Ian W. Gray, Jack Cable, Benjamin P. Brown, Vlad Cuiujuclu · 5 authors
Ransomware operations have evolved from relatively unsophisticated threat actors into highly coordinated cybercrime syndicates that regularly extort millions of dollars in a single attack. Despite dominating headlines and crippling businesses across the globe, there is relatively little in-depth research into the modern structure and economics of ransomware operations.In this paper, we leverage leaked chat messages to provide an in-depth empirical analysis of Conti, one of the largest ransomware groups. By analyzing these chat messages, we construct a picture of Contiâs operations as a highly-profitable business, from profit structures to employee recruitment and roles. We present novel methodologies to trace ransom payments, identifying over $80 million in likely ransom payments to Conti and its predecessor â over five times as much as in previous public datasets. As part of our work, we will publish a dataset of 666 labeled Bitcoin addresses related to Conti and an additional 75 Bitcoin addresses of likely ransom payments. Future work can leverage this case study to more effectively trace â and ultimately counteract â ransomware activity.
Malware detection approaches have been extensively studied for traditional software systems. However, the development of blockchain technology has promoted the birth of a new type of software systemâdecentralized applications. Composed of smart contracts, a type of application that implements the Ponzi scheme logic (called smart Ponzi schemes) has caused irreversible loss and hindered the development of blockchain technology. These smart contracts generally had a short life but involved a large amount of money. Whereas identification of these Ponzi schemes before causing financial loss has been significantly important, existing methods suffer from three main deficiencies, i.e., the insufficient dataset, the reliance on the transaction records, and the low accuracy. In this study, we first build a larger dataset. Then, a large number of features from multiple views, including bytecode, semantic, and developers, are extracted. These features are independent of the transaction records. Furthermore, we leveraged machine learning methods to build our identification model, i.e., Mul ti-view Cas cade Ensemble model (MulCas). The experiment results show that MulCas can achieve higher performance and robustness in the scope of our dataset. Most importantly, the proposed method can identify smart Ponzi scheme at the creation time.
Cryptocurrencies, such as Bitcoin and Ethereum, are becoming increasingly prevalent mainly due to their anonymity, decentralization, transparency, and security. However, the completely public ledger makes the trace and analysis of each account possible as long as the identity behind the public address is revealed. Theoretically, social networks could make that happen when addresses are posted on social network platforms using accounts containing personal information. To verify such a possibility, we have collected public data from two major platforms, i.e. Twitter and Reddit, aiming to find potential privacy leakage behind the ETH public address. In the end, an easy-to-use retrieval application is also built for a better illustration.
Jiho Choi, Junghoon Park, Woocheol Kim, JinâHyeok Park · 6 authors
The recent advent of play-to-earn (P2E) systems in massively multiplayer online role-playing games (MMORPGs) has made in-game goods interchangeable with real-world values more than ever before. The goods in the P2E MMORPGs can be directly exchanged with cryptocurrencies such as Bitcoin, Ethereum, or Klaytn via blockchain networks. Unlike traditional in-game goods, once they had been written to the blockchains, P2E goods cannot be restored by the game operation teams even with chargeback fraud such as payment fraud, cancellation, or refund. To tackle the problem, we propose a novel chargeback fraud prediction method, PU GNN, which leverages graph attention networks with PU loss to capture both the players' in-game behavior with P2E token transaction patterns. With the adoption of modified GraphSMOTE, the proposed model handles the imbalanced distribution of labels in chargeback fraud datasets. The conducted experiments on three real-world P2E MMORPG datasets demonstrate that PU GNN achieves superior performances over previously suggested methods.
Emotions form an essential and fundamental aspect of our lives. What we do and say reflects some of our feelings in some way, though not directly. We must examine these feelings using emotional data, also known as affect data, to comprehend a person's basic behavior. Text, voice, facial expressions, and other data types can be included. Since social networking websites have become so popular, many individuals have started reading the material on these numerous sites.Twitter is one of these social networking sites. People's feelings and thoughts about a subject reveal positive, negative, and neutral emotional values. Doing sentiment analysis on Twitter is a very important and challenging task. In this study, we aim to investigate the sentiments of Bitcoin and provide an overview of its effect on the value of Bitcoin by utilizing the power of deep learning architectures and machine learning methods. The study collected tweets in English shared on Twitter between December 12, 2021, and March 13, 2022. First, people's feelings about Bitcoin were assessed using TextBlob, a natural language processing (NLP) tool. Then, it was done using basic machine learning algorithms for sentiment classification and CNN, LSTM, and BiLSTM deep learning architectures that we modeled. However, deep learning models were tested separately with the TF-IDF and Glove word embedding approaches. Experimental results prove the success of deep learning architectures using the Glove word embedding approach.
