagram to adaptively visualize transaction network and a flow map to clearly show the bitcoin flows between wallets.

Community Detection
In network analysis, an important topic is community detection. Duch and Arenas [45] took advantages of extremal optimization. Yang et al. [46] made use of node attributes. Pizzuti [47] proposed a genetic-based approach to detect communities in social networks. More recently, community detection for multi-layer networks has begun to emerge. Wilson et al. [48] presented a multilayer extraction procedure which could identify densely connected vertex-layer sets in multiplex networks. Li et al. [49] designed a random walk based LART (Locally Adaptive Random Transitions) algorithm to discover communities in a multi-layer network. Clustering is also important for our system to measure wallet similarity. However, the existing clustering strategies cannot be applied directly to bitcoin analysis. Therefore, based on the features of bitcoin, we design specific metrics for bitcoin wallet clustering.

Visual Analysis of Financial Data
Although bitcoin is different from fiat currency, research on visual analysis of traditional financial data is also relevant to our work.
Anomaly detection is known as financial fraud detection. Fraud investigators have realized that visualizations are very helpful for anomaly detection and various visualization techniques have been developed to help solve the problem. Kirkland et al.
[50] proposed an ADS system on financial anomaly detection by combining the visualization techniques as well as the AI techniques. Based on a set of predefined keywords, Chang et al. [51] presented a WireVis system to facilitate banks to discover abnormal wire transactions. Huang et al. [52] designed a framework of visual analysis for stock market security, with a 3D tree-map to monitor the real time stock market and a node-link network to discover unusual trading pattern. Leite et al. [53] implemented a visual analytic approach (EVA) to help financial institutions conduct fraud transaction detection.
Correlative analysis can bring new insights for investors, analysts and financial institutions. Marketanalyzer [54] presented an interactive system for market and competitor analysis, providing side-by-side comparisons for sales, trends, and growth rates. Malik et al. [55] proposed a visual analytical approach to explore spatial-temporal correlations. Badam et al. [56] presented a system, Timefork, for prediction of multivariate time series data. Note that most traditional financial visual analysis, using macro financial data for macro analysis, are quite different from our work.

NEEDS ASSESSMENT
In order to develop a visualization system that is useful for practical bitcoin transaction investigation, we conducted interviews with bitcoin experts, entrepreneurs and regulators. Among the interviewees, one was the former CTO of a national Stock Exchange, one is an executive of a world-leading Cryptocurrency Exchange, one is a senior researcher specialized in cryptocurrency and financial technology, and two are police for cyber security crime. According to their feedbacks, we summarize the following needs: T1. Quick wallet overview. The entrepreneurs are interested in the trading activities of the wallet that they will trade with, including active trading periods and top trading wallets, etc. They stated that they would pay more attention if unusual behaviours are detected, such as transactions of unusually large volume, or wallets trading with those wallets known to be unwanted. Therefore, it is important to provide a quick wallet overview. They complained that the wellknown websites for bitcoin wallet query, including Blockchain.info [10] and Wallet Explorer [2], display transactions of a wallet in an unintuitive manner, using a list format. Our interviewees overall wish to use a system that can provide a visual and intuitive summary of transaction information.
T2. Detail examination. The interviewees suggest that an effective system should enable them to check detailed information when necessary. For example, when there are many transactions occurring in one month, the user wants to browse the transaction summary as well as to view the details of some of the transactions if needed.
T3. Transaction pattern analysis. What regulators are concerned most about is whether wallets directly or indirectly trading with a criminal's wallet w are suspects as well. However, regulators are unable to confirm the identity information of wallets as they can do for bank accounts. Therefore, transaction pattern analysis becomes the only way to identify such suspicious wallets. A typical situation is that when a criminal organization is destroyed, the police can only acquire the IDs of a limited number of bitcoin wallets but need to know whether related wallets of a suspicious w is suspect as well. Meanwhile, entrepreneurs also point out that understanding partners is a key rule in business. Examining the transaction pattern of business partners' wallet w is the best way to know about their partners. a). Connection analysis. Transaction patterns of w can be treated as the network of wallets trading with w directly or indirectly. Both regulators and entrepreneurs desire to make use of this network to analyze wallet connections. Also, they hope the system could provide metrics that can automatically detect characteristic transaction patterns to facilitate the investigation process. b). Temporal analysis. The interviewees are also interested in whether two wallets have the similar transaction pattern in the time dimension, that is whether they are active during the same specified period. Both regulators and experts believe that the similarity in trading periods is a key clue to find suspicious wallets related to a suspicious w. The system should support checking temporal trading activities of wallets related to w simultaneously.
T4. Bitcoin flow tracking. Meanwhile, both regulators and entrepreneurs concern about dirty bitcoins, that were ever possessed by criminals: Regulators focus on where the dirty money went to while entrepreneurs do not want to receive dirty bitcoins. Since every bitcoin keeps the log file about who has previously owned it, the interviewees hope to clearly visualize the bitcoin flow among wallets. In Wallet Explorer [2], the flow of bitcoin is kept in a format of linked URLs. In such a way, the user can only see one transaction at a time, which does not provide an overall view of the sequence of transactions for a good understanding of bitcoin flow. Hence, there is a need for a more convenient way to track bitcoin flows among wallets.
T5. User-friendly interactions should be provided to make the investigation procedure easy and efficient.
T6. Real time monitoring. All the interviewees want to be alerted when new transactions happen to an interested wallet so as to keep being updated about its status.

