A Lawful Metadata-Driven Framework for Linking Encrypted Communication Behavior and Cryptocurrency Wallet Activity in Digital Investigations

Abstract

End-to-end encrypted (E2EE) messaging and the growing use of cryptocurrency create an attribution gap for digital investigators because message content is unavailable and wallet activity is often decoupled from subscriber identities, which makes it difficult to link communication behaviors with wallet activity. We propose a lawful and metadata-driven forensic attribution framework called the Data-Source Association Framework (DSAF). The DSAF links encrypted communication behavior with cryptocurrency wallet activity by correlating only legally obtainable network metadata that are observable under lawful interception (LI) with on-chain traces. By integrating information from communication behaviors and wallet activity, the framework aims to narrow the person–application–wallet attribution gap. The framework integrates two components, where one performs encrypted-application classification using transport-layer signals and flow-level features and the other conducts wallet–identity association by applying controlled decoding to intercepted traffic and extracting relevant transaction traces. Both components operate under a minimum-field schema that is aligned with Taiwanese LI procedures. We implemented the workflow and evaluated it using controlled experiments across multiple wallets and assets, reporting Wilson 95% confidence intervals (CIs). We achieved 91.4% accuracy (181/198) in end-to-end association under a confidence threshold, with high performance across wallet types, including Monero and TronLink.

1. Introduction

End-to-end encrypted (E2EE) messaging and decentralized cryptocurrencies have reshaped the landscape of digital investigations. These technologies enhance privacy and security for legitimate users, but they can reduce the evidential utility of traditional lawful interception (LI) and content-centric forensic methods. In many cases, communications are inaccessible by design, and financial activities are conducted through pseudonymous blockchain addresses. As a result, investigative signals tend to remain distributed and fragmented across multiple data sources.

The loss of visibility is structural. E2EE conceals message content and limits access to participant identifiers in many deployment scenarios. In contrast, public blockchains record transactions, but they do not directly encode real-world identities. When these technologies are used together in illegal activities (e.g., fraud, money laundering, and coordinated cybercrime), it is difficult for investigators to find attribution by using any single source. Communication-side artifacts alone may be insufficient, and on-chain records alone typically lack the off-chain context needed to link activity to actors. As a result, investigators usually observe encrypted traffic without being able to identify the participants, or they may observe blockchain transactions without knowing who initiated them. In encrypted messaging, users typically register with application-specific accounts and communicate without relying on E.164 telephone numbers (E.164, ITU-T Recommendation E.164: the international public telecommunication numbering plan), which limits the ability to directly associate an observed account with the underlying real-world user. This fragmentation complicates evidential reconstruction and delays timely intervention. Recent United Nations Security Council Counter-Terrorism Committee Executive Directorate (CTED) assessments note that illicit networks use encrypted mobile applications to coordinate fundraising and transfer value via virtual assets, alongside traditional mechanisms, such as cash couriers [1]. Together with industry-scale findings that on-chain data alone may not reliably separate illicit from licit activity without off-chain context, these observations motivate investigative workflows that correlate telecom-side observables with financial traces to close the attribution gap [2].

Attempts to restore visibility by weakening encryption, mandating platform access, or expanding bulk collection may raise substantial legal, ethical, and privacy concerns. In Taiwan, LI is bound by statutory requirements that emphasize proportionality, necessity, and data minimization [3]. Accordingly, attribution should be pursued through lawfully obtainable metadata and public-chain observation rather than protected content or privileged platform data.

In response, we propose a lawful, metadata-driven framework (Data-Source Association Framework, DSAF) that links encrypted communication behavior with cryptocurrency wallet activity by using only interception-visible metadata and public-chain signals. The DSAF reconstructs person–application–wallet associations that are suitable for investigative reconstruction in privacy-enhanced ecosystems. The five key properties of the DSAF are listed as follows: (1) The DSAF is a legally compliant framework for linking encrypted communication behavior with blockchain transactions without accessing message content. (2) There are two modular attribution components in the DSAF, App–Subscriber Binding (ASB) and Wallet–Identity Association (WIA), which are used to infer encrypted applications and wallet activity from lawfully observable metadata, respectively. (3) In order to produce reconstructible person–application–wallet linkage events with preserved provenance, a fusion procedure is designed to align telecom-side and blockchain-side evidence. (4) An evaluation protocol is used to report accuracy and hit rate with Wilson 95% confidence intervals (CIs). (5) All experiments underlying the development of the DSAF were performed under controlled conditions by using author-controlled test subscriptions and devices consistent with LI procedures.

The remainder of this paper is structured as follows: In Section 2, we review prior work on encrypted-traffic analysis, LI metadata, blockchain forensics, and multi-source fusion. In Section 3, we introduce the Data-Source Association Framework (DSAF) and experimental methodology, and in Section 4, we report empirical results for the ASB and WIA modules. In Section 5, we discuss practical implications, limitations, and comparisons with current investigative workflows. Finally, we report conclusions and outline future research directions in Section 6.

2. Related Work

Previous lines of research on encrypted-traffic analysis, telecom metadata attribution, blockchain forensics, and multi-source fusion have largely progressed in parallel. However, fewer studies have considered scenarios where E2EE messaging and cryptocurrency transactions are jointly used within a single criminal workflow. In this section, we review (1) investigative challenges, (2) metadata-based traffic analysis and telecom attribution, (3) blockchain analytics, and (4) multi-source integration.

2.1. Investigative Challenges of Encrypted Communication and Cryptocurrency Use

Under E2EE protocols, encryption and decryption occur at endpoints, so intermediaries cannot access plaintext. Consequently, LI systems typically capture only traffic-side metadata (e.g., packet sizes, timing patterns, handshake sequences, and domain-level signals) rather than message content or explicit participant identities. Investigations, therefore, depend more on endpoint/cloud artifacts and traffic inference than on content-driven wiretapping [4,5,6,7,8].

From a forensic perspective, encrypted traffic introduces several compounding constraints. Carrier-grade network address translation (CGNAT) causes many subscribers to share a public Internet Protocol (IP) address, so attribution typically requires correlating precise timestamps and source ports against operator mapping logs and retained-data interfaces [9,10]. While protocol hardening (e.g., Transport-Layer Security [TLS] 1.3, Quick UDP Internet Connections [QUICs], and Encrypted ClientHello [ECH]) conceals handshake fields (e.g., Server Name Indication [SNI]), the use of virtual private networks (VPNs) and The Onion Router (Tor) further suppresses the source visibility of exit-node observations and weakens metadata signals that were previously used for traffic classification. Jurisdictional variability in Subscriber Identity Module (SIM) registration and identity-verification regimes further affects the feasibility of subscriber-level attribution, particularly in cross-border or roaming contexts [1].

