Adrian Petcu, Bogdan Pahonțu, Mădălin Frunzete, Dan Alexandru Stoichescu
Over the past decade, there has been significant evolution in the security field, specifically in the authentication and authorization part. The standard authentication protocol nowadays is OAuth 2.0-based authentication. This method relies on a third-party authentication service provider with complete control over the users’ data, which it can filter or modify at will. Blockchain and decentralization have generated much interest in recent years, and the decentralized web is considered the next significant improvement in the world wide web (also known as Web 3.0). Web3 authentication, also known as decentralized authentication, allows for the secure and decentralized authentication of users on the web. The use cases for this technology include online marketplaces, social media platforms, and other online communities that require user authentication. The advantages of Web3 authentication include increased security and privacy for users and the ability for users to have more control over their data. The proposed system implementation uses Ethereum as the blockchain and a modern web stack to enhance user interaction and usability. The solution brings benefits both to the private and the public sector, proving that it has the capability of becoming the preferred authentication mechanism for any decentralized web application.
Khandaker Mohammad Mohi Uddin, Sadia Mahamuda, Sikder Sajib Al Shahriar, Md. Ashraf Uddin
In recent times, various forms of crime have been happening worldwide.The law-and-order department of any country officially records a crime in electronic forms or on paper when the crime is reported by a victim or someone on behalf of the victim.The document that is prepared to file any perceptible committed crimes including dowry, kidnap, murder, rape, theft, and others is called First Information Report(FIR).Nowadays, online FIR also known as e-FIR has been used worldwide.Every day a number of e-FIR are filed, and they are maintained in a centralized database with the aid of third-party trust.Consequently, malicious entities including insiders and outsiders' dishonest personnel, and third-party authorities may tamper with e-FIR that questions the transparency and integrity of FIR reports.To address this exposure, in this paper, we propose a blockchain based FIR system to store all kinds of offense-related records to assure security, fidelity and privacy of FIR records.In this proposed system, the blockchain technology that refers to a decentralized and distributed ledger across peer-to-peer networks continually updates the shared ledger and strictly maintains synchronization among all network nodes.Though blockchain technology guarantees tamper-proof of the data, it cannot store a large amount of data due to the replication of ledger among all network nodes.To solve this issue, we adopt the Inter-Planetary File system (IPFS) protocol to store data in the blockchain.IPFS is a distributed file-sharing system that can be leveraged to store and share large files.The blockchain based FIR system has been tested on an Ethereum environment using blockchain and IPFS technology.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
In crowdsourcing systems, requesters publish tasks, and interested workers provide answers to get rewards. Worker anonymity motivates participation since it protects their privacy. Anonymity with unlinkability is an enhanced version of anonymity because it makes it impossible to ``link'' workers across the tasks they participate in. Another core feature of crowdsourcing systems is worker quality which expresses a worker's trustworthiness and quantifies their historical performance. Notably, worker quality depends on the participation history, revealing information about it, while unlinkability aims to disassociate the workers' identities from their past activity. In this work, we present AVeCQ, the first crowdsourcing system that reconciles these properties, achieving enhanced anonymity and verifiable worker quality updates. AVeCQ relies on a suite of cryptographic tools, such as zero-knowledge proofs, to (i) guarantee workers' privacy, (ii) prove the correctness of worker quality scores and task answers, and (iii) commensurate payments. AVeCQ is developed modularly, where the requesters and workers communicate over a platform that supports pseudonymity, information logging, and payments. In order to compare AVeCQ with the state-of-the-art, we prototype it over Ethereum. AVeCQ outperforms the state-of-the-art in three popular crowdsourcing tasks (image annotation, average review, and Gallup polls). For instance, for an Average Review task with $5$ choices and $128$ participating workers AVeCQ is 40\% faster (including overhead to compute and verify the necessary proofs and blockchain transaction processing time) with the task's requester consuming 87\% fewer gas units.