SYSTEM OVERVIEW
Design challenges. During the design and implementation of our system, a main challenge comes from the huge amount of transaction information, resulting in complicated wallet relationship and bitcoin flows. Hence, it is important to have a design that balances between high-level overviews and detailed information of involved wallets and transactions. The design should also support quick overview of a wallet, related transaction patterns, and user-selected bitcoin flows, as well as to support essential detailed examination when needed. Furthermore, we also need to present the transaction pattern clearly and to demonstrate a userselected bitcoin flowing intuitively, even when a large number of wallets and transactions are involved.
System outline. To accomplish the tasks formulated in Section. 3, we have designed and developed a system, BitAnalysis , which is composed of a front-end module for visualization ( Fig. 1) and a back-end module for bitcoin data representation and management. The bitcoin data representation and management module stores wallets and transactions information while the front-end assists with wallet investigation by visualizing the information of a user-selected wallet or bitcoin flow. Please refer to the supplemental material for a video demonstration of our system.
BitAnalysis system is implemented on a DELL window machine with Intel Core i7-11700, 64 GB DDR4 2933 MHz and GTX1080Ti GPU. Under most situations, the user spends about 5-30 minutes in investigating an interested wallet.

Bitcoin Data Representation and Management
We collect data from Wallet Explorer [2] to build up the SQL Server storage module. The data storage consists of a wallet database and a transaction database. The transaction database records information of each transaction. Meanwhile, to assist bitcoin flow tracking, it keeps the next transactions of each transaction where the bitcoins went to. The transaction database records each transactions' original transaction ID, timestamps (when it happened), input wallet ID, output wallet IDs, bitcoin amount, and next transaction IDs. The wallet database maintains the statement of each wallet, which records transaction IDs it was involved and the corresponding balances afterwards.

Design Principles
We follow the following principles when designing our system: P1. Overview first and details on demand. A wallet can involve many transactions and traders. Meanwhile, the transaction pattern and bitcoin flows can be very complicated. To adapt to this complexity, our system provides an overview first and supports detail examination when necessary.
P2. Different views are responsible for different tasks but they cooperate when necessary. To make the functionalities clear to the user, we use different views for different tasks. Besides, cross-view interactions are integrated to facilitate investigation that cannot be done within a single view.
P3. Make parameters user-adjustable. The difference between wallets can be huge. For example, the maximum amount of bitcoins of a transaction may be 10 in one wallet and 10000 in another. So we allow the user to adjust some key parameters for the best visualization effects, depending on the complexity of the data involved. Meanwhile, the parameters are all set with reasonable initial default values, allowing wallet investigation without parameter fine-tuning in common cases.
P4. Intuitive visual designs. The target users of this system may have little experience with visualization systems. Therefore, we strive to make the system functions easy to use and the visualization interface intuitive to help the user better understand the data displayed.

Visualization Interface
Interface overview. The main interface ( Fig. 1)  Workflow of bitcoin investigation. One starts investigating a wallet w by entering its ID in the summary view, with a specified time period (t s ; t e ), and a transaction amount range (v min , v max ). Then, BitAnalysis will enquire the database to retrieve related transaction and wallet data, to generate the summary, connection and temporal views. The user can then investigate the wallet w and choose to monitor a wallet related to w if needed. Also, when the user selects to track an interested flow, relevant data will be retrieved from the transaction database to generate the flow view.

FUNDAMENTAL VIEWS
In this section we will introduce the fundamental views, laying the foundation for introducing the advanced views in the following sections.

Summary View
A wallet w can have plenty of transactions, making it inconvenient for the user to go through one by one. Hence, it is important that the user can browse the transaction summary first and focus on details of transactions and traders occurring during more interested periods when necessary. Besides, the user may want to check the transaction summary from the perspective of traders. For example, wallets trading with a given wallet w with a large amount of bitcoins are more important than those with a small amount of bitcoins. Such summarized information is hard to collect in lists provided by Wallet Explorer [2] and BlockChain. info [10]. Therefore, a summary view (Fig. 1 A) (4) balances. The summary view is designed to aggregate and visualize these four kinds of information clearly in a compact manner.
Visual Design. Specifically, we aggregate transactions in a user-specified time period, such as day, month and year. Then the aggregated transactions in each period are shown in the temporal order, which are displayed by a combination of a vertical incoming transactions bar (r in Fig. 1), a vertical outgoing transaction bar (s in Fig. 1), a horizontal balance bar (b in Fig. 1), and a number of wallet blocks (x in Fig. 1). The incoming (outgoing, resp.) transaction bar represents the aggregated incoming (outgoing, resp.) transactions in the time period. The height and colour of the bar encode the total amount of bitcoins received (or sent). The balance bar shows the balance changing during the corresponding time period, with colour encoding wallet balance. Simultaneously, wallet blocks encode those traders (wallets) that trade with w an amount of bitcoin greater than a user-specified threshold v b during the specified period.
Bar Height Normalization. The height of an incoming/outgoing transaction bar encodes the total incoming/outgoing bitcoin amount within the corresponding time period. Since trading bitcoin amounts can vary dramatically, we choose to use a logarithmic function instead of linear functions to compute height of transaction bars. Specifically, given a trading bitcoin amount v, the height hðvÞ of the corresponding transaction bar is computed as where h max is the user-defined max height of a transaction bar and v max is the maximum received/sent bitcoins. Bar Colour Encoding. We use three colour schemes, which are colour-blindness-safe, print friendly and photocopy safe, to encode balance, received bitcoins and sent bitcoins, respectively. The colour legends are displayed within the summary view ( Fig. 1 A) and the user can adjust the minimum and maximum values. Note that, for consistency, the colour encoding of received and sent bitcoins in the other views is the same as that in the summary view.
Alternative Designs. Let us use two specific scenarios in bitcoin analysis to illustrate the advantages of our design of the summary view over the line chart and the bar chart. Suppose that the user is interested in studying the variation of the bitcoins received by a particular wallet over a period of time. (1) Comparison with the bar chart : It is inconvenient to use the bar chart (Fig. 2a) to examine the variation of the received bitcoins, which are presented by the red bars, because they are separated from each other by other kind of bars (green and purple). However, with our design, it is easier to examine the variation because the red bars are placed next to each other (Fig. 2c). Similarly, it is easier to use our design to visualize the other two features, i.e., sent bitcoins and balances, than using the bar chart. (2) Comparison with the line chart : Our design shows not only the variation of the received bitcoins but also the contributing wallets, i.e. the wallet boxes in each red bar in Fig. 2c. In contrast, the line chart (Fig. 2a) cannot represent these contributing wallets. Hence, our design provides a summary view that is more complete, compact and intuitive than the line chart and the bar chart.