Parallel to communication obfuscation, cryptocurrency ecosystems provide a second layer of anonymity. Public blockchains record all transactions but represent users through pseudonymous wallet addresses. It is still a challenging problem of identifying the “natural” person who controls a wallet without complementary knowing your customer (KYC), exchange logs, device artifacts, or off-chain intelligence [11,12,13]. Recently, ecosystem-wide measurements suggest that stablecoins constitute the largest share of illicit transaction volume, which makes stablecoin wallet activity a practical investigative focal point [2]. Typology research work also identifies Tether USDt (USDT) on the TRON blockchain (TRON) as a commonly abused settlement rail in illicit finance, which motivates the inclusion of Tron-based USDT scenarios in our evaluation [14]. Additionally, some services (e.g., privacy-enhancing tools such as mixers, cross-chain transfers, multi-hop forwarding, and privacy coins) further degrade the traceability of fund flows. These also increase the need for multi-source association beyond on-chain analysis alone [13,15].

When both technologies are deliberately coupled with criminal activities, communication and monetary channels mutually reinforce each other’s opacity. As noted in recent investigative reports, investigators may “see encrypted communication without knowing the actors” and “observe blockchain flows without knowing the owner,” which makes it difficult to reconstruct coherent operational narratives or evidentiary chains [1,2].

2.2. Communication-Side Metadata Analysis and Lawful Interception Research

Previous work on communication-side metadata analysis typically spans three complementary strands: (1) encrypted-traffic classification; (2) attribution based on Internet Protocol (IP) tuples and operator records such as call detail records (CDRs); (3) lawful interception (LI) architectural standards.

A substantial body of research shows that application behavior can be inferred from observable encrypted-traffic patterns without decrypting content. Previous studies have applied machine learning and deep learning models to extract features such as packet-length distributions, directionality vectors, burst patterns, inter-packet timing, and Transport-Layer Security (TLS)/QUIC handshake fingerprints, reporting high classification performance on controlled datasets [5,6,7]. These classifiers are also attractive for operational settings because they can support low-latency inference while avoiding decryption. However, their performance may degrade under feature drift caused by application updates, content delivery network changes, and protocol evolution. It is also sensitive to dataset locality and collection conditions. Moreover, application identification alone does not provide subscriber attribution unless it is integrated with operator-side metadata, including CGNAT logs and retained records.

The second strand concerns telecom operators maintaining records that can support IP-based attribution under lawful procedures. CDRs and CGNAT mapping logs can be used to associate observed tuples (public IP, port, timestamp) with subscriber-level identifiers, consistent with retained-data handover practices and lawful interception standards [9,10,16,17,18]. When timestamps and port mappings are complete and sufficiently precise, this correlation can yield deterministic attribution. At the same time, attribution remains contingent on log completeness and retention policies. It also becomes more complex in roaming scenarios or multi-operator settings. Finally, this telecom-side linkage does not, by itself, provide application-level context unless it is combined with encrypted-traffic classification.

The final strand concerns the architectural standards that define how LI products are provisioned, mediated, and delivered to lawful authorities. In the 3rd Generation Partnership Project (3GPP), Technical Specification (TS) 33.107 defines LI functional architecture and roles, TS 33.108 specifies the handover interface between the operator/mediation system and the law enforcement monitoring facility (LEMF), and TS 33.128 provides stage-3 protocols and procedures that operationalize these functions [9,10,16,17,18]. These standards, however, primarily describe delivery mechanisms and interface semantics. They do not prescribe how multi-source attribution should be performed, nor do they specify how communication-side observations should be fused with telecom retention logs and blockchain evidence. This leaves a methodological gap that the present study addresses.

From a network-engineering perspective, the evidentiary metadata used in prior attribution work are primarily generated and observable at aggregation points in the operator’s core transport backbone, rather than at end devices [19,20]. In contemporary mobile deployment, user traffic from many access sites is consolidated into a smaller number of core gateways, and this concentration often results in shared egress and address resources, including CGNAT [21].

This operational reality explains why a public IP address alone is not a stable identifier at the Internet scale and why deterministic attribution in lawful settings typically requires aligning tuples (public IP, port, timestamp) observed at the network edge with operator-maintained translation and session records that map flows back to internal addressing and subscriber identifiers [21,22]. Moreover, the same backbone aggregation can introduce timing variance through queueing and rerouting, reinforcing the need for conservative temporal alignment and multi-source fusion when payload content is unavailable.

2.3. Blockchain Analysis and Cryptocurrency Forensics

Blockchain analysis is commonly discussed along three directions: graph- and cluster-based attribution using transaction-network structure; anomaly detection and laundering analysis, including behavior associated with mixing and obfuscation; and KYC and other off-chain data integration to associate pseudonymous on-chain identifiers to real-world actors.

On-chain attribution often relies on clustering heuristics and graph analytics to relate addresses and infer control relationships. Representative techniques include multi-input linkage, change-address identification, and transaction-pattern analysis [11,12,13]. These graph-analytic methods also support the large-scale visualization and behavioral profiling of transaction flows. They are frequently incorporated into anti-money laundering (AML) risk scoring and investigative triage. However, clustering heuristics can be fragile across chains and services, as their effectiveness may degrade under obfuscation or service-level countermeasures. Moreover, such methods typically do not yield natural-person attribution without off-chain sources, such as exchange KYC records or device artifacts.

A separate line of work examines privacy coins and mixing techniques. Previous studies have analyzed protocol-level weaknesses, statistical markers, and usage patterns that can reduce untraceability under certain conditions [15]. Even when these signals are present, attribution to a specific individual generally still requires external context and corroborating evidence.

Finally, the literature consistently highlights the importance of off-chain integration. Exchange KYC logs, bank records, merchant receipts, and open-source intelligence (OSINT) are often required to connect blockchain addresses with real persons [8,13,23]. These sources are operationally central, but their availability and timeliness vary across jurisdictions. Access can be constrained by cross-border processes and providers’ compliance requirements. Responses may also arrive after transactions have been executed, which can limit their utility for time-sensitive investigations. Most critically, blockchain-centered analyses often omit the communication events that precede or trigger transactions. This omission can leave investigative narratives partial or disconnected from the coordination channel.

2.4. Multi-Source Fusion and the Lack of Point-to-Point Attribution Frameworks

Multi-source data fusion has gained traction in several forensic domains. However, integrated approaches that explicitly connect encrypted communication events with cryptocurrency transfers remain limited. Existing studies and proposals typically follow one of the following three approaches: perform case-oriented, post hoc reconstruction by manually correlating communication data with transaction records; employ cross-platform trace integration frameworks that emphasize account linkage, rather than communication–transaction association; apply policy or architectural approaches that combine LI metadata with financial intelligence, but without providing implementable designs with quantitative evaluation under operational legal constraints [4,8].

Across these approaches, three recurring gaps can be observed: First, there is limited end-to-end, point-to-point attribution that links a specific subscriber, an encrypted application, and a wallet transaction within a consistent time window. Second, previous work provides limited treatment of lawful procedures, data minimization, and evidential reproducibility. Third, quantitative evaluation is often insufficient, particularly with respect to uncertainty reporting, which would support empirical comparison across methods. Previous works have not demonstrated a legally compliant and experimentally validated framework that reconstructs person–application–wallet associations by using only metadata observable under LI constraints. In this study, the DSAF is designed to address this gap.

