{"id":"https://openalex.org/W7152408200","doi":"https://doi.org/10.1109/access.2026.3682641","title":"A Local Hierarchical LLM Framework for Privacy-Preserving Memory Forensics of Cryptocurrency Wallets","display_name":"A Local Hierarchical LLM Framework for Privacy-Preserving Memory Forensics of Cryptocurrency Wallets","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7152408200","doi":"https://doi.org/10.1109/access.2026.3682641"},"language":"en","primary_location":{"id":"doi:10.1109/access.2026.3682641","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3682641","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3682641","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5085389272","display_name":"Hsin-Hsiung Kao","orcid":null},"institutions":[{"id":"https://openalex.org/I143545923","display_name":"Central Police University","ror":"https://ror.org/03xms6995","country_code":"TW","type":"education","lineage":["https://openalex.org/I143545923"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Hsin-Hsiung Kao","raw_affiliation_strings":["Department of Information Management, Central Police University, Taoyuan, Taiwan"],"raw_orcid":"https://orcid.org/0009-0001-9895-7171","affiliations":[{"raw_affiliation_string":"Department of Information Management, Central Police University, Taoyuan, Taiwan","institution_ids":["https://openalex.org/I143545923"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101535322","display_name":"Joe-Mei Feng","orcid":"https://orcid.org/0000-0001-9368-6870"},"institutions":[{"id":"https://openalex.org/I107470533","display_name":"Tamkang University","ror":"https://ror.org/04tft4718","country_code":"TW","type":"education","lineage":["https://openalex.org/I107470533"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Joe-Mei Feng","raw_affiliation_strings":["Department of Computer Science and Information Engineering, Tamkang University, New Taipei City, Taiwan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Information Engineering, Tamkang University, New Taipei City, Taiwan","institution_ids":["https://openalex.org/I107470533"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100354329","display_name":"Chen\u2013Yu Li","orcid":"https://orcid.org/0000-0002-0336-9888"},"institutions":[{"id":"https://openalex.org/I143545923","display_name":"Central Police University","ror":"https://ror.org/03xms6995","country_code":"TW","type":"education","lineage":["https://openalex.org/I143545923"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Chen-Yu Li","raw_affiliation_strings":["Department of Information Management, Central Police University, Taoyuan, Taiwan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Management, Central Police University, Taoyuan, Taiwan","institution_ids":["https://openalex.org/I143545923"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5133241469","display_name":"Cheng-Hung Lin","orcid":null},"institutions":[{"id":"https://openalex.org/I4210108245","display_name":"Police Department","ror":"https://ror.org/01pd36221","country_code":"LT","type":"government","lineage":["https://openalex.org/I4210108245","https://openalex.org/I4210150337"]}],"countries":["LT"],"is_corresponding":false,"raw_author_name":"Cheng-Hung Lin","raw_affiliation_strings":["Information Management Office, Kaohsiung City Police Department, Kaohsiung, Taiwan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information Management Office, Kaohsiung City Police Department, Kaohsiung, Taiwan","institution_ids":["https://openalex.org/I4210108245"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.45927677,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"1"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.5005000233650208,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.5005000233650208,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.16359999775886536,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.04600000008940697,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cryptocurrency","display_name":"Cryptocurrency","score":0.8234000205993652},{"id":"https://openalex.org/keywords/network-forensics","display_name":"Network forensics","score":0.5619000196456909},{"id":"https://openalex.org/keywords/computer-forensics","display_name":"Computer forensics","score":0.489300012588501},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.4749999940395355},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.35920000076293945},{"id":"https://openalex.org/keywords/electronic-mail","display_name":"Electronic mail","score":0.29170000553131104}],"concepts":[{"id":"https://openalex.org/C180706569","wikidata":"https://www.wikidata.org/wiki/Q13479982","display_name":"Cryptocurrency","level":2,"score":0.8234000205993652},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8138999938964844},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5954999923706055},{"id":"https://openalex.org/C50747538","wikidata":"https://www.wikidata.org/wiki/Q7001032","display_name":"Network