Detail View
One often needs to check the details of a particular transaction or wallet. For that purpose, we provide a table representation and a visual representation in the detail view ( Fig. 1 B), which are both desired by the people interviewed in our user needs study. ( T2 , T5 ) Tablet Representation. When one selects an element in any other view, information of related transactions and wallets will be displayed in this view with a table format.
Visual Representation. For visual representation of the detailed information, we adopt a visual design similar to that used in the summary view. All the involved transactions are displayed in the temporal order.
Cross-View Interactions. The detail view and the other views are coordinated to enable the user to examine transaction detail. When the user clicks on an element, i.e., a transaction or a wallet, in any other view, the detailed information of the element will be shown in the detailed view. Please refer to the accompanying video for a more clear demonstration.

Temporal View
The trading activities of those wallets related to a given wallet w reflect the characteristics of w. Hence, we design a temporal view (Fig. 1 C) to help understand the temporal aspects of the trading activities of the wallets trading with w. The following two modes are provided to fulfill the requirement T1 and T3.b -the direct transaction mode and the indirect transaction mode .

Direct Transaction Mode
When browsing the transaction summary of an interested wallet w in the summary view, the user may also care about its trading activities from the perspective of each trader, to find out information such as which traders that they traded most bitcoins with or traded most frequently during the searched period (Fig. 3). In this case, the user can choose the direct mode to explore the transactions between w and every trader e. ( T1 ) Visual Design. The traders of the wallet w are displayed in a user-defined order, by received bitcoins, sent bitcoins or both. The wallet w's total received bitcoins from trader e and sent bitcoins to trader e are represented by received pie slices and sent pie slices, respectively, whose area and colour encode total received/sent bitcoins. The colour encoding for received/sent bitcoins is the same as that in the summary view. Note that a bar chart is another option. Compared to pie charts, bar charts take more space. Therefore, we choose the pie chart to save space.
Besides total traded bitcoins between w and e, the user may also be interested in trader e's temporal trading activities with w. Thus, for every e, we also visualize its temporal trading behaviour with w in a line chart, with sent and received trading behaviour drawn downwards and upwards, respectively.

Indirect Transaction Mode
The temporal view (Fig. 1 C) of BitAnalysis also provides an indirect transaction mode to simultaneously investigate the trading activity of wallets v indirectly related to w, for finding out whether wallets v have similar trading frequency or are active during the same period as w, to name a few. We will have a detailed discussion in Section. 6.1 about wallets that trade indirectly with a given wallet w.
Design Rationale. When the user chooses this mode, they focus on the temporal similarity among v rather than on specific transaction details. Therefore, the visual design should enable fast and convenient comparisons. Different from in the direct mode, in the indirect mode, we design the visual encoding of each wallet to be placed with that of other wallets in a more compact manner, enabling trading activity comparison among a large number of indirect related wallets.
Visual Design. Specifically, we use a horizontal colour bar, temporalTx, to aggregate temporal transaction data of wallet v, as demonstrated in Fig. 4. In the temporalTx bar of v, the transactions of v are grouped by a user-defined time period, year, month or day. The total incoming (X r t ) and outgoing (X s t ) transactions occurring during the period t are represented as a txBlock b r and b s , whose height encodes the total received (v r ) and sent (v s ) bitcoins, respectively. Meanwhile, we learn from the experts that inactive periods are as important as active periods, both of which together reflect the temporal activity of a wallet v. Therefore, we use a gray block to encode the period t when no transactions occur.

Connection Network
In the world of bitcoin, the relation of wallets is defined by the transactions between them. It is therefore important to use the network connecting the wallets trading with a given wallet w to understand the trading behavior of w. In the following we will first introduce some basic concepts and notations, and then present our method for analysing and visualizing this network of transactions.
Connected Wallets and Connection Network. Given a time period T , we define the universal connection graph GðT Þ ¼ fV; Eg, where the vertex set is composed of all the wallets and the edge set is composed of all the transactions between the wallets in V . Given a wallet w, an i-connected wallet of w, denoted as v i w , is a wallet whose shortest path to w in GðT Þ goes through i edges (transactions), or equivalently, has i À 1 intermediate vertices (wallets). For an integer D > 0, we define the D-distance connection network of wallet w to be the network of all the wallets trading with w through D transactions or less. Specifically, this network, denoted as N D w ¼ ðV; 0 E 0 Þ, is the subgraph of the universal connection graph GðT Þ ¼ fV; Eg such that V 0 & V consists of all the i-connected wallets of w, 0 i D, and E 0 & E consists of all the transactions between the wallets in V 0 . Note that wallet w itself is v 0 w and that the traders of w are wallets v 1 w . Shortest Path. Note that, although the D-distance connection network N D w is a directed graph upon wallets and transactions, in the definition of an i-connected wallet of w, the shortest path between two wallets in N D w is computed without considering the edge directions. As an illustration, see Fig. 5, the shortest path length between the wallet w and each of the four wallets A 2 , B 2 , C 2 and D 2 is 2. The edge direction is ignored here because, according to bitcoin investigation experts, the connections between wallets are complicated and that it is important to discover their similarities and relations even if they do not trade directly with other.