3. Materials and Methods

The proposed DSAF associates individuals, encrypted applications, and cryptocurrency wallets by integrating telecom metadata, LI-visible packet features, and blockchain transactions. The DSAF is designed to operate within Taiwan’s Communication Security and Surveillance Act by only using metadata obtainable through LI and authorized operator-side record retrieval [3]. In this section, we describe the framework architecture, module designs, data sources, evaluation metrics, and experimental methodology.

3.1. Overview of the Data-Source Association Framework (Dsaf)

The DSAF enables ascertainment of whether person-level attribution remains feasible when investigators cannot access message content or privileged platform-side data. To address this question under LI visibility constraints, the DSAF decomposes the attribution task into two complementary components, App–Subscriber Binding (ASB) and Wallet–Identity Association (WIA). ASB associates encrypted communication activity with a specific subscriber at a specific time by combining LI-visible session metadata with operator-side CGNAT and CDR correlation. WIA infers wallet-usage events and potential outbound cryptocurrency transfers from metadata-visible wallet behavior and confirms candidates with on-chain verification where feasible.

A central Fusion Hub aligns ASB and WIA outputs along a unified timeline and identity context, producing structured person–application–wallet linkage events. To support forensic defensibility, the DSAF preserves provenance for each linkage event based on (i) an Evidence Store, which consolidates event summaries and supporting artifacts, and (ii) a Processing Log, which records intermediate steps, parameter versions, and the specific metadata fields used to reach each decision. The end-to-end observation model and the structure of the Data-Source Association Framework (DSAF) are shown in Figure 1. The modular separation also allows the Fusion Hub to be operated as an auditable and logically independent correlation layer, thereby limiting unnecessary information exposure between ASB and WIA unless a lawful fusion decision is triggered.

As illustrated in the upper portion of Figure 1, we developed an end-to-end observation model for mobile access traffic in which encrypted OTT services (including voice and wallet applications) traverse the access segment and operator core as IP packet data before reaching the public Internet. Within this model, LI is positioned on the operator network side as the observation and collection point, enabling content-blind acquisition of packet-level metadata. In the observation model, the two acquisition surfaces are defined as legally and operationally distinct under LI constraints. First, ASB is anchored in authorized operator-side record retrieval, where investigators obtain application-related records and retention logs (e.g., CGNAT mappings and CDRs) through approved queries and correlate them with LI-visible session metadata to resolve subscriber identity at a given time. Second, WIA is anchored in interception-visible packet observations at the operator switching point, where the framework extracts content-blind traffic cues to flag candidate wallet-usage events and subsequently formulates on-chain hypotheses based on temporal alignment.

The lower portion of Figure 1 shows how these components are integrated as a metadata-driven attribution workflow. On the telecom/interception side, ASB ingests LI-visible metadata together with operator retention logs to classify the encrypted application and associate network events with a subscriber identity. In parallel, WIA flags candidate wallet-usage events from interception-visible traffic cues, derives on-chain hypotheses with temporal alignment, and verifies candidates by using public blockchain records where feasible. The Fusion Hub then aligns ASB and WIA outputs to produce person–application–wallet linkage events, while the Evidence Store and Processing Log capture intermediate artifacts, parameter versions, and decision-relevant fields to support reproducibility, auditability, and downstream forensic reporting.

3.1.1. Design Constraints and Rationale

The DSAF is designed to operate under four constraints that are typical of operational LI environments. First, only metadata fields that are legally retrievable through telecom operators or LI interfaces are used. Second, the framework is intentionally content-blind and processes no message content, decrypted payloads, or unrelated personal data. Third, linkage decisions are made reconstructible by retaining verifiable metadata summaries and versioned processing records. Fourth, modularity is maintained so that ASB and WIA can be evaluated independently or combined, depending on the evidential scope required.

3.1.2. Investigative Scenarios

To clarify how the DSAF supports attribution under LI constraints, we describe two representative investigative scenarios. These scenarios motivate the modular design and the evaluation setup, and they should be interpreted as conceptual use cases rather than prescriptive operational procedures; collection and disclosure are assumed to follow applicable authorization and retention requirements.

Scenario 1 (communications-only attribution). ASB ingests LI-visible session metadata, classifies the encrypted application, and correlates (public IP, port, timestamp) with carrier-side CGNAT/CDR records to resolve the associated subscriber identity. The output is a set of timestamped app–subscriber attribution events accompanied by the exact metadata fields used, feature/model version identifiers, and verifiable processing records. This scenario corresponds to the ASB workflow in Figure 2 and is evaluated in Section 4.1.

Scenario 2 (end-to-end cross-source attribution). ASB and WIA are executed in parallel when wallet-related leads are present or when communication behavior must be corroborated with value-transfer traces. The Fusion Hub then aligns results within a configurable temporal window to output reconstructible person–application–wallet linkage packages. Where available, the package includes on-chain confirmation artifacts (e.g., a transaction identifier [TXID]) and the supporting provenance records required for repeatable validation. This scenario corresponds to the end-to-end fusion pathway in Figure 1 (with WIA detailed in Figure 3) and is evaluated in Section 4.3.

3.2. The App–Subscriber Binding (Asb) Module

The App–Subscriber Binding (ASB) module associates encrypted-application sessions with a subscriber and a device by using only operator-side metadata and LI mediation outputs. ASB takes three primary inputs: CDR records, CGNAT logs, and traffic-mediator features that summarize LI-visible session metadata and flow identifiers. By jointly leveraging these sources, ASB operationalizes NAT-based attribution without relying on message content or platform-side identifiers. The workflow of the ASB module is shown in Figure 2.

Operationally, ASB proceeds in a staged correlation workflow. First, LI-visible timestamps and observed public IP addresses are used to derive the corresponding private addressing context by querying CGNAT logs within a predefined time window and tolerance. Second, the resolved private addressing context is bound to subscriber identity and device context by correlating CGNAT-derived keys with CDR-retrievable identifiers, yielding a stable subscriber–device attribution for the session. Third, the module identifies target encrypted-application sessions from traffic behavior and mediation-visible session descriptors and outputs app–subscriber–device association events. Each event retains the minimum provenance and correlation descriptors needed for downstream auditing and for subsequent cross-module fusion in the end-to-end framework. At the implementation level, this staged lookup is intended to reduce the CGNAT search space by first constraining candidate records with the observed time window and public IP/port tuple and only then resolving subscriber context based on operator-retained records. However, telecom-scale computational latency was not benchmarked in this feasibility study; therefore, it should be treated as an operational consideration rather than a measured performance claim.

