Given the growing importance of smart contracts in various applications, ensuring their security and reliability is critical. Fuzzing, an effective vulnerability detection technique, has recently been widely applied to smart contracts. Despite numerous studies, a systematic investigation of smart contract fuzzing techniques remains lacking. In this paper, we fill this gap by: 1) providing a comprehensive review of current research in contract fuzzing, and 2) conducting an in-depth empirical study to evaluate state-of-the-art contract fuzzers' usability. To guarantee a fair evaluation, we employ a carefully-labeled benchmark and introduce a set of pragmatic performance metrics, evaluating fuzzers from five complementary perspectives. Based on our findings, we provide direction for the future research and development of contract fuzzers.
The Internet of Things (IoT) has revolutionized industries by enabling the interconnection of devices, creating opportunities for enhanced automation and real-time data analysis. However, the rapid proliferation of IoT devices has introduced significant security vulnerabilities, such as unauthorized access, data manipulation, and privacy breaches. These challenges stem from the inherent limitations of IoT devices, such as low computational power, and the reliance on centralized security models that are susceptible to single points of failure. To address these issues, this paper proposes a Blockchain-Based Secure Framework for IoT devices. Blockchain, a decentralized, immutable, and transparent distributed ledger technology, offers an effective solution for securing IoT networks. By leveraging blockchain's cryptographic features and consensus mechanisms, this framework ensures secure device authentication, data integrity, and transparent communication between IoT devices. Devices can securely authenticate themselves through blockchain-based digital identities, eliminating the need for centralized servers, thus reducing the risk of unauthorized access.Moreover, the framework guarantees data integrity by recording all IoT transactions on the blockchain, making them tamper-proof and verifiable. Blockchain's decentralized nature also mitigates the risk of Distributed Denial of Service (DDoS) attacks by removing central points of vulnerability. Privacy is enhanced through techniques such as zero-knowledge proofs, allowing users to control access to their personal data. This proposed framework not only enhances IoT security but also provides scalability, transparency, and resilience. By combining the strengths of blockchain with IoT, it offers a robust solution for secure, reliable, and privacy-preserving communication in the ever-growing IoT ecosystem. The integration of blockchain technology is poised to transform IoT security, facilitating the secure deployment and management of IoT devices across various industries.
Once deployed in blockchain, smart contracts become immutable: Attackers can exploit bugs and vulnerabilities in their code that cannot be replaced with a bug-free version. For this reason, the verification of smart contracts before they are deployed in blockchain is important. However, the development of verification tools is not easy, especially if one wants to obtain guarantees by using formal methods. This article describes the development, from scratch, of a static analyzer based on abstract interpretation for the verification of real-world Tezos smart contracts. The analyzer is generic with respect to the property under analysis. This article shows taint analysis as a concrete instantiation of the analyzer, at different levels of precision, to detect untrusted cross-contract invocations.
The rapid development of physical device-based data collection in emerging technology needs smart, secure, and intelligent transmission. Cyber physical systems compete with the requirement of intelligent transmission of data. In cyber physical systems, security is a very challenging task due to the heterogeneous connections of devices in real time. This paper proposes a novel methodology for cyber-attack finding in cyber physical systems. The proposed system employed a DNN-deep neural network for the categorization of normal and attack data. The employed deep neural network design for 4 hidden layers for the detection of anomalies. For the secured transmission, we employed the blockchain process in Ethereum. The process of Ethereum generates blocks of blockchain with headers and transmits data over the cyberworld to the physical world with the alteration of data. For the authentication of the projected algorithm tested on two real-time datasets, such as NSL-KDD15 and CIDDS_001. The working of proposed algorithm is very promising in compression of existing algorithms of deep learning like RNN-recurrent neural networks, DBN, and DNN.
As blockchain platforms grow exponentially, millions of lines of smart contract code are being deployed to manage extensive digital assets. However, vulnerabilities in this mission-critical code have led to significant exploitations and asset losses. Thorough automated security analysis of smart contracts is thus imperative. This paper introduces LLM4Fuzz to optimize automated smart contract security analysis by leveraging large language models (LLMs) to intelligently guide and prioritize fuzzing campaigns. While traditional fuzzing suffers from low efficiency in exploring the vast state space, LLM4Fuzz employs LLMs to direct fuzzers towards high-value code regions and input sequences more likely to trigger vulnerabilities. Additionally, LLM4Fuzz can leverage LLMs to guide fuzzers based on user-defined invariants, reducing blind exploration overhead. Evaluations of LLM4Fuzz on real-world DeFi projects show substantial gains in efficiency, coverage, and vulnerability detection compared to baseline fuzzing. LLM4Fuzz also uncovered five critical vulnerabilities that can lead to a loss of more than $247k.