Connection Diagram
In the connection view ( Fig. 1 D), we display the D-distance connection network in the form of a connection diagram , which is a novel visual presentation for clearly showing the relationship between a wallet w and its trading wallets, directly or indirectly. ( T3 , T5 ) The value of D is specified by the user. All the involved wallets v i w (i 2 ½0; D) are listed on the left of the connection view ( Fig. 1 D). Each wallet is displayed with its ID, its distance to w, and its belonged cluster, together with its last balance during the searching period. The user can choose to order the wallets by distance, cluster, or balance.
Wallet Glyph. The main element of a connection diagram is the wallet glyph , which encodes the main features of the trading activities of each wallet v i w in the connection network N D w of wallet w. These features include the balance b, the total sent bitcoins v s , the total received bitcoins v r , the number of input wallets n r that v i w received bitcoins from, and the number of output wallets n s that v i w sent bitcoins to. Fig. 6 shows the visual design of a wallet glyph. Here, the balance b is encoded by circle in the center, whose radius is proportional to the corresponding balance value. Two annular sectors are used to encode the total received bitcoins v r and sent bitcoins v s , respectively. The central angle and thickness of the annular sections are proportional to the received (v r ) (sent v s , resp.) bitcoins, and the number of input (n r ) (output n s , resp.) wallets, respectively. When a wallet glyph is selected in the connection diagram, the glyph itself and its incident connection edges will be highlighted. Besides, the same wallet will be highlighted in other views as well.
Colour Encoding. The center balance circle is coloured according to the wallet's trading distance to w. The colouring scheme for distances is colour-blindness-safe and different from those used in the summary view, which is shown on the top of the connection view (Fig. 1 D). Meanwhile, to be consistent, the colour encoding of the sent and received annular sectors is the same as that of sent and received bitcoins in the summary view, respectively.
Design logic. The glyph is designed to support feature comparisons across different wallets as well as within the same wallet, which are both important for users. Users can focus on different parts of the glyph for different purposes. For example, if users want to compare inputs and outputs of the same wallet, they can focus on the annular angles. While if users want to compare different wallets on features such as input or output, they can focus on the corresponding colors for comparison.
Full mode v.s. simple mode. By default, the full mode is enabled to show full wallet glyphs (Fig. 7a). We also provide a simple mode (Fig. 7b) to show the center balance circle only when the user wants to hide glyph details to focus on the connection network as a whole.
Wallet Placement. In the connection diagram, the wallets, displayed as wallet glyphs, are placed in the view panel using the graph-layout method by Kamada [57], which places closely wallets trading with each other. While the edges encode the connections (transactions) between wallets, showing all edges would make the visualization of a connection network cluttered and incomprehensible in practice since there are often a large number of active wallets in the connection network. Hence, we choose to display only the edges incident to a particular wallet chosen for investigation while hiding all the connections. This selective approach to display the edges of the connection diagram is a trade-off between diagram clarity and expressing wallet connections. Note that, although many edges are not displayed, it is still easy to visualize the trading distances between the wallets because the distances from the wallets to the central wallet w in the view panel are generally correlated to their trading distances. Further, the wallet glyphs are coloured in a way to indicate their distances to the wallet w. See Fig. 7.
When needed, the user can zoom in on the diagram with mouse scrolling, translate the diagram with the arrow keys, and rotate the diagram with the 'R' key. Meanwhile, the user can also reposition a wallet glyph with mouse dragging. ( T5 )

Similarity-Based Transaction Patterns of Wallet
When analysing a connection network N D w , regulators and entrepreneurs are often interested in how the i-connected wallets v i w of w are related to each other and whether they display similar characteristics, because such similarities can be used to characterize the behavior pattern of the wallet w. Hence, we propose to cluster similar wallets using the following four clustering metrics: temporal similarity , trader similarity , balance similarity , and similarity of large-amount transactions . Note that parameters in this section can be adjusted and the visual effects of each metric will be demonstrated later in the evaluation section. The user can choose to colour the center circle of wallet glyph based on belonging clusters. If a wallet is not clustered with any other wallets, it will be coloured gray, indicating that it is not successfully clustered. ( T3 ) Temporal Similarity. By this metric, two wallets are regarded to be highly related if they are active during the  same time period. For each wallet w j in N D w , we first retrieve its total trading amount, i.e., the sum of sent and received bitcoins, in every time period, and order them chronically to form a time series S j . Then we apply the fast dynamic time wrapping algorithm (DTW) [58] to compute temporal similarity between w p and w q . Wallets with the temporal similarity less than a user specified threshold s s with be grouped in the same cluster C time . That is, every two wallets w p and w q in C time satisfy DTW ðS p ; S q Þ < s s : Briefly Speaking, DTW computes temporal similarity between w p and w q with the summed euclidean distance between the optimal shape-matched corresponding data points on S p and on S q .
Trader Similarity. The trader similarity metric measures the degree in which two wallets contain similar traders. The user can choose the set of top n traders of each wallet w j , denoted as R n w j , and then group together wallets such that the number of their common traders is greater than a user specified integer m > 0. Denote a trader cluster as C trader , kR n w p \ R n w q k > m; w p ; w q 2 C trader : In this way, wallets having a certain number of common traders are clustered together. Balance similarity. The balance similarity metric measures the similarity of the latest balances of two wallets. Using this metric, we group wallets w j with their balance difference less than a threshold s b into the same cluster C balance . Let B w j denote the balance of wallet w j . Then for two wallets w p and w q in the same cluster, we have jB w p À B w q j < s b ; w p ; w q 2 C balance : Similarity of large amount transactions. When a largeamount transaction occurs, the investigating agents should be alerted for further investigation. Based on this need, we introduce the large-amount transaction (greater than s v ) metric to cluster the wallets involved in large amount transactions. Denote a large transaction cluster as C large , If w in i and w out i are the input and output of a large amount transaction X s v i , then w in i ; w out i 2 C large . Moreover, If w in j and w out j are the input and output of another large amount transaction X sv j with w out i ¼ w in j , then w out j 2 C large as well.

