Wenjuan Li, Yu Wang, Weizhi Meng, Jin Li · 5 authors
To safeguard critical services and assets in a distributed environment, collaborative intrusion detection systems (CIDSs) are usually adopted to share necessary data and information among various nodes, and enhance the detection capability. For simplifying the network management, software defined networking (SDN) is an emerging platform that decouples the controller plane from the data plane. Intuitively, SDN can help lighten the management complexity in CIDSs, and a CIDS can protect the security of SDN. In practical implementation, trust management is an important approach to help identify insider attacks (or malicious nodes) in CIDSs, but the challenge is how to ensure the data integrity when evaluating the reputation of a node. Motivated by the recent development of blockchain technology, in this work, we design BlockCSDN — a framework of blockchain-based collaborative intrusion detection in SDN, and take the challenge-based CIDS as a study. The experimental results under both external and internal attacks indicate that using blockchain technology can benefit the robustness and security of CIDSs and SDN.
Internet of Things (IoT) devices are widely used in many industries including smart cities, smart agriculture, smart medical, smart logistics, etc. However, Distributed Denial of Service (DDoS) attacks pose a serious threat to the security of IoT. Attackers can easily exploit the vulnerabilities of IoT devices and control them as part of botnets to launch DDoS attacks. This is because IoT devices are resource-constrained with limited memory and computing resources. As an emerging technology, Blockchain has the potential to solve the security issues in IoT. Therefore, it is important to analyse various Blockchain-based solutions to mitigate DDoS attacks in IoT. In this survey, a detailed survey of various Blockchain-based solutions to mitigate DDoS attacks in IoT is carried out. First, we discuss how the IoT networks are vulnerable to DDoS attacks, its impact over IoT networks and associated services, the use of Blockchain as a potential technology to address DDoS attacks, in addition to challenges of Blockchain implementation in IoT. We then discuss various existing Blockchain-based solutions to mitigate the DDoS attacks in the IoT environment. Then, we classify existing Blockchain-based solutions into four categories i.e., Distributed Architecture-based solutions, Access Management-based solutions, Traffic Control-based solutions and the Ethereum Platform-based solutions. All the solutions are critically evaluated in terms of their working principles, the DDoS defense mechanism (i.e., prevention, detection, reaction), strengths and weaknesses. Finally, we discuss future research directions that can be explored to design and develop better Blockchain-based solutions to mitigate DDoS attacks in IoT.
Since the Ethereum virtual machine is Turing complete, Ethereum can implement various complex logics such as mutual calls and nested calls between functions. Therefore, Ethereum has suffered a lot of attacks since its birth, and there are still many attackers active in Ethereum transactions. To this end, we propose a traceability method on Ethereum, using graph analysis to track attackers. We collected complete user transaction data to construct the graph and analyzed data on several harmful attacks, including reentry attacks, short address attacks, DDoS attacks, and Ponzi contracts. Through graph analysis, we found accounts that are strongly associated with these attacks and are still active. We have done a systematic analysis of these accounts to analyze their threats. Finally, we also analyzed the correlation between the information collected through RPC and these accounts and finally found that some accounts can find their IP addresses.
Internet of Things (IoT) network consists of many devices that communicate together and exchange data. IoT network has many applications especially in smart city and smart campus. IoT devices usually produce a huge amount of data that are stored in the cloud to be analyzed later. Data in general and IoT devices data in particular suffer from major security issues such as the availability and the integrity of data. Blockchain is a new technology that offers an interesting solution for the security of sensitive IoT data by protecting data against malicious tampering. However, the data stored in the blockchain cannot be altered, therefore, it should be validated before being stored in the blockchain especially that IoT devices are vulnerable to attacks. Machine learning algorithms are very useful to detect compromised IoT devices to ensure that only reliable data are stored in the blockchain.
Cryptocurrencies have completely altered the digital transaction process all over the globe. Almost a decade after Satoshi Nakamoto generated the first Bitcoin block; many cryptocurrencies have been established. The Ransomware attack is a type of cybercrime and a class of malware that encrypts the files and prevents users from accessing their data or systems and demands payment for decrypting and retrieving access to their files. Ransomware data classification using present data mining and machine learning methods is difficult because predictions aren't always correct. We aim to build two models that effectively address these challenges and can diagnose and classify Ransomware attacks accurately, then compare the performance of the models. In this paper, we investigated the use of Rule-Based algorithms for mining Bitcoin Ransomware Data to classify Ransomware attacks in Bitcoin transactions. Employing Rule-Based techniques in detecting Bitcoin data is beneficial because the algorithms effectively classify non-linear datasets. The analysis was done on a Bitcoin dataset for 61,004 addresses selected from 29 Ransomware families and contained ten descriptive and decision attributes. Both Rule-Based algorithms were illustrated and compared on the dataset employing 10-fold cross-validation. Experimental results show that classification under partial decision tree (PART) algorithm performed better in different metrics than the Decision Table algorithm. It provides an accuracy of 96.01%, a recall of 96%, a precision of 95.9%, and an F-Measure of 95.6%. Experimental results propose that it is beneficial to further investigate the application of PART to predictive modelling tasks in Ransomware studies.