Bhupendra Acharya, Muhammad Saad, Antonio Emanuele Ciná, Lea Schönherr · 8 authors
The mainstream adoption of cryptocurrencies has led to a surge in wallet-related issues reported by ordinary users on social media platforms. In parallel, there is an increase in an emerging fraud trend called cryptocurrency-based technical support scam, in which fraudsters offer fake wallet recovery services and target users experiencing wallet-related issues.In this paper, we perform a comprehensive study of cryptocurrency-based technical support scams. We present an analysis apparatus called HoneyTweet to analyze this kind of scam. Through HoneyTweet, we lure over 9K scammers by posting 25K fake wallet support tweets (so-called honey tweets). We then deploy automated systems to interact with scammers to analyze their modus operandi. In our experiments, we observe that scammers use Twitter as a starting point for the scam, after which they pivot to other communication channels (e.g., email, Instagram, or Telegram) to complete the fraud activity. We track scammers across those communication channels and bait them into revealing their payment methods. Based on the modes of payment, we uncover two categories of scammers that either request secret key phrase submissions from their victims or direct payments to their digital wallets. Furthermore, we obtain scam confirmation by deploying honey wallet addresses and validating private key theft. We also collaborate with the prominent payment service provider by sharing scammer data collections. The payment service provider feedback was consistent with our findings, thereby supporting our methodology and results. By consolidating our analysis across various vantage points, we provide an end-to-end scam lifecycle analysis and propose recommendations for scam mitigation.
Pengcheng Xia, Yu Zhou, Kailong Wang, Kai Ma · 9 authors
The dark web has emerged as the state-of-the-art solution for enhanced anonymity. Just like a double-edged sword, it also inadvertently becomes the safety net and breeding ground for illicit activities. Among them, cryptocurrencies have been prevalently abused to receive illicit income while evading regulations. Despite the continuing efforts to combat illicit activities, there is still a lack of an in-depth understanding regarding the characteristics and dynamics of cryptocurrency abuses on the dark web. In this work, we conduct a multi-dimensional and systematic study to track cryptocurrency-related illicit activities and campaigns on the dark web. We first harvest a dataset of 4,923 cryptocurrency-related onion sites with over 130K pages. Then, we detect and extract the illicit blockchain transactions to characterize the cryptocurrency abuses, targeting features from single/clustered addresses and illicit campaigns. Throughout our study, we have identified 2,564 illicit sites with 1,189 illicit blockchain addresses, which account for 90.8 BTC in revenue. Based on their inner connections, we further identify 66 campaigns behind them. Our exploration suggests that illicit activities on the dark web have strong correlations, which can guide us to identify new illicit blockchain addresses and onions, and raise alarms at the early stage of their deployment.
Smart contracts are computer programs that run on a blockchain. As the functions implemented by smart contracts become increasingly complex, the number of cross-contract interactions within them also rises. Consequently, the combinatorial explosion of transaction sequences poses a significant challenge for smart contract security vulnerability detection. Existing static analysis-based methods for detecting cross-contract vulnerabilities suffer from high false-positive rates and cannot generate test cases, while fuzz testing-based methods exhibit low code coverage and may not accurately detect security vulnerabilities. The goal of this paper is to address the above limitations and efficiently detect cross-contract vulnerabilities. To achieve this goal, we present CrossFuzz, a fuzz testing-based method for detecting cross-contract vulnerabilities. First, CrossFuzz generates parameters of constructors by tracing data propagation paths. Then, it collects inter-contract data flow information. Finally, CrossFuzz optimizes mutation strategies for transaction sequences based on inter-contract data flow information to improve the performance of fuzz testing. We implemented CrossFuzz, which is an extension of ConFuzzius, and conducted experiments on a real-world dataset containing 396 smart contracts. The results show that CrossFuzz outperforms xFuzz, a fuzz testing-based tool optimized for cross-contract vulnerability detection, with a 10.58% increase in bytecode coverage. Furthermore, CrossFuzz detects 1.82 times more security vulnerabilities than ConFuzzius. Our method utilizes data flow information to optimize mutation strategies. It significantly improves the efficiency of fuzz testing for detecting cross-contract vulnerabilities.