Decentralized video sharing structures are much like video sharing structures wherein creators post content material and customers view it. However, the primary distinction lies withinside the community in the back of the decentralized video sharing platform. A peer-to-peer (P2P) community of decentralized video sharing structures helps the steady switch of files. To make sure speedy facts switch, facts is break up into smaller blocks for less complicated switch and download, making sure quicker downloads and browsing. The decentralized video sharing platform transfers facts over a P2P community, however with an extra layer of blockchain era encryption. Less operational value, higher fault tolerance, much less consider necessities among garage carriers and facts owners, and much less vulnerability to attacks. An occasion in blockchain era has delivered a decentralized garage mode to the public. Video transcoding is extensively carried out in video streaming commerce, changing films into a couple of codecs for extraordinary audiences.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Purpose- The aim of this study is to reveal the publications that shed light on the dark side of the cryptocurrency markets with a systematic approach. Methodology- For this purpose, 369 publications in the Scopus database between 2014-2022 were determined as samples. In the publications provided by the database, the keywords "cryptocurrency" and "fraud", "scam", "phishing", "ponzi", "crime" were scanned over the publication title, abstract and keywords, and an integrated bibliometric analysis was employed. The R program was used in the analysis, and the "Biblioshiny" application in the RStudio program was employed to visualize the findings. Findings- The analysis reveals that the number of publications, the number of citations and the interest in the field have increased especially in recent years. The rate of increase in the number of publications in the field and the fact that most of these publications are at the stage of notification have shown that the field is an important developing field. The most intense interest in the field has been shown from universities in China. On the other hand, it was seen that the most interest in the field was from computer sciences and the interest of journals in the field of finance remained weak. It has been determined that the topics that may attract attention in the future are digital forensics, digital assets, fraudulent cryptocurrencies, corruption prevention, mining and cyber attacks. Conclusion- The study reveals the evolution of the dark side of cryptocurrency markets in academic research. The findings provide researchers interested in the field with the opportunity to explore themes and issues that may be on the agenda in the future. Keywords: Cryptocurrency, fraud, ponzi, crime, bibliometric analysis JEL Codes: G11, G19
As smart contracts process digital assets, their security is essential for blockchain applications. Many approaches have been proposed to detect smart contract vulnerabilities. Studies show that few of the reported vulnerabilities are exploited and hypothesize that many of the reported vulnerabilities are false positives. However, no follow-up study is performed to confirm the hypothesis and understand why the reported vulnerabilities are not exploited. In this study, we first collect 136,969 unique real-world smart contracts and analyze them using four vulnerability detectors, namely Oyente, SmartCheck, Slither, and SolDetector. Then, we apply Strauss’ grounded theory approach to manually analyze the source code of the smart contracts reported as vulnerable to recognizing false positives and understand the reasons for false results. In addition, we analyze the transaction logs of the smart contracts reported as vulnerable to identifying and understanding their exploitations. Our results show that 75.37% of the 4,364 smart contracts reported as vulnerable are false positives, and eleven reasons are causing the false positives. After analyzing the 4,106,134 transaction logs of the contracts reported as vulnerable, we find that vulnerabilities of only 67 (0.015%) of the contracts have been exploited in history. We also identify six reasons for demotivating and preventing the attackers from exploiting the vulnerabilities. Our results reveal that state-of-the-art smart contract vulnerability detectors primarily treat the smart contracts as yet another application developed using Object Oriented (OO) languages when analyzing and reporting the smart contract vulnerabilities. Without considering the specific design principles of the Solidity programming language and the characteristics of smart contracts’ application scenarios and execution environments, many of the reported vulnerabilities are not exploitable or not cost-effective to be exploited by adversaries.
Hanna Kim, Jian Cui, Eugene Jang, Chanhee Lee · 7 authors
As Non-Fungible Tokens (NFTs) continue to grow in popularity, NFT users have become targets of phishing attacks by cybercriminals, called \textit{NFT drainers}. Over the last year, \$100 million worth of NFTs were stolen by drainers, and their presence remains a serious threat to the NFT trading space. However, no work has yet comprehensively investigated the behaviors of drainers in the NFT ecosystem. In this paper, we present the first study on the trading behavior of NFT drainers and introduce the first dedicated NFT drainer detection system. We collect 127M NFT transaction data from the Ethereum blockchain and 1,135 drainer accounts from five sources for the year 2022. We find that drainers exhibit significantly different transactional and social contexts from those of regular users. With these insights, we design \textit{DRAINCLoG}, an automatic drainer detection system utilizing Graph Neural Networks. This system effectively captures the multifaceted web of interactions within the NFT space through two distinct graphs: the NFT-User graph for transaction contexts and the User graph for social contexts. Evaluations using real-world NFT transaction data underscore the robustness and precision of our model. Additionally, we analyze the security of \textit{DRAINCLoG} under a wide variety of evasion attacks.