Blockchain technology has made significant success, but it is also vulnerable for cyberattacks. As a particular form of attacks, Black Bird 51% hash rate attack has not been studied in depth, and it deserves particular attention. It is important to analyze its core construction, origin, and perniciousness. Black Bird Attack (BBA) could jeopardize a decentralized system more than centralized one, because centralized system has higher priority to control the dataflow than its users, whereas decentralized systems are vulnerable to attack, since everyone has almost the same privilege. Black Bird Attack can potentially destroy the fairness of blockchain networks. With this in mind, we have built a blockchain network simulation to examine this form of attacks, as presented in a detailed case study. This case study demonstrates Black Bird Attack is completely possible. Since Black Bird 51% hash rate attack is particularly dangerous in the post-quantum computing era, an intensive research agenda on this topic is in urgent need.
The decoupling of the data plane and the control plane in the Software- Defined Network (SDN) can increase the flexibility of network management and operation. And it can reduce the network limitations caused by the hardware. However, the centralized scheme in SDN also can introduce some other security issues such as the single point of failure, the data consistency in multiple-controller environment and the spoofing attack initiated by a malicious device in the data plane. To solve these problems, a security framework for SDN based on Blockchain (BCSDN) is proposed in this paper. BCSDN adopts a physically distributed and logically centralized multi-controller architecture. LLDP protocol is periodically used to obtain the link state information of the network, and a Merkle tree is establised according to the collected link information and the signature is generate based on KSI for each link that submitted by a switch by the main controller selected by using the PoW mechanism. Such, the dynamic change of network topology is recorded on Blockchian and the consistency of the topology information among multiple controllers can be guaranteed. The main controller issues the signature to the corresponding switch and a controller checks the legitimate of a switch by verifying the signature when it requests the flow rule table from the controller later. The signature verification ensures the authenticated communication between a controller and a switch. Finally, the simulation of the new scheme is implemented in Mininet platform that is a network emulation platform and experiments are done to verify our novel solution in our simulation tool. And we also informally analysis the security attributes that provided by our BCSDN.
Distributed Denial of Service (DDoS) attacks is always one of the major problems for service providers. Using blockchain to detect DDoS attacks is one of the current popular methods. However, the problems of high time overhead and cost exist in the most of the blockchain methods for detecting DDoS attacks. This paper proposes a blockchain-based collaborative detection method for DDoS attacks. First, the trained DDoS attack detection model is encrypted by the Intel Software Guard Extensions (SGX), which provides high security for uploading the DDoS attack detection model to the blockchain. Secondly, the service provider uploads the encrypted model to Inter Planetary File System (IPFS) and then a corresponding Content-ID (CID) is generated by IPFS which greatly saves the cost of uploading encrypted models to the blockchain. In addition, due to the small amount of model data, the time cost of uploading the DDoS attack detection model is greatly reduced. Finally, through the blockchain and smart contracts, the CID is distributed to other service providers, who can use the CID to download the corresponding DDoS attack detection model from IPFS. Blockchain provides a decentralized, trusted and tamper-proof environment for service providers. Besides, smart contracts and IPFS greatly improve the distribution efficiency of the model, while the distribution of CID greatly improves the efficiency of the transmission on the blockchain. In this way, the purpose of collaborative detection can be achieved, and the time cost of transmission on blockchain and IPFS can be considerably saved. We designed a blockchain-based DDoS attack collaborative detection framework to improve the data transmission efficiency on the blockchain, and use IPFS to greatly reduce the cost of the distribution model. In the experiment, compared with most blockchain-based method for DDoS attack detection, the proposed model using blockchain distribution shows the advantages of low cost and latency. The remote authentication mechanism of Intel SGX provides high security and integrity, and ensures the availability of distributed models.