Vulnerabilities in smart contracts may trigger serious security events, and the detection of smart contract vulnerabilities has become a significant problem. In this paper, to solve the limitations of current deep learning-based vulnerability detection methods in extracting various code critical features, using the multi-scale cascade encoder architecture as the backbone, we propose a novel Multi-Scale Encoder Vulnerability Detection (MEVD) approach to hit well-known high-risk vulnerabilities in smart contracts. Firstly, we use the gating mechanism to design a unique Surface Feature Encoder (SFE) to enrich the semantic information of code features. Then, by combining a Base Transformer Encoder (BTE) and a Detail CNN Encoder (DCE), we introduce a dual-branch encoder to capture the global structure and local detail features of the smart contract code, respectively. Finally, to focus the model’s attention on vulnerability-related characteristics, we employ the Deep Residual Shrinkage Network (DRSN). Experimental results on three types of high-risk vulnerability datasets demonstrate performance compared to state-of-the-art methods, and our method achieves an average detection accuracy of 90%.
Shereen Ismail, Salah Dandan, Diana W. Dawoud, Hassan Reza
The security of Industrial Supply Chain (ISC) has emerged through the integration of Industrial Internet of Things (IIoT) and Blockchain (BC) technology. This new era involves effectively protecting IIoT systems from various threats and ensuring their smooth operation and resilience against potential cyber-attacks. Within the ISC ecosystem, combining machine learning (ML)-based security models for cyber-attack detection can play a crucial role in enhancing the ISC security and proactively identifying potential threats. This paper presents a BC-enabled ISC that embed ML security model integrated within a multi-layered approach. We conducted a comparative study and performance analysis of several ML classification techniques, with a focus on supervised methods to identify the lightweight model for cyber-attack detection suitable for deployment in resource-constrained IIoT environment. We investigate the performance of Gaussian Naive Bayes (NB), K-Nearest Neighbors (KNN), Random Forest (RF), Decision Tree (DT), and three ensemble techniques, namely Bagging, Stacking, and Boosting. The study employs the WUSTL-IIOT-2021 imbalanced dataset, which contains samples representing four types of attacks, including denial of service (DoS), SQL injection, reconnaissance, and backdoor. The paper addresses the imbalance in class representation by customizing the dataset for training and testing the ML models. Both Mutual Information (MI) and Extra-trees (ET) are applied as a one-stage ensemble feature selection. The performance of the ML models are investigated using classification accuracy (Acc), precision, recall, F1 score, Matthews correlation coefficient (MCC), model size (Mem), training time (TT) and prediction time (PT).
Ananda Ravuri, M. Sadish Sendil, Moshe Rani, A. Srikanth · 7 authors
Protection of the Internet of Things (IoT) has become a significant concern due to the widespread use of IoT technologies. Conventional Intrusion Detection Systems (IDS) have challenges when used in IoT networks because of resource restrictions and complexities. Blockchain Technology (BCT) has significantly altered organizations' financial behavior and effectiveness in recent years. Data security and system stability are crucial concerns that must be tackled in blockchain systems. The study suggests a mechanism called Deep Blockchain-Enabled Collaborative Anomaly Detection (DBC-CAD) for security-focused distributed Anomaly Detection (AD) and privacy-focused BC with smart contracts in IoT networks. A Modified - Long Short-Term Memory (M-LSTM) based Deep Learning (DL) algorithm with a multi-variable optimization approach has been used for the AD approach. The multi-variable optimization technique has been used to set the hyperparameters. The Ethereum framework creates privacy-focused BC and smart contract techniques that safeguard decentralized AD engines. The proposed M-LSTM model has the highest detection rate of 99.1%. The findings show the effectiveness of the proposed systems in identifying assaults on IoT networks.