With the blooming of blockchain-based smart contracts in decentralized applications, the security problem of smart contracts has become a critical issue, as vulnerable contracts have resulted in severe financial losses. Existing research works have explored vulnerability detection methods based on fuzzing, symbolic execution, formal verification, and static analysis. In this paper, we propose two static analysis approaches called ASGVulDetector and BASGVulDetector for detecting vulnerabilities in Ethereum smart contacts from source-code and bytecode perspectives, respectively. First, we design a novel intermediate representation called abstract semantic graph (ASG) to capture both syntactic and semantic features from the program. ASG is based on syntax information but enriched by code structures, such as control flow and data flow. Then, we apply two different training models, i.e., graph neural network (GNN) and graph matching network (GMN), to learn the embedding of ASG and measure the similarity of the contract pairs. In this way, vulnerable smart contracts can be identified by calculating the similarity to labeled ones. We conduct extensive experiments to evaluate the superiority of our approaches to state-of-the-art competitors. Specifically, ASGVulDetector improves the best of three source-code-only static analysis tools (i.e., SmartCheck, Slither, and DR-GCN) regarding the F1 score by 12.6% on average, while BASGVulDetector improves that of the three detection tools supporting bytecode (i.e., ContractFuzzer, Oyente, and Securify) regarding the F1 score by 25.6% on average. We also investigate the effectiveness and advantages of the GMN model for detecting vulnerabilities in smart contracts.
Prof. Sumit Shevtekar, Ajay Raut, Pranit Chaudhari
People no longer trust charities as a result of the lack of openness, which has caused social investment to stagnate. The donor is unaware of how his money is being used legally. Mistrust of the donor is increased by corruption. In this study, a decentralised network named Charity-Chain that is based on the Ethereum blockchain is proposed. By employing smart contract-based incentives to ensure that their impact is independently validated and available to everyone, it aids social organisations in managing initiatives transparently. For funders (philanthropic organisations, impact investors, and small donors), this makes it much simpler for them to monitor their transactions and, as a result, restore their trust in funding these types of social organisations.
Smart contracts are increasingly used with blockchain systems for high-value applications. It is highly desired to ensure the quality of smart contract source code before they are deployed. This paper proposes a new deep learning-based tool, MANDO-GURU, that aims to accurately detect vulnerabilities in smart contracts at both coarse-grained contract-level and fine-grained line-level. Using a combination of control-flow graphs and call graphs of Solidity code, we design new heterogeneous graph attention neural networks to encode more structural and potentially semantic relations among different types of nodes and edges of such graphs and use the encoded embeddings of the graphs and nodes to detect vulnerabilities. Our validation of real-world smart contract datasets shows that MANDO-GURU can significantly improve many other vulnerability detection techniques by up to 24% in terms of the F1-score at the contract level, depending on vulnerability types. It is the first learning-based tool for Ethereum smart contracts that identify vulnerabilities at the line level and significantly improves the traditional code analysis-based techniques by up to 63.4%. Our tool is publicly available at https://github.com/MANDO-Project/ge-sc-machine. A test version is currently deployed at http://mandoguru.com, and a demo video of our tool is available at http://mandoguru.com/demo-video.
Cryptocurrencies have the potential to enable socioeconomic growth throughout the world by offering easier access to capital and financial services. However, many virtual asset service providers (VASPs) that offer cryptocurrency services lack identity management and can be accessed anonymously, which has led to their services being exploited by criminal activities such as money laundering and illegal foreign exchange. Such crimes have a negative impact on socioeconomic sustainability. Building identity systems on blockchains can help VASPs improve their identity management to combat cryptocurrency-based crimes so VASPs can better serve the social economy and achieve their sustainability goals. However, existing solutions have privacy problems because the identity provider can associate usersâ identities with their wallet accounts. In addition, there is currently no solution that can support all public blockchains unconditionally, as current solutions can only support EVM-compliant blockchains or require additional work to support new blockchains. This article proposes a KYC (know your customer)-compliant identity scheme based on Ethereum using Merkle trees and smart contracts. The identity and wallet accounts are linked by the user rather than the KYC provider so, in general, no one but the user knows the association between the wallet accounts and the identity, which protects privacy. For suspicious accounts, supervisors can trace their identities and thus achieve supervision. In addition, the scheme supports identifying accounts on all public blockchains by using Merkle trees and smart contracts to bind accounts on multiple blockchains to one identity and no extra work is required. Moreover, the scheme supports users to prove that their attributes meet the requirements of VASPs by adopting the BBS+ signature and the Sigma protocol.