An eclipse attack is a common method used to attack the blockchain network layer; however, detecting eclipse attacks is challenging, and the performance of existing methods is inadequate due to uneven sample distribution, incomplete definition of discriminating features, and weak feature perception. Thus, this paper proposes an eclipse attack traffic detection method based in a custom combination of features and deep learning. To describe the behavior characteristics of attack traffic more accurately, traffic attribute features in there levels are defined in combination with the eclipse attack method. Here, the downstream traffic behavior feature of the eclipse attack is described from the conventional traffic feature, and the frequency distribution characteristics of eclipse attack traffic is by introducing the φ ‐entropy divergence algorithm. In addition, the structural characteristics of eclipse attack traffic are mapped from the rate of changes in traffic communication and load features. Then, the improved synthetic minority oversampling technique (ISMOTE) up‐sampling algorithm is employed to eliminate interference caused by the uneven distribution of eclipse attack traffic samples on the detection results. In addition, the ISMOTE algorithm adjusts the sampling weight of minority class samples, supports automatic clustering and efficient up‐sampling of samples, and improves the detection accuracy performance of eclipse attack samples by calculating the local cluster density. Then, deep feature mining is performed on the eclipse attack traffic from the distribution characteristics of space and time series using a CNN and Bi‐LSTM. Simultaneously, mining features are fully integrated into mixed feature using the multihead attention mechanism such that the relevance and complementarity of the two feature distributions can be utilized to enhance the model’s ability to perceive the spatiotemporal relationship of the eclipse attack traffic. Finally, the generated multihead attention items are detected for binary classification, and the results are output. Experimental results demonstrate that the proposed method can comprehensively enhance detection performance and sufficiently detect and classify eclipse attack traffic in the blockchain network layer.
In this paper, a blockchain‐based secure routing model is proposed for the Internet of Sensor Things (IoST). The blockchain is used to register the nodes and store the data packets’ transactions. Moreover, the Proof of Authority (PoA) consensus mechanism is used in the model to avoid the extra overhead incurred due to the use of Proof of Work (PoW) consensus mechanism. Furthermore, during routing of data packets, malicious nodes can exist in the IoST network, which eavesdrop the communication. Therefore, the Genetic Algorithm‐based Support Vector Machine (GA‐SVM) and Genetic Algorithm‐based Decision Tree (GA‐DT) models are proposed for malicious node detection. After the malicious node detection, the Dijkstra algorithm is used to find the optimal routing path in the network. The simulation results show the effectiveness of the proposed model. PoA is compared with PoW in terms of the transaction cost in which PoA has consumed 30% less cost than PoW. Furthermore, without Man In The Middle (MITM) attack, GA‐SVM consumes 10% less energy than with MITM attack. Moreover, without any attack, GA‐SVM consumes 30% less than grayhole attack and 60% less energy than mistreatment. The results of Decision Tree (DT), Support Vector Machine (SVM), GA‐DT, and GA‐SVM are compared in terms of accuracy and precision. The accuracy of DT, SVM, GA‐DT, and GA‐SVM is 88%, 93%, 96%, and 98%, respectively. The precision of DT, SVM, GA‐DT, and GA‐SVM is 100%, 92%, 94%, and 96%, respectively. In addition, the Dijkstra algorithm is compared with Bellman Ford algorithm. The shortest distances calculated by Dijkstra and Bellman are 8 and 11 hops long, respectively. Also, security analysis is performed to check the smart contract’s effectiveness against attacks. Moreover, we induced three attacks: grayhole attack, mistreatment attack, and MITM attack to check the resilience of our proposed system model.
Wenjun Fan, Shubham Kumar, Sang‐Yoon Chang, Younghee Park
Abstract Collaborative intrusion detection approach uses the shared detection signature between the collaborative participants to facilitate coordinated defense. In the context of collaborative intrusion detection system (CIDS), however, there is no research focusing on the efficiency of the shared detection signature. The inefficient detection signature costs not only the IDS resource but also the process of the peer-to-peer (P2P) network. In this paper, we therefore propose a blockchain-based retribution mechanism, which aims to incentivize the participants to contribute to verifying the efficiency of the detection signature in terms of certain distributed consensus. We implement a prototype using Ethereum blockchain, which instantiates a token-based retribution mechanism and a smart contract-enabled voting-based distributed consensus. We conduct a number of experiments built on the prototype, and the experimental results demonstrate the effectiveness of the proposed approach.