ASB extracts and processes features exclusively from metadata observable under LI and telecom-side retention logs, thereby avoiding payload inspection and content decryption. The feature families include transport-layer handshake behavior in TLS/QUIC, packet-size distributions with directionality sequences, and temporal characteristics such as inter-packet timing intervals and burst patterns. When presenting in LI-visible traces, ASB also captures WebRTC-related signaling indicators, including Session Traversal Utilities for NAT (STUN) and Traversal Using Relays around NAT (TURN). In addition, the module retains essential network identifiers (such as source and destination IP addresses and ports, timestamps, protocol type, and domain endpoints when observable) and forms a minimum set of legal metadata consistent with Taiwanese LI procedures. Because some signals may disappear under Encrypted ClientHello (ECH), traffic padding, or relay-based tunneling, the feature design is intentionally multi-signal rather than dependent on any single observable, such as SNI, packet length, or destination endpoint.

Based on pre-established fingerprints, implemented as either rule-based signatures or model-based classifiers, ASB assigns each eligible traffic flow to an encrypted-application category (e.g., FaceTime v26.0.1, LINE v15.16–v15.17, and Telegram v12.1.1) without decrypting any payload. The classification result is stored together with a compact metadata summary required for downstream correlation and fusion.

Following classification, ASB performs NAT-based identity reconstruction by correlating the observed tuple (Public IP, Port, Timestamp) with CGNAT mappings and CDRs to resolve subscriber-level identifiers and associated records. This mapping can be expressed as {Public IP, Port, Timestamp} to {Internal Address, Mobile Station International Subscriber Directory Number (MSISDN), International Mobile Subscriber Identity (IMSI), International Mobile Equipment Identity (IMEI), subscriber record}. This procedure supports the person-level attribution of encrypted-application usage without content inspection, subject to the completeness and precision of operator-side logs.

For forensic reproducibility, ASB preserves provenance for each decision by recording the feature-set version, the model or rule version, the CGNAT query outcomes, and the relevant timestamps. These artifacts are stored in the Processing Log to enable the reconstruction and independent verification of the attribution process.

3.3. The Wallet–Identity Association (Wia) Module

The Wallet–Identity Association (WIA) Module infers wallet-usage events and candidate outbound cryptocurrency transfers under lawful interception visibility constraints. WIA operates on two inputs: LI-visible packet features derived from mediation-layer observation and public on-chain data obtained through blockchain lookup. Its primary output is a set of wallet–identity–transaction association events, where each association corresponds to a single candidate linkage between an app-level wallet instance, meaning a particular wallet application installation and its local account context on the device, and a specific outbound on-chain transaction on a given chain. Each output association retains the minimum descriptors needed for reconstruction and review, including the wallet-instance identifier, chain context, and candidate transaction identifiers (or TXIDs) where available, and the supporting metadata-derived cues that triggered reporting. The workflow of the WIA module is shown in Figure 3. In this study, “controlled decoding” refers to the rule-bounded parsing of lawfully intercepted, metadata-visible protocol artifacts—such as session sequencing, observable message framing cues, and chain-specific broadcast timing patterns—without reconstructing protected message content, decrypting payloads, or deriving user plaintext.

Operationally, WIA proceeds in four stages: First, wallet detection identifies wallet app usage patterns from traffic behavior and session-level packet features. Second, chain-type inference determines the target blockchain family associated with the observed wallet activity, enabling chain-specific parsing and confirmation logic. Third, outbound transaction identification detects send events and extracts key fields that support candidate transaction construction and subsequent on-chain lookup. Finally, an optional enrichment step maps candidates to higher-level on-chain entities using external blockchain intelligence services when such mapping is available and appropriate for the investigative setting. The resulting associations provide a structured bridge between metadata-visible wallet behavior and confirmable on-chain artifacts, supporting downstream fusion with telecom-side attribution in the end-to-end framework.

WIA characterizes wallet-related behavior by using interception-visible metadata and controlled decoding outputs derived from intercepted traffic streams. Extracted cues include transport-layer handshake and session behavior (TLS/QUIC), directionality and packet-size patterns, and synchronization or burst sequences that commonly precede transaction construction and broadcast. When observable, destination endpoints, protocol identifiers, and timing features are also retained to support chain-family inference. Accordingly, the decoder operates only on side-channel characteristics that remain visible in transit and outputs candidate events when the observed feature combination exceeds a fixed decision threshold calibrated on the controlled test set; in this study, the threshold was held constant across experiments to preserve the comparability of the reported hit-rate estimates.

Based on these cues, WIA applies pre-established fingerprints implemented as rule-based signatures or model-based classifiers to output a wallet/chain attribution event with an associated confidence score. For events that satisfy reporting criteria, the module attempts transaction extraction by aligning the inferred broadcast window with on-chain traces and retrieving candidate transaction identifiers (TXIDs) where feasible. This design enables wallet–transaction attribution while remaining content-agnostic and minimizing retained fields.

For forensic reproducibility, WIA preserves provenance for each decision, including the feature-set and decoder version, the signature/model version, the correlation parameters used for broadcast-window alignment, and the outcomes of on-chain queries. These artifacts are recorded in the Processing Log to support verification, review, and downstream fusion with telecom-side attribution results.

3.4. Data Sources and Legal Constraints

The DSAF relies exclusively on the minimum set of legally permissible metadata fields under Taiwanese LI procedures, consistent with the datasets described in this study.

The DSAF draws on three metadata domains: The telecom-side domain includes CGNAT mappings, call detail records, and subscriber-linked identifiers (e.g., MSISDN/IMSI/IMEI) used for lawful subscriber resolution. The interception-visible domain includes packet-level metadata such as endpoints/domains when visible, TLS/QUIC handshake behavior, and packet size, timing, and directionality sequences (without payload or decrypted content). The blockchain-side domain includes public on-chain transaction records, address heuristics and labeling data, and where lawfully obtainable, off-chain intelligence such as KYC-related artifacts or analytic-platform outputs. The DSAF is consistent with the Communication Security and Surveillance Act, as no communication content, no unrelated personal identifiers, and no unapproved data fields are processed [3].

3.5. Evaluation Metrics

The framework is evaluated using quantitative indicators defined for each module and for end-to-end performance. The evaluation metrics are defined in

Table 1. Evaluation metrics used in this study.

Metric	Description	Module
App identification accuracy	Correctly classified encrypted-app flows/total labeled flows	ASB
Wallet detection hit rate	Correctly detected wallet-usage events/total outbound-transfer trials, by wallet/currency	WIA
Weighted hit rate and 95% CIs	Wilson 95% CIs by wallet/currency; “Overall” is event-weighted across all trials	WIA
Network address translation (NAT)-based attribution success rate	Successful mapping of IP + port + time → unique subscriber	ASB
Fusion success rate	Proportion of ASB + WIA events successfully aligned	Fusion Hub
End-to-end delay	Time from metadata ingestion to final linkage event	Fusion Hub

. These metrics allow for the module-level benchmarking and holistic evaluation of the DSAF’s operational feasibility.