With the development of Web 3.0 which emphasizes decentralization, blockchain technology ushers in its revolution and also brings numerous challenges, particularly in the field of cryptocurrency. Recently, a large number of criminal behaviors continuously emerge on blockchain, such as Ponzi schemes and phishing scams, which severely endanger decentralized finance. Existing graph-based abnormal behavior detection methods on blockchain usually focus on constructing homogeneous transaction graphs without distinguishing the heterogeneity of nodes and edges, resulting in partial loss of transaction pattern information. Although existing heterogeneous modeling methods can depict richer information through metapaths, the extracted metapaths generally neglect temporal dependencies between entities and do not reflect real behavior. In this paper, we introduce Time-aware Metapath Feature Augmentation (TMFAug) as a plug-and-play module to capture the real metapath-based transaction patterns during Ponzi scheme detection on Ethereum. The proposed module can be adaptively combined with existing graph-based Ponzi detection methods. Extensive experimental results show that our TMFAug can help existing Ponzi detection methods achieve significant performance improvements on the Ethereum dataset, indicating the effectiveness of heterogeneous temporal information for Ponzi scheme detection.
Smart contracts running on public blockchains are permissionless and decentralized, attracting both developers and malicious participants. Ethereum, the worldâs largest decentralized application platform on which more than 40 million smart contracts are running, is frequently challenged by smart contract vulnerabilities. Whatâs worse, since the homogeneity of a wide range of smart contracts and the increase in inter-contract dependencies, a vulnerability in a certain smart contract could affect a large number of other contracts in Ethereum. However, little is known about how vulnerable contracts affect other on-chain contracts and which contracts can be affected. Thus, we first present the contract dependency graph (CDG) to perform a vulnerability analysis for Ethereum smart contracts, where CDG characterizes inter-contract dependencies formed by DELEGATECALL-type internal transaction in Ethereum. Then, three generic definitions of security violations against CDG are given for finding respective potential victim contracts affected by different types of vulnerable contracts. Further, we construct the CDG with 195,247 smart contracts active in the latest blocks of the Ethereum and verify the above security violations against CDG by detecting three representative known vulnerabilities. Compared to previous large-scale vulnerability analysis, our analysis scheme marks potential victim contracts that can be affected by different types of vulnerable contracts, and identify their possible risks based on the type of security violation actually occurring. The analysis results show that the proportion of potential victim contracts reaches 14.7%, far more than that of corresponding vulnerable contracts (less than 0.02%) in CDG.
Bitcoin is the most common cryptocurrency involved in cyber scams. Cybercriminals often utilize pseudonymity and privacy protection mechanism associated with Bitcoin transactions to make their scams virtually untraceable. The Ponzi scheme has attracted particularly significant attention among the Bitcoin fraudulent activities. This paper considers a multi-class classification problem to determine whether a transaction is involved in Ponzi schemes or other cyber scams, or is a non-scam transaction. We design a specifically designed crawler to collect data and propose a novel Attention-based Long Short-Term Memory (A-LSTM) method for the classification problem. The experimental results show that the proposed model has better efficiency and accuracy than existing approaches, including Random Forest, Extra Trees, Gradient Boosting, and classical LSTM. With correctly identified scam features, our proposed A-LSTM achieves an F1-score over 82% for the original data and outperforms the existing approaches.
Rickard Elsen, Muhammad Rikza Nashrulloh, Ade Sutedi
Since the widespread use of cryptocurrency, blockchain technology start to be adapted in various applications. Some businesses are already adopting blockchain technology because of its advantages such as data integrity and privacy. One of them is Web 3.0. Web 3.0 puts forward data decentralization so that users can choose what data will be sent to the server. User data is provided locally with the help of a crypto wallet and the server just receives wallet info. With this mechanism, user privacy can be maintained directly by the user himself. All data will be processed at the users' end first before being sent to the server. With the new mechanism of web 3.0 and the advantages of blockchain, we build an application to authenticate students' login activities and grant roles to them based on their wallets. In this paper, we use the prototyping model as the method to build the application. We managed to utilize studentsâ wallet addresses as credentials. And with the help of Web3 module, we managed to decentralize the authentication process. And as a result of the successful authentication process, students can access their data based on their roles.