Jan 1, 2022·Proceedings of the 20th LACCEI International Multi-Conference for Engineering, Education and Technology: “Education, Research and Leadership in Post-pandemic Engineering: Resilient, Inclusive and Sustainable Actions”
Blockchain is one of the most anticipated technology revolutions, with immense promise in various applications. It is a distributed and encrypted database that can address a range of challenges connected to online security and trust. While many people identify Blockchain with cryptocurrencies such as Bitcoin, it has a wide range of applications in supply chain management, health, Internet of Things (IoT), education, identity theft prevention, logistics, and the execution of digital smart contracts. Although Blockchain Technology (BT) has numerous advantages for Decentralized Applications (DApps), it is nevertheless vulnerable to abuse, smart contract failures, security, theft, trespassing, and other concerns. As a result, using Machine Learning (ML) models to detect anomalies is an excellent way to detect and safeguard blockchain networks from criminal activity. Adapting ensemble learning methods in ML to create better prediction outcomes is a viable approach for anomaly identification. Ensemble learning, as the name implies, refers to creating a stronger and more accurate classification by combining the prediction results of numerous weak models. As a result, an in-depth evaluation of ensemble learning methodologies for anomaly detection in the blockchain network ecosystem is applied in this paper. It comprises numerous ensemble methods (e.g., averaging, voting, stacking, boosting, bagging). The review collects data from three established databases, which are Scopus, Web of Science (WoS), and Google Scholar. Specific keywords are employed, such as Blockchain, Ethereum, Bitcoin, Anomaly Detection, and Ensemble Learning, employing advanced searching algorithms. The results of the search found 60 primary articles from 2017 to 2022 (30 from Scopus, 20 from the WoS, and 10 from Google Scholar). Based on these findings, we decided to divide our debate into three primary themes: (1) the fundamentals of Blockchain Technology (BT), (2) the overview of ensemble learning, and (3) the integration and analysis of ensemble learning in blockchain networks for anomaly detection. In terms of awareness and knowledge, the results are also discussed in terms of what they mean and where future research should go.
Lampis Alevizos, Mahmoud Hashem Eiza, Vinh‐Thong Ta, Qi Shi · 5 authors
In a world where organisations are embracing new IT working models such as Bring Your Own Device (BYOD) and remote working, the traditional mindset of defending the network perimeter is no longer sufficient. Zero Trust Architecture (ZTA) has recently emerged as a new security model in which the breach mindset dominates the threat model. By default, the ZTA considers any endpoint (i.e., device), user, or application to be untrusted until proven otherwise. Nonetheless, once proven by the endpoint, using Advanced Persistent Threats (APT), attackers can still take over an authenticated and authorised session via that endpoint. Therefore, they can perform several user/device centric malicious activities in addition to lateral movement rendering the endpoint as the Achilles heel of ZTA. To effectively deter APT attack capabilities on the endpoints, this work proposes a Blockchain-enabled Intrusion Detection and Prevention System (BIDPS) that augments ZTA onto endpoints. The BIDPS aims to achieve two core outcomes: first, detect and prevent attackers’ techniques and tactics as per MITRE’s ATT&CK enterprise matrix earlier than the lateral movement stage, and secondly, strip trust out of the endpoint itself and place it on-chain, thus creating an immutable system of explicit trust. To evaluate the effectiveness of the BIDPS, a testbed was built where techniques of over ten APTs attacks were launched against the endpoint. BIDPS has proven a high rate of success defending against the launched attacks owing to its Blockchain’s immutability, fortifying the detection/prevention processes.
Valeh Farzaliyev, Jan Willemson, Jaan Kristjan Kaasik
Abstract Mix‐networks were first proposed by Chaum in the late 1970s–early 1980s as a general tool for building anonymous communication systems. Classical mix‐net implementations rely on standard public key primitives (e.g., ElGamal encryption) that will become vulnerable when a sufficiently powerful quantum computer will be built. Thus, there is a need to develop quantum‐resistant mix‐nets. This article focuses on the application case of electronic voting where the number of votes to be mixed may reach hundreds of thousands or even millions. We propose an improved architecture for lattice‐based post‐quantum mix‐nets featuring more efficient zero‐knowledge proofs while maintaining established security assumptions. Our current implementation scales up to 100,000 votes, still leaving a lot of room for future optimisation.