For WIA, we define an association as a candidate linkage between a wallet-usage observation and a specific outbound blockchain transaction on a given chain. Here, an app-level wallet instance denotes a particular wallet application installation and its local account context on the device. Each association instance is produced when WIA maps metadata-visible wallet behavior observed for an app-level wallet instance to one candidate transaction, yielding a candidate pair comprising a wallet-instance identifier, a chain identifier, and a transaction identifier (or TXID) where available, together with an associated confidence score and a binary reporting decision. An association is counted as a hit only when the reported candidate passes a fixed confidence threshold and the candidate transaction is independently confirmed via on-chain lookup. The threshold is treated as a fixed operating point that prioritizes evidential precision by minimizing false-positive linkages, and it is held constant across experiments to ensure comparability of hit-rate estimates. Let n denote the number of outbound-transfer trials observed for a given wallet/currency pair and k denote the number of trials in which WIA produces a correct wallet-usage detection and attribution event. We report the point estimate (k/n) and summarize uncertainty using Wilson 95% CIs.

3.6. Experimental Environment and Design

Table 2. End-to-end DSAF evaluation scenarios and rationale.

Scenario	Condition and Rationale
Baseline	Normal environment; it establishes reference performance under controlled conditions.
Transport perturbation	VPN/Tor usage; it assesses the stability of metadata-driven signals under routing/timing perturbations.
Timing perturbation	Time-synchronization perturbation; it tests the sensitivity of temporal alignment to timestamp offsets/granularity.
Field ablation	Removal of selected metadata fields; it identifies which minimal fields are the most critical to attribution and fusion.
On-chain obfuscation	Privacy coins or chain obfuscation; it characterizes the limits under which on-chain confirmation or interpretability is constrained.
Overall rationale	It enables the systematic analysis of sensitivity, robustness, and limiting factors under operational constraints.

summarizes the end-to-end DSAF evaluation scenarios and their rationale. A baseline condition was included to establish reference performance under controlled settings. Transport perturbation was evaluated using a virtual private network (VPN) and Tor to assess the stability of metadata-driven signals under routing and timing changes. Timing perturbation was evaluated via time-synchronization offsets to test sensitivity to timestamp granularity and misalignment. Field ablation was performed by removing selected metadata fields to identify which minimal fields are the most critical to attribution and fusion. On-chain obfuscation scenarios, including privacy coins or chain-level obfuscation, were used to characterize limits where on-chain confirmation or interpretability is constrained. Collectively, these scenarios support a structured analysis of sensitivity, robustness, and limiting factors under operational constraints. Because the present study was designed as a feasibility-oriented, controlled evaluation, these scenarios were used to structure robustness reasoning and qualitative failure-mode analysis; separate per-condition k/n degradation tables were not collected for every perturbation case.

4. Results

In this section, we present the empirical evaluation of the proposed DSAF, including the performance of the ASB and WIA modules, and the end-to-end person–application–wallet association results. All experiments were conducted using legally obtained test numbers and controlled devices, ensuring full compliance with statutory LI constraints. Performance metrics follow the definitions introduced in Section 3.5.

4.1. Asb Module Results: Encrypted-Application Identification

The ASB module was evaluated using a labeled dataset consisting of 20 controlled test cases, covering FaceTime, LINE, and Telegram voice/video calls. Each case included 25 metadata fields (e.g., timestamps, handshake behavior, directionality, and network address translation (NAT) information), enabling both application classification and subscriber attribution.

Across the 20 evaluation cases, ASB correctly identified the encrypted communication application in every instance, which corresponds to an application classification accuracy of 100% (20/20) with no misclassifications. No evidence of model drift or version mismatch was observed during the evaluation window. This result is consistent with the controlled experimental setting, in which application versions and network conditions were maintained stable over a short test period. Classification performance was comparable for voice and video calls, suggesting that the discriminative metadata patterns used by ASB remain robust across media modalities under the evaluated conditions.

NAT-based subscriber attribution was also successful in all evaluated cases. For each intercepted session, CGNAT mapping logs provided the public IP address, source port, and timestamp required for correlation. Under the evaluated conditions, these fields were sufficient to deterministically associate each event with a single subscriber identity record (MSISDN/IMSI/IMEI), yielding a success rate of 100% (20/20) in the dataset.

The results indicate that LI-visible metadata can be sufficient for encrypted-application identification without accessing payload content, at least under controlled conditions. In the evaluated cases, CGNAT-induced IP sharing did not prevent subscriber attribution because sub-second timestamp precision and port-based disambiguation enabled deterministic resolution to a unique subscriber record. These findings support the feasibility of application-level attribution within LI visibility constraints in the tested setting, motivating additional robustness analysis regarding field availability and the sensitivity of correlation to timestamp and port precision (shown in Section 4.4).

4.2. Wia Module Results: Wallet Detection and Cryptocurrency Attribution

The WIA module was evaluated using multi-day, multi-round controlled experiments conducted between 13 October and 28 October 2025. Each trial involved initiating outbound transactions using test devices running real wallet applications across multiple blockchains. In total, WIA was assessed over 198 outbound-transfer trials spanning seven wallet/currency pairs. Across all trials, WIA produced 181 correct wallet-usage detection and attribution events, corresponding to an overall hit rate of 91.4% (181/198). Wallet/currency-specific hit rates ranged from 85.2% to 96.3%.

Table 3. WIA wallet-detection performance by wallet/currency (k/n, hit rate, and Wilson 95% CI).

Wallet/Currency	k (Hits)	n (Trials)	Hit Rate (%)	Wilson 95% CI, Lower Limit (%)	Wilson 95% CI, Upper Limit (%)
Monero	27	29	93.1	78.0	98.1
TronLink/TRX	23	27	85.2	67.5	94.1
Trust/ETH	26	27	96.3	81.7	99.3
TronLink/USDT	28	30	93.3	78.7	98.2
Trust/USDT	28	30	93.3	78.7	98.2
Bitcoin/BCH	25	28	89.3	72.8	96.3
Mycelium/BTC	24	27	88.9	71.9	96.1
Overall	181	198	91.4	86.7	94.6

Note: n is the number of outbound-transfer trials evaluated for the given wallet/currency pair; k is the number of trials where WIA produced a correct wallet-usage detection and attribution event.

reports the corresponding k/n values, hit rates, and Wilson 95% CIs. The evaluated wallet applications were Monero.com v5.4.2; v5.5.0–v5.5.1, TronLink v4.18.0–v4.18.1, Trust Wallet v11.4–v11.5, Bitcoin.com Wallet (BCH) v8.8–v8.9, and Mycelium v1.18, corresponding to the wallet/currency pairs reported in Table 3.

Among the wallet events that WIA successfully detected, the module correctly inferred the underlying chain family (e.g., Ethereum, Tron, Bitcoin-family, and Monero) in all cases. Missed detections were excluded from chain-type scoring because no chain label was produced when the detection event was absent. In a qualitative review of trial traces, outbound transfers were typically preceded by synchronization bursts and upload flows consistent with transaction broadcast. WIA aligned these cues with on-chain transaction identifiers in most cases. The remaining false negatives were primarily associated with small-value transfers, wallets that batch or delay broadcast, and transient network jitter observed during some rounds.