Continuous Wallet Monitoring
When a wallet attracts attention for any reason, besides examining its previous trading activities, the investigator also wishes to keep monitoring the wallet and be informed when any new transaction occurs to the wallet. Hence, we provide a monitoring module at the bottom-left of the connection view (Fig. 1 D) to meet this requirement. When selecting a wallet from the wallet list, the user can set the monitoring state to "On". In this case, our system will continuously monitor the selected wallet and record all the new transactions occurring to it. For every monitored wallet, BitAnalysis checks its transaction information in Wallet Explorer [2] every 30 minutes. Whenever new transactions are detected, the user will receive a notification via email or communication applications. ( T7 )

FLOW VIEW
The bitcoin flow is a process that some amount of bitcoins is transferred from a wallet to a group of wallets through a chain of transactions. Besides the trading activities of individual wallets, bitcoin investigators often also need to track whether the wallets are involved in a bitcoin flow and where the bitcoins end up. Hence, in this section we will present some new techniques in BitAnalysis for visualizing the bitcoin flow process. Fig. 8 uses a simple example to illustrate how a bitcoin flow process is visualized. ( T3 , T4 , T5 )

Bitcoin Flow Map
We have designed a new structure for visual presentation of the bitcoin flow originated from a given wallet w. In general, bitcoins flow from w to multiple wallets (i.e., the traders of w). Then the bitcoins continue flow from these traders to other wallets via new transactions. Hence, in general the flow of bitcoin has a tree structure. However, it often happens that a wallet may be involved multiple times in the flow. In this case they will appear multiple times in the tree structure of the flow map. Visual Design. The visual presentation of an illustrative flow map is illustrated in Fig. 8c, based on the hypothetical bitcoin flow data tabulated in Fig. 8a.
Wallet Representation. Here, each wallet involved in the flow is represented by a rectangular box of a fixed width, whereas its height indicates the amount of bitcoins received from its preceding wallet, with the exception for the root wallet from which the flow starts; the height for the root wallet is the amount of bitcoins flowing out of it. Specifically, in this example, the box of the root wallet w 1 is placed left most of the flow map. Then the wallets receiving bitcoins from w 1 , which are w 2 and w 3 , are stacked and placed next to w 1 . In general, the output wallets of a transaction are placed next to the input wallet to define a branching structure of the flow map tree. The colour of each box indicates the trading distance of the corresponding wallet to the root wallet w 1 . Note that multiple transactions may share the same output wallets. For example, in Fig. 8a, w 7 is the output wallet of transactions X 3 and X 4 . Then, w 7 will appear twice in the flow map, leading to two identical sub-trees. A flow map based actual bitcoin transaction data is shown in Fig. 9b.
Transaction Representations. In addition, there is a curved path tracing from each wallet back to the root wallet in the flow map, encoding the involved transactions. The graduate colour change of the path represents the times when the transactions along the path take place. However, when the height of wallet boxes decreases, the curved paths may occlude the corresponding wallet boxes as shown in Fig. 9b. Therefore, we provide another non-time-highlight mode (Fig. 9c) when time is not the user's main focus.
Note that bitcoins will not disappear by the UTXO model. In our flow map, a blank space does not mean the disappearing of bitcoins; It means that certain bitcoins remain unspent in certain wallets after certain transactions. For the example in Fig. 8c, before transactions X 1 , 6 bitcoins are all in wallet w 1 . But after transactions X 1 -X 7 , bitcoins flow to other wallets and finally remain in w 2 ; w 5 ; w 6 , and w 8 . For example, totally 2 bitcoins remain in w 2 , with 1 bitcoin unspent in the first branch of w 2 , and 0.5 bitcoin unspent in both the second and third branches of w 2 (marked by the yellow arrow for illustration). In total, after transaction X 1 -X 7 , 2 bitcoins remain in w 2 and w 8 , respectively while 1 bitcoin remains in w 5 and w 6 , respectively. And all other wallets have a zero balance.
Comparison With Connection Diagram. Compared with the connection diagram (Fig. 9b), the flow map (Fig. 8c) more clearly shows the process how wallets are involved along the flow direction. As shown in the flow map (Fig. 8c), the bitcoins involved in transaction X 1 are finally distributed into and maintained by w 2 , w 5 , w 6 , and w 8 . But it is difficult for the user to tell which wallets the bitcoins finally end to in the connection diagram (Fig. 9b). Besides, it is also intuitive to see that whether circulations exist. For example, 1connected wallet w 2 appears on the right of 2-connected wallets w 5 , w 6 and w 7 , indicating that bitcoins are circulated between w's 1-connected and 2-connected wallets.
Note that the advantage of a flow map over a connection diagram will be more noticeable with the increased complexity of involved wallets and transactions. For example, in Fig. 9c, when the flow process is complex, the flow map is still clear and the user can clearly see the circulation pattern: Certain bitcoins flow out of the w 0 , the leftmost red box, and afterwards flow back to w 0 , the red boxes on the right side of the map. However, the user can hardly tell the connections between wallets and the circulation pattern in the connection diagram with all edges set visible (Fig. 9a).