forensics","level":3,"score":0.5619000196456909},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.489300012588501},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.4749999940395355},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.35920000076293945},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.29170000553131104},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2815999984741211},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.26649999618530273},{"id":"https://openalex.org/C203062551","wikidata":"https://www.wikidata.org/wiki/Q201339","display_name":"Public-key cryptography","level":3,"score":0.2549999952316284},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2547000050544739}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/access.2026.3682641","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3682641","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:69fc11d9fa9d490a8c4a9ace0b8cae35","is_oa":true,"landing_page_url":"https://doaj.org/article/69fc11d9fa9d490a8c4a9ace0b8cae35","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 14, Pp 55891-55902 (2026)","raw_type":"article"},{"id":"pmh:oai:tkuir.lib.tku.edu.tw:987654321/129192","is_oa":false,"landing_page_url":"https://tkuir.lib.tku.edu.tw/dspace/handle/987654321/129192","pdf_url":null,"source":{"id":"https://openalex.org/S4406922698","display_name":"Tamkang University Institutional Repository (TKUIR)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":{"id":"doi:10.1109/access.2026.3682641","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3682641","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Gender equality","score":0.43452218174934387,"id":"https://metadata.un.org/sdg/5"},{"display_name":"Peace, Justice and strong institutions","score":0.4335991144180298,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G2528869787","display_name":null,"funder_award_id":"114-2221-E-015-001-MY3","funder_id":"https://openalex.org/F4320331164","funder_display_name":"National Science and Technology Council"},{"id":"https://openalex.org/G8674537757","display_name":null,"funder_award_id":"113-2221-E-015-001","funder_id":"https://openalex.org/F4320331164","funder_display_name":"National Science and Technology Council"}],"funders":[{"id":"https://openalex.org/F4320331164","display_name":"National Science and Technology Council","ror":"https://ror.org/00wnb9798"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cryptocurrency-related":[0],"crime":[1],"continues":[2],"to":[3,167],"expand":[4],"worldwide.":[5],"Chainalysis":[6],"reports":[7],"that":[8,70,188,220],"the":[9,116,141,160,168,182,227],"global":[10],"value":[11],"of":[12,133,151,230],"illicit":[13],"cryptocurrency":[14],"transactions":[15],"has":[16],"exceeded":[17],"USD":[18],"50":[19],"billion,":[20],"underscoring":[21],"an":[22,128,137],"urgent":[23],"need":[24],"for":[25,214],"more":[26],"advanced":[27],"digital":[28,215],"forensics.":[29],"Cryptocurrency":[30],"investigations":[31],"are":[32,44],"particularly":[33],"difficult":[34],"when":[35],"critical":[36],"evidence":[37,84],"resides":[38],"in":[39,59,153],"volatile":[40,83],"memory.":[41],"Traditional":[42],"workflows":[43],"time-consuming":[45],"and":[46,93,96,109,178,200,211],"heavily":[47],"manual.":[48],"Cloud-based":[49],"large":[50],"language":[51],"models":[52,224],"(LLMs)":[53],"also":[54,145,218],"pose":[55],"unacceptable":[56],"privacy":[57],"risks":[58],"confidential":[60],"law-enforcement":[61],"investigations.":[62,216],"This":[63],"paper":[64],"presents":[65],"a":[66,74,101,105,110,147,174,208],"multi-layer":[67],"reasoning":[68,99,183],"framework":[69,81,117],"integrates":[71],"LangChain":[72],"with":[73,100],"locally":[75],"deployed":[76],"LLM":[77,190],"(LLaMA":[78],"3.1-8B).":[79],"The":[80,124,204],"acquires":[82],"via":[85,91],"memory":[86,195],"dumping,":[87],"extracts":[88],"forensic":[89,122],"artifacts":[90],"keyword":[92],"regular-expression":[94],"search,":[95],"performs":[97,164],"three-stage":[98],"Single-Layer":[102,142],"Baseline":[103],"Architecture,":[104,108],"Dual-Layer":[106],"Supervisor":[107],"Tri-Layer":[111,125,162],"RAG-Decider":[112],"Architecture.":[113],"We":[114],"evaluate":[115],"on":[118,181],"100":[119],"purpose-built":[120],"crypto-wallet":[121],"questions.":[123],"architecture":[126],"achieves":[127],"average":[129],"human-evaluation":[130],"total":[131],"score":[132,150],"11.29,":[134],"which":[135],"is":[136],"8.9%":[138],"improvement":[139],"over":[140],"baseline.":[143],"It":[144,217],"reaches":[146],"BERT":[148],"F1":[149],"0.84":[152],"automated":[154],"metrics,":[155],"improving":[156],"by":[157],"15.1%.":[158],"Notably,":[159],"local":[161,189,223],"system":[163],"very":[165],"close":[166],"commercial":[169],"cloud":[170],"model":[171],"ChatGPT-4o":[172],"(only":[173],"0.3%":[175],"gap":[176],"overall)":[177],"surpasses":[179],"it":[180],"dimension.":[184],"These":[185],"results":[186],"demonstrate":[187],"deployment":[191],"can":[192,225],"effectively":[193],"support":[194],"forensics":[196],"under":[197],"strict":[198],"confidentiality":[199],"limited":[201],"compute":[202],"resources.":[203],"proposed":[205],"approach":[206,226],"offers":[207],"practical,":[209],"low-cost,":[210],"privacy-preserving":[212],"tool":[213],"shows":[219],"optimized":[221],"lightweight":[222],"analytical":[228],"quality":[229],"cloud-scale":[231],"models.":[232]},"counts_by_year":[],"updated_date":"2026-04-10T06:07:51.998497","created_date":"2026-04-10T00:00:00"}