Uncertainty was summarized using Wilson 95% CIs, which provide more stable coverage behavior under moderate sample sizes than normal-approximation intervals. As expected, the intervals were narrower for wallet/currency pairs with larger trial counts and wider for pairs with fewer observations, reflecting sampling variability across the evaluated wallet types.

4.3. End-to-End Cross-Source Attribution (Asb + Wia)

This experiment evaluates whether the DSAF can yield reconstructible person–application–wallet linkage events by fusing telecom-side attribution (from ASB) with wallet and transaction attribution (from WIA) along a unified identity and timeline. Conceptually, each linkage event captures the sequence “subscriber X used encrypted app Y at time t₁, and subscriber X initiated cryptocurrency transfer Z at time t₂.” In the evaluated dataset, linkage records retained the minimum set of fields required for subsequent reconstruction and review. On the telecom side, records retained subscriber identity context, including MSISDN, IMSI, and IMEI where available, together with app labels, LI-visible timestamps, and session or flow keys, as well as the NAT and CDR correlation keys required for subscriber–flow resolution under CGNAT. On the wallet side, records retained wallet and chain identifiers and candidate transaction identifiers (or TXIDs) where available, together with confidence scores and reporting decisions. Correlation parameters used for reconstruction, namely, the time window and tolerance settings, and provenance pointers to upstream module outputs, were also retained. Because a persistent Fusion Hub event store was not deployed in the experimental setup, end-to-end linkage records were instantiated with an offline correlation join over ASB and WIA outputs under the predefined correlation tolerance levels used in this study.

End-to-end linkage instantiation was performed by joining ASB-attributable encrypted-application session events with candidate WIA attribution events that met the reporting criteria. ASB events were represented by subscriber identity context where available, LI-visible timestamps, session or flow keys, and NAT and CDR correlation keys for CGNAT resolution. Candidate WIA events were characterized by wallet and chain identifiers, candidate TXIDs where available, and the associated confidence score and reporting decision. A linkage record was output when the identity context was consistent and timestamps fell within the predefined time window and tolerance settings, and it retained the joined app-side and wallet-side descriptors together with correlation parameters and provenance pointers to the underlying ASB and WIA logs to support repeatable reconstruction during subsequent review.

Across all test days from 13 October to 28 October 2025, the end-to-end linkage records were instantiated whenever both upstream conditions were satisfied. Specifically, ASB needed to resolve the relevant communication flow to a unique subscriber identity via NAT-based attribution, and WIA needed to produce a wallet or transaction attribution event that met the reporting criteria. Under the controlled dataset, ASB exhibited no attribution failures, as reported in Section 4.1. Accordingly, the end-to-end yield was primarily bounded by WIA false negatives. End-to-end association was achieved for all ASB-attributable communication events and for 91.4% of outbound-wallet-transfer trials overall, corresponding to 181 out of 198 trials with a Wilson 95% confidence interval of 86.7 to 94.6%, consistent with the WIA hit-rate results reported in Section 4.2.

Temporal alignment was influenced by several operational factors, including Network Time Protocol synchronization between test devices, sub-second timestamp granularity in LI-visible metadata, and confirmation latency on public chains when deriving or validating TXIDs. Despite these sources of timing variance, all end-to-end associations in the evaluated dataset satisfied the pre-defined correlation tolerance levels adopted for lawful, metadata-based reconstruction in this study. To reduce false-positive fusion, the offline join used conservative temporal tolerance levels referenced to synchronized test clocks; nevertheless, this study did not independently quantify performance under systematically expanded windows or deliberately desynchronized clocks, which remains an important future validation task for real-world deployment.

Reconstruction examples further illustrate the evidential sequence supported by the DSAF under this offline-join procedure. In representative trials, for example, an ASB communication event, a LINE video call at 10:12:07, was temporally aligned with a WIA outbound-transfer event, a TRON TRC20 token transfer broadcast at 10:14:33. The offline fusion step associated both events to the same subscriber-level identity context where available and retained the corresponding module outputs, correlation parameters, and provenance pointers needed to reproduce the linkage during subsequent review. The resulting linkage record forms a compact and reconstructible evidential unit suitable for downstream investigative examination.

Transport- and protocol-level perturbations, such as VPN or Tor routing and timing jitter, may reduce the stability of network-side features used by metadata-driven inference. Attribution may also be limited by logging incompleteness or insufficient timestamp and port precision in NAT and LI metadata, which directly affects subscriber–flow resolution under CGNAT. In addition, wallet-behavior variability, such as delayed broadcasts, batching, or nonstandard wallet settings, may attenuate or shift outbound-transfer cues, reducing detectability. Finally, privacy-enhancing assets and services, including mixers and privacy coins, can constrain on-chain confirmation and limit the interpretability of candidate linkages. Within the controlled dataset used in this study, ASB-related failures were not observed. When degradation occurred, it primarily manifested in the WIA stage and aligned with wallet-behavior variability and on-chain confirmation constraints.

4.4. Robustness Tests and Failure-Mode Analysis

Across the robustness scenarios, robustness tests indicate that performance degradations arise from several recurring sources of uncertainty. Transport- and protocol-level perturbations, such as VPN/Tor routing effects and timing jitter, may reduce the stability of network-side features used by metadata-driven inference. Attribution may also be constrained by logging incompleteness. In addition, insufficient timestamp granularity or missing port precision in NAT and LI metadata can directly affect subscriber–flow resolution under CGNAT. Wallet-behavior variability may further reduce detectability. Examples include delayed broadcasts, batching, or nonstandard wallet settings that shift or attenuate outbound-transfer cues. Finally, privacy-enhancing assets and services, including mixers and privacy coins, can constrain on-chain confirmation. This limitation can reduce the interpretability of candidate linkages. Within the controlled dataset used in this study, ASB-related failures were not observed. When degradation occurred, it primarily manifested in the WIA stage. The observed patterns aligned with wallet-behavior variability and constraints on on-chain confirmation. In particular, future deployment must account for handshake concealment (e.g., ECH), packet-size normalization or padding, VPN/Tor relay paths, and backbone jitter, all of which can suppress or distort metadata features that are discriminative under controlled conditions. Because separate perturbation-specific sample counts were not retained for each stress condition, the present section should be interpreted as a qualitative failure-mode analysis rather than a standalone benchmark table.

In VPN- and Tor-mediated environments, ASB accuracy remained stable under VPN routing. This behavior is consistent with the design of the ASB module, which relies on interception-visible traffic metadata rather than IP endpoint identity. WIA exhibited minor sensitivity under VPN routing, and the observed variability was mainly associated with wallet-side behavior rather than systematic failure of the inference pipeline. Overall performance remained within the ranges expected from the module-level results. In operational settings, third-party VPNs and Tor may also collapse destination diversity and handshake visibility at the LI observation point, so any retained classification capability would need to rely more heavily on timing, burst structure, and telecom-side correlation than on endpoint-facing identifiers.