Track Bitcoin Flow
Workflow. One starts to track where bitcoins traded in a transaction X flow to by clicking a transaction X (marked in Fig. 1 B) in the detail view. And the involved transaction information will be retrieved from the transaction database, displayed in the table of the detail view (Fig. 1 B). Then, the flow process is shown in the flow view ( Fig. 1 E), illustrating how bitcoins flow among wallets v i w ði 2 ½0; DÞ involved in the connection network N D w . BitAnalysis provides the following interactive operations to support convenient examination of bitcoin flows. Please refer to the video for a more clear demonstration.
Correlation of flow view to other views.When one selects a wallet in the connection view, the flow view, or the temporal view, the same wallet will be highlighted in other views as well.
As an example, wallet 0 is selected in Fig. 1. Bitcoin flow animation. The process of bitcoin flow involves a series of flow steps and the user may want to review the process dynamically. When the user scrolls the time axis slider-bar in the flow view, the process how bitcoin flows will be animated in the flow map as well as in the connection diagram. Zooming up. The flow map is initially displayed as an overview. When the user wants to check wallet boxes in detail, he can scroll the mouse wheel to increase the height of boxes.

TAG WALLETS WITH KNOWN TYPES
Meanwhile, we have retrieved tags, including exchanges, mixers, services, and gambling games from Wallet Explorer to exhibit wallet types. To be specific, when users choose to highlight wallets with known types in BitAnalysis, The summary view will highlight outstanding wallet blocks with known tags (Fig. 10a). The temporal view will display traders of a wallet along with their tags (Fig. 10b).  In the connection view, wallets with known types will be rendered distinguished from others along with the abbreviation of their tags (Fig. 10c).
In the flow view, if a transaction involves wallets of specific types, such as exchange or mixer, the tracking of bitcoin flow in the flow map will be stopped automatically, since in such transactions, the inputs and outputs obviously do not relevant and thus require no further flow tracking.

User Study
To evaluate BitAnalysis , we conducted a user study to assess its effectiveness and usability. The details of the user study are presented in this section.

User Study Setup
Participants. We recruited 25 participants for the user study. Among them, 5 have helped us perform the needs study described in Section. 3 and the rest 20 participants ( 4 females, aged 29 to 65 years) are interested in or have bitcoin investment experience. Meanwhile, all the participants have no background of either HCI or visualization and no conflict of interests.
Procedure. We first briefly explained to all the participants the main features of the BitAnalysis system, by demonstrating commons visualization functions with a wallet investigation example. Then, the participants were asked to utilize BitAnalysis to analyze a wallet by accomplishing six tasks as shown below, which will be explained shortly. After the participants finished all the tasks, we asked them to express their view on the effectiveness and usability of BitAnalysis both verbally and in a post-study questionnaire (Table 1)

In-Depth Wallet Examination
In this section, we describe the procedure how participants investigated a wallet w in the user study. Basic Tasks. All the participants ( p 1À25 ) started the analysis by searching the w and looking at its transaction summary from the summary view ( Fig. 1 A), from which they noticed that w kept accumulating bitcoins until March 2014, which are all sent out afterwards ( R1 ). Then, some participants ( 15=25) clicked on the transaction bar of time unit 2014.03 to check transaction details from the detail view ( Fig. 1 B) while some ( 20=25) examined from the direct mode of the temporal view (Fig. 3), who all found that 111114 (99%) bitcoins were send to wallet w001 in one single transaction X ( R2 ).
Track Bitcoin Flow. Then, the participants attempted to investigate the bitcoin flow of X. Most participants ( 21=25) immediately decided to focus on w001 and leave alone other traders v 1 w ð6 ¼ w001Þ of w since the majority of bitcoins in w were sent to w001. And they increased D of the connection network N D w in the connection view by expanding wallet w001 only. The remaining 4 participants (p 10 , p 14 , p 18 p 19 ) started to ignore wallet v 1 w ð6 ¼ w001Þ after D > 3. The participants kept increasing D while at the same time checked the bitcoin flow of X. They observe that when D < 6, all wallets v i w ði 2 ½2; D) maintain a zero balance. This phenomenon stops when D ¼ 7 (Fig. 1 D).
Afterwards, all the participants ( 25=25) used the provided flow tracking animation to examine the time-varying bitcoin flow process (Fig. 11), with which the participants can watch the live bitcoin flow process in the connection diagram (a) -(c), and in the flow maps (d) -(f) simultaneously.