The present era is witnessing rapid development in the smartphone revolution, where mobile users can access many required services through mobile applications. These services include healthcare, finance, learning, insurance, and the Internet of Things. Android has become the most popular smartphone operating system, and this rapidly increasing adoption of Android has led to a significant increase in the number of malware compared to previous years, resulting in issues related to the insecurity of mobile applications and the violation of their users' privacy. A large role in this mobile phone revolution has been played by the emergence of blockchain technology (BCT), which represents an effective way to develop applications, improve their security, and protect the privacy of their users. The aim of this paper is to design a system architecture for the software and provide a prototype that uses BCT at its core for the purpose of storing and sharing malicious data while also integrating a malicious detection technique. We employed the design science research approach to guide our project. Through this approach, we successfully integrated a malware detection technique with BCT in an Android application, resulting in a decentralized feature that enables peers to add and share malware data. Furthermore, we have developed an easy-to-use interface that allows users to interact with the blockchain in the Android application. This interface displays the results of the malware signature detection algorithm and enables users to take appropriate action if malware is detected. We have employed a design science methodology to develop a software framework, and open-source code meeting the tool's requirements has been provided. Finally, the proposed methodology has been evaluated against the existing methodologies and compared with the other techniques to demonstrate the effectiveness of the blockchain-based detection tools.
Cloud-based deployments face increasing threats from various types of attacks, necessitating robust anomaly detection frameworks to safeguard against potential security breaches. Existing solutions, such as RSSI, GTM, and APG, though effective to a certain extent, exhibit limitations in terms of precision, accuracy, and scalability. To address these shortcomings, this paper proposes a novel anomaly detection framework that integrates multimodal feature analysis, deep learning models, and QoS-aware sidechains to enhance the prediction accuracy of cloud attacks and optimize blockchain-based cloud installations. By maximizing feature variance across different sample types and leveraging advanced deep learning techniques, the proposed approach significantly outperforms conventional methods in terms of precision, accuracy, recall, and AUC performance. Furthermore, the framework demonstrates superior efficiency in block mining delay, energy consumption, and throughput, making it highly suitable for real-time cloud attack prediction scenarios. The proposed methodology represents a significant advancement in anomaly detection and cloud security, offering a comprehensive solution for addressing challenges in blockchain-based cloud deployments. Thus, the proposed anomaly detection framework employs both Deep Learning and Blockchain technologies. Using Recurrent Neural Networks (RNN) with Convolutional Neural Networks (CNN), the system examines system logs and identifies unusual behavior patterns associated with different attacks. Using Blockchain technology, the framework ensures the transparency and integrity of system logs, and Deep Learning models provide precise and timely anomaly detection. The decision to combine Deep Learning and Blockchain technology is justified by the merits of each technique. The distributed, immutable ledger provided by blockchain technology makes it impossible to tamper with system logs and ensures the accuracy of anomaly detection. While, deep learning models, have exceptional pattern recognition abilities and can adapt to changing attack methods, resulting in high precision, accuracy, recall, and AUC metrics. Analyses of experimental data demonstrate that the proposed framework is effective. The framework achieves impressive performance metrics, such as low delays, 98.5% precision, 99.4% accuracy, 98.3% recall, and 99.2% Area Under the Curve (AUC).
Remote attestation (RA) protocols have been widely used to evaluate the integrity of software on remote devices.Currently, the state-of-the-art RA protocols lack a crucial feature: transparency.This means that the details of the final attestation verification are not openly accessible or verifiable by the public.Furthermore, the interactivity of these protocols often limits attestation to trusted parties who possess privileged access to confidential device data, such as pre-shared keys and initial measurements.These constraints impede the widespread adoption of these protocols in various applications.In this paper, we introduce zRA, a non-interactive, transparent, and publicly provable RA protocol based on zkSNARKs.zRA enables verification of device attestations without the need for pre-shared keys or access to confidential data, ensuring a trustless and open attestation process.This eliminates the reliance on online services or secure storage on the verifier side.Moreover, zRA does not impose any additional security assumptions beyond the fundamental cryptographic schemes and the essential trust anchor components on the prover side (i.e., ROM and MPU).The zero-knowledge attestation proofs generated by devices have constant size regardless of the network complexity and number of attestations.Moreover, these proofs do not reveal sensitive information regarding internal states of the device, allowing verification by anyone in a public and auditable manner.We conduct an extensive security analysis and demonstrate scalability of zRA compared to prior work.Our analysis suggests that zRA excels especially in peer-to-peer and Pub/Sub network structures.To validate the practicality, we implement an open-source prototype of zRA using the Circom language.We show that zRA can be securely deployed on public permissionless blockchains, serving as an archival platform for attestation data to achieve resilience against DoS attacks.