To assess sensitivity to field availability, we performed an ablation-style analysis. Selected metadata fields were removed, and the qualitative impact on association capability was examined (as shown in

Table 4. Ablation analysis of selected metadata fields and qualitative impact on association capability.

Ablated Metadata Field	Observed Effect and Interpretation
Packet-size sequences	Lower discriminability for some wallets; size–directionality cues contribute to wallet-type separability under encryption.
Timing intervals	Reduced app classification confidence; timing and burst patterns provide stable signals for app inference and temporal alignment under LI visibility.
Port information	Higher NAT ambiguity risk; port + time disambiguation is critical when multiple subscribers share a public IP via CGNAT.
Handshake features	Lower accuracy for certain encrypted apps; TLS/QUIC handshake templates provide high-signal identifiers when visible.

). Removing packet-size sequences reduced discriminability for some wallets. This observation suggests that size and directionality cues contribute to wallet-type separability under encryption. Removing timing intervals reduced confidence in app-level classification. It also weakened temporal alignment cues, consistent with the role of timing and burst patterns in metadata-driven inference under LI visibility. Removing port information increased NAT ambiguity risk under CGNAT. This result reflects the importance of port-and-time disambiguation when multiple subscribers share a public IP address. Removing handshake features reduced accuracy for certain encrypted applications. This finding suggests that TLS/QUIC handshake templates can provide high-signal identifiers when they are observable. Collectively, these observations support the necessity of the minimal set of metadata described in Section 3. They also clarify which fields are most critical to maintaining attribution reliability.

Under privacy-coin and mixer scenarios, WIA often detected wallet usage. However, it could not always map outbound transfers to meaningful on-chain entities. This outcome is consistent with known limitations of privacy-enhancing cryptocurrencies and related services [14,15].

5. Discussion

The results provide empirical evidence that person–application–wallet associations can, in certain investigative scenarios, be reconstructed using only metadata observable under LI constraints. Rather than relying on message content, platform-side cooperation, or privileged device artifacts, the DSAF operationalizes attribution as a cross-source linkage problem that combines (i) telecom-side subscriber resolution under CGNAT and (ii) wallet/transaction inference supported by on-chain confirmation. In this section, we interpret the findings in the context of encrypted communication investigations and blockchain forensics, discuss the value of jointly interpreting communication and financial signals, and compare the DSAF with common investigative workflows.

5.1. Implications for Encrypted Communication Investigations

ASB achieved perfect accuracy in encrypted-application identification and subscriber resolution in the controlled evaluation. This result supports a key implication for LI practice: even when content is inaccessible, encrypted applications may remain distinguishable at the metadata level, provided that a stable subset of discriminative signals (e.g., TLS/QUIC-related behavior, timing/burst patterns, and size–directionality cues) remains observable.

In addition, the evaluation highlights the continuing operational importance of CGNAT mapping logs. When multiple subscribers share a public IP, the combination of timestamp precision and source-port disambiguation enables the deterministic resolution of flows to subscriber-level identifiers, thereby recovering person-level attribution without payload inspection. The DSAF extends prior work by integrating encrypted-traffic classification with telecom-side identity reconstruction, producing an end-to-end attribution path from network-side metadata to application identity and then to subscriber identity.

5.2. Implications for Cryptocurrency and Blockchain Investigations

WIA’s results indicate that wallet applications and outbound transfers can generate detectable metadata-side signals, even when wallet traffic is encrypted and transaction payloads are unavailable. In the tested setting, synchronization behavior, chain-specific communication patterns, and broadcast-associated bursts provided sufficient cues to infer wallet usage and support outbound-transfer hypotheses that could be validated with on-chain confirmation.

These findings do not imply that device seizure, exchange-side KYC, or financial-intelligence requests are unnecessary. Instead, metadata-based inference can serve as an earlier-stage indicator that helps prioritize investigative actions, narrow time windows, and guide downstream evidence collection when traditional sources are delayed or unavailable. Reporting hit rates with Wilson 95% CIs also provides a reproducible way to quantify uncertainty and improve cross-study comparability.

5.3. Joint Interpretation of Communication and Financial Signals

A central contribution of the DSAF lies in bridging two analytical domains that are often treated separately: encrypted communication inference and blockchain transaction forensics. In adversarial settings, these domains exhibit a dual-layer obfuscation effect: E2EE suppresses content and participant visibility, while pseudonymous blockchains suppress natural-person attribution of financial flows.

The end-to-end evaluation shows that when upstream conditions are satisfied, communication events produced by ASB and wallet/transaction events produced by WIA can be aligned at the subscriber level within a unified timeline. The Fusion Hub can, therefore, generate reconstructible linkage events such as the following: “Subscriber X used encrypted app Y at t₁ and performed a TRC20 transfer at t₂.” These fused linkage events serve as compact evidential units that support investigative reconstruction while preserving provenance for review and contestability.

5.4. Comparison with Existing Investigative Workflows

In practice, investigations combine multiple sources and procedures, including device seizure, OSINT and enriched intelligence, exchange-side KYC requests, retrospective blockchain graph analysis, and the manual correlation of communication and financial records. These approaches remain indispensable, but their availability and timeliness can vary across jurisdictions and cases, and they often depend on post hoc access to devices, providers, or third-party records.

The DSAF is positioned as a complementary workflow layer rather than a replacement for traditional forensic methods. Its primary contribution is an empirically evaluated, metadata-driven linkage mechanism that (i) does not require decryption or platform keys; (ii) can generate structured, timestamped linkage events suitable for downstream review; and (iii) preserves provenance to support reconstruction and auditing under the stated constraints. When stablecoins are involved, issuer-level administrative controls (e.g., freezing) may provide additional disruption or preservation options, which motivates timely cross-source detection and correlation beyond on-chain graph analysis alone [2,14]. For evidential purposes, the DSAF should be understood as generating probabilistic investigative linkage rather than replacing deterministic evidence such as plaintext content, seized devices, or provider-authenticated records; in practice, its strongest use is to prioritize and corroborate downstream collection. This positioning is also the basis on which the framework may travel across jurisdictions: while the precise lawful-access procedures differ, the core design principle—metadata minimization, provenance retention, and explicit separation between inference and confirmation—is not unique to Taiwan and can be mapped to other LI or retained-data regimes with jurisdiction-specific adjustment.

5.5. Limitations

Despite strong performance under controlled testing, several limitations should be acknowledged. The framework’s effectiveness depends on the continued availability of specific metadata fields within LI constraints. If those fields are unavailable or degraded, attribution performance may decline. The reported results also reflect a controlled environment. In all experiments, we used author-controlled devices and stable conditions over a short evaluation window. Operational deployment will introduce additional variance and noise, and outcomes may differ. In addition, some cryptocurrency ecosystems and obfuscation techniques inherently limit what can be confirmed on-chain, which can reduce the interpretability of candidate linkages. Finally, evidential use in practice requires safeguards beyond an experimental prototype, including jurisdiction-specific preservation rules and chain-of-custody controls. The present results should, therefore, be interpreted as a feasibility demonstration rather than a claim of general operational readiness. In particular, the ASB evaluation relied on only 20 controlled application tests, which limits internal validity and sharply constrains statistical generalization.