Vikas Goel, Mukul Aggarwal, Amit Gupta, Narendra Kumar
An Aadhaar is a unique number issued to every citizen in India. Aadharâs current identity authentication relies on the central identities data repository (CDIR) of the unique identification authority of India (UIDAI), which is at risk of a single-point fault attack. Perhaps worse, internal attacks can tamper with the sensitive data of authenticated devices without being detected. In this paper, the proposed system utilizes emerging technology: blockchain for solving the issue of centralized authentication. The proposed system provides a distributed, secure, and tamper-proof ledger platform for Aadhar in that Aadhar is implemented using blockchain ethereum technology. The proposed system considers the unique Aadhar identification (ID) for each citizen of India and registered it on the smart contract of ethereum so that this unique ID may be authenticated by each other in a peer-to-peer network without a central authority. For securing the data, the proposed framework uses hashing technique for significant data (i.e. firmware). Blockchain stores hashed data and instantly any change in the state of the data may be possible to detect.
Smart contracts are decentralized applications running on blockchain platforms and have been widely used in a variety of scenarios in recent years. However, frequent smart contract security incidents have focused more and more attention on their security and reliability, and smart contract vulnerability detection has become an urgent problem in blockchain security. Most of the existing methods rely on fixed rules defined by experts, which have the disadvantages of single detection type, poor scalability, and high false alarm rate. To solve the above problems, this paper proposes a method that combines Bi-LSTM and an attention mechanism for multiple vulnerability detection of smart contract opcodes. First, we preprocessed the data to convert the opcodes into a feature matrix suitable as the input of the neural network and then used the Bi-LSTM model based on the attention mechanism to classify smart contracts with multiple labels. The experimental results show that the model can detect multiple vulnerabilities at the same time, and all evaluation indicators exceeded 85%, which proves the effectiveness of the method proposed in this paper for multiple vulnerability detection tasks in smart contracts.
The rapid growth of modern technologies has encouraged non-profit organizations (NPOs) to harness such technologies to better serve the charity sector, especially in relation to charity donation processes. Non-profit organizations primarily rely on fundraising that may involve opaque operations, which leads to the exacerbation of fears that donations may be used for illegal purposes or not reach deserving people. The necessity of charity donations traceability system is inevitable to overcome such concerns, which have an adverse impact on donersâ trust in the donation process. In this study, we propose a blockchain-based donation traceability framework intended to enable all involved parties to trace the progress of charity donations from the moment they are given by donors to the moment they reach the intended recipients. The system is built on a public-permissioned blockchain on the Ethereum platform, with every transaction being recorded as a block in the chain. These blocks of information are immutable and visible to all parties, and they also enable timely and traceable transactions. The proposed frameworkâs effectiveness is evaluated using a hybrid qualitative approach and proves to improve the traceability of charity donations overcoming the uncertainty associated with current systems.
Coinhive released its browser-based cryptocurrency mining code in September 2017, and vicious web page writers, called vicious miners hereafter, began to embed mining JavaScript code into their web pages, called mining pages hereafter. As a result, browser users surfing these web pages will benefit mine cryptocurrencies unwittingly for the vicious miners using the CPU resources of their devices. The above activity, called Cryptojacking, has become one of the most common threats to web browser users. As mining pages influence the execution efficiency of regular programs and increase the electricity bills of victims, security specialists start to provide methods to block mining pages. Nowadays, using a blocklist to filter out mining scripts is the most common solution to this problem. However, when the number of new mining pages increases quickly, and vicious miners apply obfuscation and encryption to bypass detection, the detection accuracy of blacklist-based or feature-based solutions decreases significantly. This paper proposes a solution, called MinerGuard, to detect mining pages. MinerGuard was designed based on the observation that mining JavaScript code consumes a lot of CPU resources because it needs to execute plenty of computation. MinerGuard does not need to update data used for detection frequently. On the contrary, blacklist-based or feature-based solutions must update their blocklists frequently. Experimental results show that MinerGuard is more accurate than blacklist-based or feature-based solutions in mining page detection. MinerGuardâs detection rate for mining pages is 96%, but MinerBlock, a blacklist-based solution, is 42.85%. Moreover, MinerGuard can detect 0-day mining pages and scripts, but the blacklist-based and feature-based solutions cannot.
We reveal six zero-day social engineering attacks in Ethereum, and subdivide them into two classes: Address Manipulation and Homograph. We demonstrate the attacks by embedding them in source codes of five popular smart contracts with combined market capitalization of over \$29 billion, and show that the attacks have the ability to remain dormant during the testing phase and activate only after production deployment. We analyze 85,656 open source smart contracts and find 1,027 contracts that can be directly used for performing social engineering attacks. For responsible disclosure, we contact seven smart contract security firms. In the spirit of open research, we make the source codes of the attack benchmark, tools, and datasets available to the public.