Cryptocurrencies are crucial in modern commerce and finance, whether at the national, corporate, or individual level. They serve as fundamental currencies for buying and selling, enabling various business transactions. However, the rise of cybercrime has brought about concerns regarding their operations, potential breaches in encrypted currencies, and the security systems managing them. The frequency of attack tactics and the motivation of attackers seeking financial gain are well-known. Many cryptocurrencies lack the necessary algorithms, techniques, and knowledge to effectively detect and mitigate malware, making them vulnerable targets for hackers. In this study, machine learning techniques are employed to detect malicious code in digital currencies. Additionally, a comparison of these techniques is conducted to determine the most suitable algorithm and technology, Furthermore, this study highlights the importance of effective malware detection in securing cryptocurrencies. Three datasets of different sizes were used, each yielding distinct results based on dataset size. The AdaBoost model demonstrated superior performance when applied to the short dataset, while the decision tree model performed best with the medium-sized dataset. Conversely, the Naive Bayes model consistently produced the worst results, while the large-size KNN model achieved the highest performance.
The advent of Blockchain and its subsequent application in creating Bitcoin has changed the world of finance. The peer-to-peer Blockchain networks, lack a third-party intermediary authority to regulate the transactions, making it vulnerable to various forms of stings. One of the most proliferate uses of crypto transactions is for the ransom payment made by victims of ransomware attacks. Owing to the varied nature of the ransomware attacks, coupled with the decentralized nature of Blockchain, tracking and guarding against such attacks is still a challenge. One way to prevent ransomware attackers from easily benefitting from such crypto transactions is to identify them and avert any payment to those attackers. In this paper, the impact of three ensemble classification algorithms – Random Forest, XGBoost and Balanced Bagging are studied to correctly classify ransomware payments from existing Bitcoin transaction data, to identify the attackers’ addresses and possibly suspend them from taking part in any transactions. The outcomes of the three algorithms are compared with each other based on various indicators. From the experimental results, it could be concluded that Balanced Bagging Classifier demonstrated better performance with an accuracy of 98.41%.
Ho-Won Lee, Yoon-Young Park, Sungchul Lee, Yoon-Jae Chae
In today’s rapidly evolving digital landscape, ensuring data integrity is paramount for maintaining the security and reliability of applications. This paper introduces the Application Integrity Assurance System (AIAS), a novel solution designed to enhance data integrity through the integration of Ethereum blockchain technology. AIAS leverages smart contracts and the Interplanetary File System (IPFS) to securely store and verify application manifests. By decentralizing the integrity assurance process, AIAS mitigates the risks associated with tampering and unauthorized modifications, providing a robust framework for maintaining data integrity in various application environments. The system has been prototyped and tested on an augmented reality platform, demonstrating its practical application and efficiency. The AIAS framework offers a cost-effective, infrastructure-free solution for safeguarding application integrity, making it an essential tool for platforms that demand high standards of data integrity and security.
In recent years, Ethereum, which is a leading application for realizing blockchain services, has received much attention for its usability and functionality. Ethereum executes smart contracts and arbitrary programmable calculations, in addition to cryptocurrency trading. However, cyberattacks target misconfigured Ethereum clients with application programming interface (API) enabled, specifically JSON-RPC. Herein, we propose EtherWatch, a framework to detect and analyze malicious and/or suspicious Ethereum accounts using three data sources (a honeypot, an internet-wide scanner, and a blockchain explorer). The honeypot, named Etherpot, leverages a proxy server placed between a real Ethereum client and the internet. It modifies client responses to attract attackers, identifies malicious accounts, and analyzes their behaviors. Using scan results from Shodan, we also detect suspicious Ethereum accounts registered on multiple nodes. Finally, we utilize Etherscan, a well-known blockchain explorer, to track and analyze the activities of the detected accounts. During six weeks of observations, we discovered 538 hosts attempting to call JSON-RPC of our honeypots using 41 types of methods, including a type of unreported attack in the wild. Specifically, we observed account hijacking, mining, and smart contract attacks. We detected 16 malicious accounts using the honeypots and 64 suspicious accounts from the Shodan scan results, with five overlapping accounts. Finally, from Etherscan, we collected records of activities related to the detected accounts, including transactions of 21.50 ETH and mining of 22.61 ETH (equivalent to 39,494 US$ and 41,533 US$, respectively, as of June 9, 2023).