Q1:
Is it easy for you to quickly browsing the transaction summary of a wallet in the summary view? Q2: Is it easy for you to find the outstanding traders (transactions) via the summary view and the direct Tx mode of the temporal view? Q3: Is it easy for you to analyze wallets relationship via the connection diagram and the provided metrics in the connection view? Q4: Is it easy for you to examine the temporal activity of i-connected wallets of w in the indirect Tx mode of temporal view? Q5: Is it easy for your to track bitcoin flow with the flow map in flow view and the interactions (e.g., flow animation)? Q6: Is it easy for you to set real time monitoring alarms for interested wallets? Q7: Is it easy for you to examine details of interested transactions? Q8: Is it easy for you to learn how to use BitAnalysis? Q9: Overall, is it easy for you to understand the visual designs of BitAnalysis? Q10: Do you think BitAnalysis is more effective than Wallet Explorer [2] and Blockchain.info [10] in accomplishing the tasks described in Q1-Q7? ? Q11: Do you think BitAnalysis is more effective than BlockChainVis [35] in accomplishing the tasks described in Q1-Q7? Q12: Do you think BitAnalysis is more effective than Bitcoin Big Bang [33] in accomplishing the tasks described in Q1-Q7? Q13: Do you think BitAnalysis is more effective than BitExtract [6] in accomplishing the tasks described in Q1-Q7? Q14: Do you think BitAnalysis is more effective than SilkViser [9] in accomplishing the tasks described in Q1-Q7?
Note that the flow maps are set not to highlight time and please refer to Fig. 1 E for the time-highlighted version.
In the first stage, Figs. 11a, 11b, 11c, and 11d, the bitcoins were sent to more wallets distributively. In the second stage, Figs. 11b, 11c, 11d, and 11e, bitcoins were traded between many intermediate wallets back and forth, which leads to the complex connectivity of the connection diagram. In the last stage, Figs. 11c, 11d, 11e, and 11f, the bitcoins were concentrated from the intermediate wallets to the final wallets, which are the wallet boxes on the rightmost side of the flow map (Fig. 11f) and the wallet glyphs with a larger balance (or inner) circle radius in the connection diagram (Fig. 11c). Notice that among the final wallets, most are dark blue wallets or light blue wallets but one is an orange wallet. ( R3 ) 21 (out of 25) participants noticed the appearance of red rectangles on both the left and right sides of the flow map (Fig. 11f), which represent the wallet w 0 itself, indicating the existence of bitcoin circulations that some bitcoins flow back to w 0 . Though 4 participants (p 8 , p 10 , p 14 , p 21 ) did not notice this phenomenon at first but realized it right away after a quick hint. ( R4 ) Identify Wallet Similarity. Next, the participants used the four similarity metrics and the temporal view to investigate wallet v i w ði 2 ½2; 7Þ similarity. The clustering results of different metrics, balance, trader, temporal, large-amount transaction, and combining them all are shown in Fig. 12. The findings are Wallets have great balance similarity (Fig. 12a) but little trader similarity (Fig. 12b). Meanwhile, the indirect Tx mode of the temporal view (Fig. 1 C) and the temporal similarity (Fig. 12c) metric both demonstrate the temporal similarity between wallets. ( 25/ 25 participants) In Fig. 12d, many wallets belonging to the red balance cluster of Fig. 12a transferred a large volume of bitcoins to wallets belonging to the orange balance cluster of Fig. 12a. This phenomenon indicates that the wallets also have great similarity in terms of the large-amount transaction metric from the perspective of balance clusters. ( 20=25 participants) Wallets are clustered into a single group if combining the balance, temporal, and large transaction metrics (Fig. 12e)

Results
Overall, the user study indicates that BitAnalysis can effectively help the user examine a bitcoin wallet. Meanwhile, it is easy to use for the user with little knowledge of visualization and HCI.
Effectiveness. Fig. 13 shows the scores for each question in the post-study questionnaire ( Table 1). The participants usually started an investigation from the summary view. All participants appreciated the summary view which enables them to get an overview first with the intuitive encoding of outstanding wallets and transactions (Q1 and Q2). Many participants verbally commented that the summary view releases them from having to go through pages of transactions (p 3À5 , p 17À19 , p 20 , p 23À25 ), and that it is intuitive to locate the outstanding traders (p 3À5 , p 8 , p 11À13 , p 16À19 , p 20 , p 22À25 ). Meanwhile, 24=25 participants can easily examine details of interested transactions (Q7 of Fig. 13).
More importantly, most participants praised the analysis functions provided. i.e., the temporal view and the connection view, as well as the convenient manner to track bitcoin flows in the flow view, as shown in Q3, Q4 and Q5 of Fig. 13. They noted that such advanced functions are unavailable in other existing tools. Specifically, 23=25 participants expressed their satisfaction with the connection view (Q3). All participants agreed that the temporal view provides an effective way to observe wallet temporal similarity (Q4). 24=25 participants appreciated the flow map and bitcoin flow tracking animation, which enabled them to easily go through the bitcoin flow process among wallets (Q5).  Meanwhile, many participants verbally commented that the design of wallet glyph is very helpful in providing a quick overview, and facilitate visually wallet similarity checking (p 1À5 , p 8 , p 10À13 , p 15 , p 17 , p 19 , p 20 , p 22À25 ); that the proposed bitcoin characteristics based metrics are useful for wallet similarity measurement (p 1À5 , p 8À11 , p 13 , p 15 , p 16 , p 19À20 , p 22À23 ); that the newly designed flow map can show the paths of bitcoin flow in a more clean and clear way comparing to the widely used node-link diagrams, in which the paths can easily overlap with each other and are much more unintuitive to investigate (p 1 , p 3 , p 5 , p 10 , p 12 , p 19À22 , p 24 ); and that the time-axis in the flow map is useful for investigating flow process from the temporal perspective (p 3 , p 5 , p 11 , p 15 , p 17 , p 23 ).
Finally, all participants encountered no difficulties in setting the monitoring alarms for interested wallets (Q6).
Usability. Q8 and Q9 of Fig. 13 show that the participants had no difficulty in learning and understanding BitAnalysis . Meanwhile, the participants' verbal feedback indicates that the integrated cross-view interactions are helpful during the wallet investigation.
Comparison With Existing Tools. Note that it would be informative to compare our system with existing wallet analytical tools. However, a formal comparison between our system and existing tools is probably unfair and inappropriate because the existing tools do not provide visualization functions (e.g., BlockChain.info [10] and Wallet Explorer [2]), do not support advanced analysis functions (e.g. Bitcoin Big Bang [33]), or have different objectives as BitAnalysis (e.g., BlockChainVis [35], BitExtract [6], and SilkViser [9]). Hence, we just introduce the most relevant existing tools to them and asked the participants to try their best to finish the same tasks with the existing tools and collected their comments on the comparison between BitAnalysis and the existing tools in questions Q10-Q14 of the questionnaire (Table 1).
All the participants commented that the BlockChain. info [10] and Wallet Explorer [2] are useful for primitive transaction examination but are ineffective for advanced tasks, such as bitcoin flow tracking and wallet analysis, due to their lack of visualization functions and other advanced analysis tools. Moreover, many participants ( p 1À5 , p 7À13 , p 16À19 , p 21À25 ) pointed out that BlockChain.info [10] and Wallet Explorer [2] do not support transactions filtering as BitAnlysis does, so they always have to go through a wallet's transactions of all time, which is very inconvenient when there are many transactions under consideration. All the participants asserted that the BitAnalysis system is more effective than Wallet Explorer and Blockchain.info (Fig. 13  Q10).