Sayak Saha Roy, Dipanjan Das, Priyanka Bose, Christopher Kruegel · 6 authors
The rapid growth in popularity and hype surrounding digital assets such as art, video, and music in the form of non-fungible tokens (NFTs) has made them a lucrative investment opportunity, with NFT-based sales surpassing $25B in 2021 alone. However, the volatility and general lack of technical understanding of the NFT ecosystem have led to the spread of various scams. The success of an NFT heavily depends on its online virality. As a result, creators use dedicated promotion services to drive engagement to their projects on social media websites, such as Twitter. However, these services are also utilized by scammers to promote fraudulent projects that attempt to steal users' cryptocurrency assets, thus posing a major threat to the ecosystem of NFT sales. In this paper, we conduct a longitudinal study of 439 promotion services (accounts) on Twitter that have collectively promoted 823 unique NFT projects through giveaway competitions over a period of two months. Our findings reveal that more than 36% of these projects were fraudulent, comprising of phishing, rug pull, and pre-mint scams. We also found that a majority of accounts engaging with these promotions (including those for fraudulent NFT projects) are bots that artificially inflate the popularity of the fraudulent NFT collections by increasing their likes, followers, and retweet counts. This manipulation results in significant engagement from real users, who then invest in these scams. We also identify several shortcomings in existing anti-scam measures, such as blocklists, browser protection tools, and domain hosting services, in detecting NFT-based scams. We utilize our findings to develop and open-source a machine learning classifier tool that was able to proactively detect 382 new fraudulent NFT projects on Twitter.
With the increase of the adoption of blockchain technology in providing decentralized solutions to various problems, smart contracts have become more popular to the point that billions of US Dollars are currently exchanged every day through such technology. Meanwhile, various vulnerabilities in smart contracts have been exploited by attackers to steal cryptocurrencies worth millions of dollars. The automatic detection of smart contract vulnerabilities therefore is an essential research problem. Existing solutions to this problem particularly rely on human experts to define features or different rules to detect vulnerabilities. However, this often causes many vulnerabilities to be ignored, and they are inefficient in detecting new vulnerabilities. In this study, to overcome such challenges, we propose a framework to automatically detect vulnerabilities in smart contracts on the blockchain. More specifically, first, we utilize novel feature vector generation techniques from bytecode of smart contract as source code is rarely publicly available. These feature vectors are then analyzed using our innovative metric learning-based Deep Neural Networks (DNNs) to produce detection results. The framework’s predictions are further refined through a voting mechanism to achieve consensus. We conduct comprehensive experiments on large-scale benchmarks, and the quantitative results demonstrate the effectiveness and efficiency of our approach.
With the boom of cryptocurrency and its concomitant financial risk concerns, detecting fraudulent behaviors and associated malicious addresses has been drawing significant research effort. Most existing studies, however, rely on the full history features or full-fledged address transaction networks, both of which are unavailable in the problem of early malicious address detection and therefore failing them for the task. To detect fraudulent behaviors of malicious addresses in the early stage, we present Evolve Path Tracer, which consists of Evolve Path Encoder LSTM, Evolve Path Graph GCN, and Hierarchical Survival Predictor. Specifically, in addition to the general address features, we propose Asset Transfer Paths and corresponding path graphs to characterize early transaction patterns. Furthermore, since transaction patterns change rapidly in the early stage, we propose Evolve Path Encoder LSTM and Evolve Path Graph GCN to encode asset transfer path and path graph under an evolving structure setting. Hierarchical Survival Predictor then predicts addresses' labels with high scalability and efficiency. We investigate the effectiveness and generalizability of Evolve Path Tracer on three real-world malicious address datasets. Our experimental results demonstrate that Evolve Path Tracer outperforms the state-of-the-art methods. Extensive scalability experiments demonstrate the model's adaptivity under a dynamic prediction setting.