The DSAF relies on a constrained set of LI-visible and operator-retained metadata fields. These include TLS/QUIC-related behavior, timing and burst patterns, and NAT mapping information. Protocol evolution can reduce discriminative signals. The wider deployment of handshake concealment mechanisms, such as Encrypted ClientHello (ECH), is one example. Application updates can also change traffic characteristics and invalidate prior fingerprints, and operator logging policies and implementation choices are also relevant, as they affect the completeness of carrier-grade NAT (CGNAT) mappings and the precision of timestamps. For these reasons, operational use would require ongoing validation, and periodic recalibration may also be necessary.

The controlled setting is a further limitation. The experiments were conducted over a short and stable period, while real-world conditions are more heterogeneous: device stacks vary across users and operating systems; networks experience congestion, jitter, and route changes; application versions shift over time; VPN/Tor routing may introduce additional perturbations; and wallet behavior can also differ from trial to trial, with delayed broadcasts, batching, and background synchronization being common examples. These factors can reduce feature stability and weaken temporal alignment. Accordingly, the reported performance should be interpreted as evidence of feasibility under constrained conditions and should not be read as a guarantee of identical performance in all operational environments. External validity is likewise limited because in the experiments, we used author-controlled devices over a short interval and did not fully reproduce real-world variability such as unsynchronized clocks, radio-condition changes, concurrent background traffic, Wi-Fi-only transactions, and mixed-access behavior across cellular and wireless networks.

Limitations are more pronounced in ecosystems designed to resist tracing. WIA can often detect wallet usage from metadata-visible behavior. However, the meaningful interpretation of outbound transfers may be restricted, with privacy coins and mixing services being common cases. Multi-layer cross-chain operations can further obscure attribution, and contract-level obfuscation techniques can also reduce transparency. These conditions may constrain the availability of on-chain confirmation artifacts and may also reduce the granularity of attribution. These issues reflect known challenges in blockchain forensics and remain an important boundary condition for metadata-driven linkage approaches such as the DSAF. Additional boundary conditions include dual-SIM devices, where encrypted communication on one SIM and wallet activity on another may weaken person-level fusion unless device-side or operator-side context is available, and Wi-Fi-originated wallet transactions, which may bypass the cellular observation surface altogether. These scenarios were not evaluated in the present study.

Evidential use also imposes operational requirements. Operator logs and LI metadata typically require preservation and provenance documentation, and chain-of-custody controls are also needed. The DSAF introduces an Evidence Store and a Processing Log to support reconstructibility. Even so, deployment would still require jurisdiction-specific compliance controls, access governance must be defined and enforced, retention handling must follow applicable rules, and audit procedures are also necessary. These measures help ensure that linkage events remain reviewable and support legal defensibility in practice. Finally, legal defensibility also depends on preserving a clear distinction among inference, corroboration, and proof; metadata-based linkage should, therefore, be documented as one evidential layer within a broader chain-of-custody process rather than presented as a standalone deterministic conclusion.

5.6. Future Directions

Future work could extend the DSAF along several complementary directions that strengthen external validity and improve robustness under operational constraints. Cross-operator and cross-border fusion can be explored by incorporating roaming data and multi-operator LI feeds. Federated-learning approaches to traffic inference may reduce model drift by enabling the privacy-preserving aggregation of feature statistics across operators. Graph-enhanced wallet attribution can be integrated more deeply by combining chain-analytic platforms and clustering heuristics. Validation through anonymized or simulated case studies would help quantify robustness beyond controlled environments. Finally, automated scenario reconstruction can translate fused person–application–wallet events into higher-level narratives suitable for investigative dashboards and prosecutorial reporting while preserving provenance. Future work should, therefore, include telecom-scale latency benchmarking for CGNAT correlation, perturbation-specific robustness measurements, and dedicated experiments for ECH-era traffic, padded flows, dual-SIM behavior, and Wi-Fi/off-cellular transaction paths.

5.7. Summary

In summary, the DSAF unifies telecom-side subscriber attribution and blockchain-side transaction confirmation into a single, metadata-driven fusion workflow. By combining App–Subscriber Binding (ASB) and Wallet–Identity Association (WIA) under LI constraints, the framework enables reconstructible person–application–wallet linkage events while preserving provenance for review and repeatable validation.

A case-oriented walkthrough illustrates how investigators can progress from network-to-identity correlation to evidentiary corroboration. It starts with mapping IP addresses, timestamps, and port numbers (e.g., Public IP, private IP where available, and source/destination ports). It then incorporates NAT translation records, including CGNAT mapping logs, to resolve public IP:port ↔ private IP:port ↔ session/time window and link the activity with relevant subscriber and device records (e.g., account/subscription identifiers and device identifiers where available). Finally, the walkthrough shows how the resulting device/subscriber attribution can be corroborated with corresponding blockchain evidence. The results indicate that legally obtainable metadata, when fused across layers, can materially improve attribution in digital investigations while minimizing privacy intrusion.

6. Conclusions

End-to-end encrypted (E2EE) communication and the increasing use of cryptocurrency have reduced the utility of content-centric interception and have widened the attribution gap between observable network activity and real-world identity. This study developed the Data-Source Association Framework (DSAF), a lawful, metadata-driven approach that links encrypted communication behavior with wallet-related activity without weakening encryption or requiring privileged platform-side data.

In controlled experiments using author-controlled test subscriptions and devices, attribution remained feasible under strict LI constraints. ASB identified encrypted applications and associated them with subscriber identities via LI-visible metadata and CGNAT-based correlation. WIA detected wallet-usage events and candidate outbound transfers across multiple wallet/currency pairs, and performance was reported with Wilson 95% CIs. By fusing ASB and WIA outputs within a unified timeline and identity context, the DSAF produced auditable person–application–wallet linkage events that are reconstructible from preserved metadata summaries and versioned processing records.

These findings indicate that within the stated constraints, metadata-only analysis can still support the cross-domain reconstruction of communication and value-transfer behavior. However, the results should be interpreted in light of important boundary conditions: performance depends on the availability and stability of specific metadata features, which may change with protocol evolution, application updates, and operator logging practices; real-world networks introduce additional noise and timing variance; and advanced obfuscation (e.g., privacy coins, mixing, and cross-chain operations) can reduce attribution granularity. The evaluation was conducted in a controlled environment and did not involve message content or third-party personally identifiable information.

Future work will focus on strengthening external validity and robustness, including cross-operator and cross-jurisdictional fusion, the mitigation of feature drift through adaptive fingerprinting and model maintenance, deeper integration with blockchain analytics and graph-based attribution, and validation with anonymized or simulated case studies. Overall, the DSAF provides an experimentally grounded pathway for reconstructible, provenance-preserving attribution in investigative contexts shaped by strong encryption and decentralized finance.