Comparative Analysis
We also provide a detailed comparison between BitAnalysis and existing works from different aspects, including the advantages, disadvantages, techniques, objectives, and experimental environments ( Table 2). Most related works focus on bitcoin analysis and visualization from different perspectives as ours and thus have different objectives. The different functionalities mean that their techniques are quite different from ours. Please refer to Table 2 for details.

Mathematical Analysis
Time Complexity. In theory, without using any provided filtering, the time complexity of our system is Oðm Á n D Þ, where n is the average number of traders of a wallet, m is the average number of transactions of a wallet, and D is the max distance of the connection network. Because of the high time complexity, when using the system, the user should filter out unimportant transactions and increase value of D in the connection diagram by expanding userspecified wallets only. if the provided filtering function is used, the time complexity can be reduced to Oðm Án D Þ, wherem ( m andn ( n, and if user-specified wallet expanding strategy is further adopted, the time complexity could be reduced to Oðm Án Á DÞ to the greatest extent.
Theory Analysis of System Design. The design of flow map is piece-wise linear in the 2-dimensional screen space, following a tree structure and demonstrating a series of related bitcoin flows in a consistent direction. While the connection diagram is not, demonstrating the flows in random directions of the 2-dimensional screen space. Therefore, theoretically, it is much easier for users to track the flows in the flow map than in the connection diagram. Meanwhile, the advantage of a flow map over a connection diagram will be more noticeable with the increased complexity of involved wallets and transactions.
In the connection diagram, we propose the design of wallet glyphs. Without the glyphs, a wallet node in the connection diagram can only demonstrate one feature, enabling feature comparison from 1 dimension. While in a wallet glyph, we fully take advantage of the screen space to demonstrate multiple features of bitcoin wallets, including received/sent center angles, input/output thickness, concentric circles for different features. Meanwhile, we also use consistent color schemes to display absolute received/sent bitcoins. Totally, a wallet glyph can exhibit 7 different features at the same time, enable users to compare wallets from 7 dimensions in a connection diagram.

Contribution & Novelty Discussion
To summarize, the main contribution of this paper is the BitAnalysis system for advance bitcoin wallet analysis, which provides four main functions, efficient wallet preview via a novel designed summarization chart, wallets analysis with a newly proposed wallet glyph and connection diagram, bitcoin flow tracking with a novel designed flow map, as well as new transactions alerting. The functions are carefully designed based on the requirements raised in needs assessment (Section. 3). To be more specific, from the perspective of each proposed technique: Compared with line charts and bar charts, the design of our summary view is for more convenient comparison between different features of a wallet. And its advantages over line charts and bar charts are demonstrated in section 5.1 (alternative designs). Compared with node-link diagrams, our connection diagram uses novel wallet glyphs to summarize the features of wallets. Meanwhile, the placement of wallets in the diagram is designed to reflect wallet trading distances, which is shown in Section 6.2. Compared with existing clustering metrics, our wallet similarity metrics are specifically designed based on the characteristics of bitcoins, which are shown in section 6.3. Bitcoin flow map in section 7 is a newly design structure to illustrate how bitcoin flows between wallets, in with each graphical element is designed to encode different wallet/transaction features. Experimental Justification. Meanwhile, to justify that the proposed functions and designs are effective, in our experiment (section 9.1), we have invited 25 participants to conduct a rigorous case study for wallet investigation and let them accomplish six tasks (Section. 9.1.1, R1-R6) that cover different aspects of the proposed functions. The detailed procedure of the case study (section. 9.1.2) and the feedbacks from the participants (section 9.1.3) together indicate the effectiveness and usefulness of the proposed functionalities of BitAnalysis. Generally speaking, the participants are satisfied with the proposed system design, and they claimed that the functions provided by our system are helpful for bitcoin wallet analysis.

Limitations and Future Works
Processing Time and System Upgrade. Although the proposed system is useful and effective, it has a potential limitation, which is the processing time. When an investigation involves too many wallets, for example, a wallet contains many transactions or users specify a large distance value in the connection view, the data retrieval time and visualization rendering time will be long. To mitigate this problem, the user can filter out unimportant transactions and increase value of D in the connection diagram by expanding user- specified wallets only. As we tested, with the filtering functions enabled, the processing time to generate a 7-distance connection diagram with 450 wallets and 67,000 transactions is less than a minute.
To make the system more applicable for the industry, in the future work, we want to include more computational power and use parallel computing to speed up the data loading and rendering process.
Privacy-Oriented Cryptocurrencies . Since our system takes advantages of the transactions between wallets to perform the analysis, As a result, it cannot be used to analyze privacy-oriented cryptocurrencies such as Zcash, Dash and Monero, which are anonymous. However, in the future, we can still extend the system to support analysis of more nonprivacy-oriented cryptocurrencies.
Beginners Need Some Efforts to Learn the System. Inevitably, our system consists of relatively complicated visual design in order to fulfill the requirement of advanced bitcoin analysis. Therefore, it takes some time for users who are inexperienced in bitcoin to understand and to user our system. In the future, we will attempt to develop a simpler version of the current system as a complement for beginners with less advanced analytical needs.
Environment Settings. At present, BitAnalysis is a desktop system. In the future, we are considering migrating our system to a web engine to make it a web-based application, enabling BitAnalysis to be more easily accessible by users with no need to configure system settings.
Heterogeneous Systems. During the design process of BitAnalysis, we did not fully consider how it will work in the case of heterogeneous systems. Therefore, we list it as a limitation and would like to explore the possibility to integrate this feature in the future work.