Blockchain technology has been successfully exploited for deploying new economic applications. However, it has started arousing the interest of malicious actors who deliver scams to deceive honest users and to gain economic advantages. Ponzi schemes are one of the most common scams. Here, we present a classifier for detecting smart Ponzi contracts on Ethereum, which can be used as the backbone for developing detection tools. First, we release a labelled data set with 4422 unique real-world smart contracts to address the problem of the unavailability of labelled data. Then, we show that our classifier outperforms the ones proposed in the literature when considering the AUC as a metric. Finally, we identify a small and effective set of features that ensures a good classification quality and investigate their impacts on the classification using eXplainable AI techniques.
Abstract For a long time, anomaly detection is such a well topic. Its use in the banking industry has aided in the detection of questionable hacking activity. In the network of bitcoin, since all nodes are unlabeled, there is no proof that any particular transaction is the result of illegal activity, this thesis seeks to identify transactions that are unusual or suspicious. Finding abnormalities in the bitcoin transaction network is the main objective. We discuss anomaly identification in this paper with particular reference to the Bitcoin transaction network(BTN). In this instance, anomalies behaviors is a proxy for apprehensive activity, thus our objective is to find anomalies in the dataset in terms of their percentage. To achieve this, we use the feature selection method which is sequential forward feature selection along with three ML techniques, k-means clustering, isolation forest, and support vector machine (SVM) and got the highest accuracy of 98.2% in SVM as compared to all other methods.
Consensus algorithms are applied in the context of distributed computer systems to improve their fault tolerance. The explosive development of distributed ledger technology following the proposal of ‘Bitcoin’ led to a sharp increase in research activity in this area. Specifically, public and permissionless networks require robust leader selection strategies resistant to Sybil attacks in which malicious attackers present bogus identities to induce byzantine faults. Our goal is to analyse the entire breadth of works in this area systematically, thereby uncovering trends and research directions regarding Sybil attack resistance in today’s blockchain systems to benefit the designs of the future. Through a systematic literature review, we condense an immense set of research records (N = 21,799) to a relevant subset (N = 483). We categorise these mechanisms by their Sybil attack resistance characteristics, leader selection methodology, and incentive scheme. Mechanisms with strong Sybil attack resistance commonly adopt the principles underlying ‘Proof-of-Work’ or ‘Proof-of-Stake’ while mechanisms with limited resistance often use reputation systems or physical world linking. We find that only a few fundamental paradigms exist that can resist Sybil attacks in a permissionless setting but discover numerous innovative mechanisms that can deliver weaker protection in system scenarios with smaller attack surfaces.
S Sheela, S. Shalini, D Sai Harsha, Vani Chandrashekar · 5 authors
This research introduces an approach to detect malware attacks using blockchain technology that integrates signature-based and behavioralbased methods. The proposed system uses a decentralized blockchain network to share and store malware signatures and behavioral patterns. This enables faster and more efficient detection of new malware files. The signature-based method involves storing the signatures in the blockchain and the sharing of the signature of malware files among the user nodes of the p2p blockchain network, while the behavioral-based approach analyzes the behavior and actions of files in a separate virtualized environment to identify suspicious patterns. This system addresses the limitations of conventional signature-based methods, which can be evaded by polymorphic malware, and behavioral-based methods, which may generate false positives. The results of the evaluation indicate that the proposed system achieves high detection rates while maintaining low false positives. Overall, the proposed system offers an effective and efficient approach to malware detection by utilizing the strengths of both signature-based and behavioral-based methods and utilizing the security and transparency benefits of blockchain technology.