Non-Fungible Token (NFT) is evolving with the rise of the cryptocurrency market and the development of blockchain techniques, which leads to an emerging NFT market that has become prosperous rapidly then followed by a cooldown. Nevertheless, the overall rise procedure of the NFT market has not been well understood. To this end, we consider that social media communities evolving alongside the market growth, are worth exploring and reasoning about, as the mineable information might unveil the market behaviors. We explore the procedure from the perspective of NFT Twitter communities and its impact on the NFT price moves with two experiments. We perform a Granger causality test on the number of tweets and the NFT price time series and find that the number of tweets has a positive impact on (Granger-causes) the price or reversely for larger part of the 19 top authentic projects but seldom copycat projects. Besides, to investigate the price moves predictability, we experiment on predicting Markov normalized NFT price (representing the direction and magnitude of price moves) given tweets-extracted word features and interpret the feature importance to find insights. Our results show that social media words as the predictors result in all 19 top projects having a testing accuracy evidently above the baseline. Based on the feature importance analysis, we find that both general market-related words and NFT event-related words have a markedly positive contribution in predicting price moves. We summarize the characteristics including categorization and sentiment for the words with the top and least feature importance.
Ali Aljofey, Abdur Rasool, Qingshan Jiang, Qiang Qu
Blockchain technology has allowed many abnormal schemes to hide behind smart contracts. This causes serious financial losses, which adversely affects the blockchain. Machine learning technology has mainly been utilized to enable automatic detection of abnormal contract accounts in recent years. In spite of this, previous machine learning methods have suffered from a number of disadvantages: first, it is extremely difficult to identify features that enable accurate detection of abnormal contracts, and based on these features, statistical analysis is also ineffective. Second, they ignore the imbalances and repeatability of smart contract accounts, which often results in overfitting of the model. In this paper, we propose a data-driven robust method for detecting abnormal contract accounts over the Ethereum Blockchain. This method comprises hybrid features set by integrating opcode n-grams, transaction features, and term frequency-inverse document frequency source code features to train an ensemble classifier. The extra-trees and gradient boosting algorithms based on weighted soft voting are used to create an ensemble classifier that balances the weaknesses of individual classifiers in a given dataset. The abnormal and normal contract data are collected by analyzing the open source etherscan.io, and the problem of the imbalanced dataset is solved by performing the adaptive synthetic sampling. The empirical results demonstrate that the proposed individual feature sets are useful for detecting abnormal contract accounts. Meanwhile, combining all the features enhances the detection of abnormal contracts with significant accuracy. The experimental and comparative results show that the proposed method can distinguish abnormal contract accounts for the data-driven security of blockchain Ethereum with satisfactory performance metrics.
Home delivery (B2C) experienced rapid growth during the COVID-19 pandemic, especially food delivery. Nonrepudiation is a problem in security and affects delivery. Blockchain technology is a new technology that addresses this issue. This paper proposes preventing nonrepudiation in home delivery through blockchain technology. We also design a data structure and smart contract for distributed application. In addition, we evaluate the performance of the proposed framework in terms of transaction fees and response times. We experimented on the blockchain emulator, stored data in RDBMS, and implemented a client with a mobile application. The data in the smart contract were directly impacted by the gas used and the response time. Primarily, the function processes the large data size and involves high transaction fees and long response times. The gas used accounts for 9061 times of data length, while the response time accounts for 2.84 times of data length. Finally, we propose a security policy for the proposed framework.
K. Vidya, Hussain Imthiaz Hussain, Vishal Celestine, V. Siva Kumar · 5 authors
Abstract Crowdfunding is a method of raising funds from a large number of individuals or businesses. Investors can contribute to any project they are interested in and earn if the initiative is successful. Many crowdfunding sites now exist, and they accept large sums of money from investors and contributors and then leave them with bogus promises. Blockchain-based crowdfunding alters the usual approach to company finance. Generally, when people need to acquire funds to start a firm, they must first develop a strategy, statistical surveys, and models, and then offer their ideas to attract people or organisations. Banks, individual investors, and venture capital firms were among the sources of funding. The modern crowdfunding concept is based on three types of on-screen characters: the task initiator who presents the idea or venture to be financed, individuals or investors who invest in the idea, and a platform that connects these two characters to make the venture successful. It can be used to fund a wide range of start-ups and new concepts, such as inventive activities, medical improvements, travel, and social commercial enterprise projects. This work presents a practical implementation of a crowdfunding application that is secured by a lattice-based cryptosystem for encryption of user data and zero-knowledge proof for the identification of application users. Additionally, machine learning has been used for prediction of campaign success for the benefit of fund contributors.