Jaehyeon Kim, Sejong Lee, Yushin Kim, Se-young Ahn · 5 authors
Recently, cybercrimes that exploit the anonymity of blockchain are increasing. They steal blockchain users' assets, threaten the network's reliability, and destabilize the blockchain network. Therefore, it is necessary to detect blockchain cybercriminal accounts to protect users' assets and sustain the blockchain ecosystem. Many studies have been conducted to detect cybercriminal accounts in the blockchain network. They represented blockchain transaction records as homogeneous transaction graphs that have a multi-edge. They also adopted graph learning algorithms to analyze transaction graphs. However, most graph learning algorithms are not efficient in multi-edge graphs, and homogeneous graphs ignore the heterogeneity of the blockchain network. In this paper, we propose a novel heterogeneous graph structure called an account-transaction graph, ATGraph. ATGraph represents a multi-edge as single edges by considering transactions as nodes. It allows graph learning more efficiently by eliminating multi-edges. Moreover, we compare the performance of ATGraph with homogeneous transaction graphs in various graph learning algorithms. The experimental results demonstrate that the detection performance using ATGraph as input outperforms that using homogeneous graphs as the input by up to 0.2 AUROC.
Khaled Almiani, Young Choon Lee, Tawfiq Alrawashdeh, Amirmohammad Pasdar
The usage of blockchain technology has been significantly expanded with smart contracts and blockchainoracles. While smart contracts enables to automate the execution of an agreement between untrusted parties, oracles provide smart contracts with data external to a given blockchain, i.e., off-chain data. However, the validity and accuracy of such off-chain data can be questionable that compromises the transparency and immutability chacteristics of blockchain. Despite many studies on the trustworthiness of blockchain oracles, more precisely, off-chain data, their solutions are often ‘short-sighted’ and dependent on binary decisions. In this paper, we present a novel graph-based profiling method to determine the trustworthiness of blockchain oracles. We construct a graph with oracles as nodes and cumulative average discrepancies of validity and accuracy of data as edge weights. Our profiling method continues to update the graph, edge weights in particular, to distinguish trustworthy oracles. Clearly. this discourages the provision of false and inaccurate data. We have conducted an evaluation study to see the effectiveness of our proposed method, in which we have run the experiments utilizing the Ethereum network. Additionally, we have also calculated the cost of running these experiments. Consequently, our experiment results show that the proposed method achieves around 93% accuracy in identifying the trustworthiness of data sources.
Md. Anisul Islam Mahmud, A. A. Talha Talukder, Arbiya Sultana, Kazi Iftesam Amin Bhuiyan · 7 authors
The growing popularity of online news has prompted concerns regarding (i) the socio-political influence over news dissemination, (ii) the waning freedom of news media, (iii) and a facile news evaluation process. A piece of news having the power to capture a large audience and sow the seed of bizarre consequences on a national scale should be prudently evaluated before reaching the mass. In quest of making a substantial profit, and sometimes due to inevitable socio-political influence, news with biased heading outpours mass media, resulting in ambiguity and mass manipulation. In this paper, we suggest a blockchain, smart contract, and incremental machine learning-based news evaluation procedure for the Bengali language to overcome these challenges. Weighted synthesis of machine classification and human expert opinion in a decentralized platform are synthesized to evaluate news. With continuous data, the Natural Language Processing (NLP) model is incrementally trained, and the best version of the model is used to detect deprived fake news. During experiments, the NLP model with initial training and testing accuracy of 84.94% and 84.99% was increased to 93.75% and 93.80% after nine rounds of incremental model training. On the Ethereum test network, the protocols have been installed and tested. The simulation demonstrates successful implementation of our proposed system.
Electronic Government (e-Government) systems constantly provide greater services to people, businesses, organisations, and societies by offering more information, opportunities, and platforms with the support of advances in information and communications technologies. This usually results in increased system complexity and sensitivity, necessitating stricter security and privacy-protection measures. The majority of the existing e-Government systems are centralised, making them vulnerable to privacy and security threats, in addition to suffering from a single point of failure. This study proposes a decentralised e-Government framework with integrated threat detection features to address the aforementioned challenges. In particular, the privacy and security of the proposed e-Government system are realised by the encryption, validation, and immutable mechanisms provided by Blockchain. The insider and external threats associated with blockchain transactions are minimised by the employment of an artificial immune system, which effectively protects the integrity of the Blockchain. The proposed e-Government system was validated and evaluated by using the framework of Ethereum Visualisations of Interactive, Blockchain, Extended Simulations (i.e. eVIBES simulator) with two publicly available datasets. The experimental results show the efficacy of the proposed framework in that it can mitigate insider and external threats in e-Government systems whilst simultaneously preserving the privacy of information.