Routing in wireless sensor networks (WSNs) are based on multi-hop communication in which the messages pass through multiple sensor nodes, and hence routing algorithms must rely on trust relationships between neighboring nodes. The open access nature of WSNs leads to the possibility of nodes becoming compromised and consequently being turned into malicious objects. One such attack on WSNs is the Sybil attack, in which an attacker can take control of a legitimate node or enter a malicious node into the network and create fake identities. Consequently, they can change the behavior of the WSN, such as its routing schema to cause loops or wrong directions to manipulate data and consume the energy of the network, or even target cluster heads. In this paper, we present a novel technique based on IOTA Tangle, a distributed ledger technology, for the detection and prevention of Sybil attacks by protecting routing data. A transaction history on IOTA is maintained for detecting malicious node injection, and IOTA currency is used as a reputation score to prevent malicious nodes and protect the routing table. Even if an attacker gains access to the network, all routing data can be tracked in IOTA Tangle that will alert the base station about this attack. The technique has been simulated and evaluated using a proof-of-concept prototype.
As the most successful cryptocurrency, bitcoin has become the primary target of attackers. The security risks existing in bitcoin network (P2P networks) may pose serious threats to itself. It has been proved that network attackers of the autonomous system level could isolate a specific set of bitcoin nodes using prefix hijacking attacks; since this attack achieves bitcoin partition by deleting all data packets of the victim node, it is easy to be discovered by the victim node, and cannot maintain a long‐term connection (the partition will disappear after canceling the BGP hijacking) (Apostolaki M et al. (2017)). This paper proposes a new attack scheme—eclipse attack method based on BGP hijacking (BHE). The attack can occupy the network connection of the victim node, and only need to delete part of the TCP handshaking packets of the victim node during the attack, and it makes the attack more hidden and can occupy the network connection of the victim node for a long time. The innovation of the BHE attack is that it can control the peering decision of the victim node by controlling the victim node’s internal peer database (new table and tried table) and preventing the victim node from establishing a good connection. It enables the attacker to occupy all network connections of the victim node and become its natural network middleman. We verify the feasibility of the BHE attack through experimental evaluation and demonstrate that an attacker who can launch BGP hijacking may occupy all connections of the victim node within 20 minutes (ignoring the time of traffic diversion). To reduce the attack’s impact, the paper provides some countermeasures that can use in practice according to the basic characteristics of the attack.
Ibrahim Aliyu, Sélinde van Engelenburg, Muhammed Bashir Mu’azu, Jinsul Kim · 5 authors
The internet-of-Vehicle (IoV) can facilitate seamless connectivity between connected vehicles (CV), autonomous vehicles (AV), and other IoV entities. Intrusion Detection Systems (IDSs) for IoV networks can rely on machine learning (ML) to protect the in-vehicle network from cyber-attacks. Blockchain-based Federated Forests (BFFs) could be used to train ML models based on data from IoV entities while protecting the confidentiality of the data and reducing the risks of tampering with the data. However, ML models created this way are still vulnerable to evasion, poisoning, and exploratory attacks using adversarial examples. This paper investigates the impact of various possible adversarial examples on the BFF-IDS. We proposed integrating a statistical detector to detect and extract unknown adversarial samples. By including the unknown detected samples into the dataset of the detector, we augment the BFF-IDS with an additional model to detect original known attacks and the new adversarial inputs. The statistical adversarial detector confidently detected adversarial examples at the sample size of 50 and 100 input samples. Furthermore, the augmented BFF-IDS (BFF-IDS(AUG)) successfully mitigates the adversarial examples with more than 96% accuracy. With this approach, the model will continue to be augmented in a sandbox whenever an adversarial sample is detected and subsequently adopt the BFF-IDS(AUG) as the active security model. Consequently, the proposed integration of the statistical adversarial detector and the subsequent augmentation of the BFF-IDS with detected adversarial samples provides a sustainable security framework against adversarial examples and other unknown attacks.
Denial of Service (DoS) attacks are a growing threat in network services. The frequency and intensity of DoS attacks are rapidly increasing day by day. The immense financial potential of the Cryptocurrency market is a prevalent target of the DoS attack. The DoS attack events are kept on happening in cryptocurrencies and the blockchain ecosystem. To the best of our knowledge, there has not been any study on the DoS attack on the blockchain ecosystem. In this paper, we identify ten entities in the blockchain ecosystem and we scrutinize the DoS attacks on them. We also present the DoS mitigation techniques applicable to the blockchain services. Additionally, we propose a DoS mitigation technique by the use of verifiable delay function (VDF).
Syed Muhammad Sajjad, Muhammad Rafiq Mufti, Muhammad Yousaf, Waqar Aslam · 9 authors
DDoS (distributed denial of service) attacks have drastically effected the functioning of Internet‐based services in recent years. Following the release of the Mirai botnet source code on GitHub, the scope of these exploitations has grown. The attackers have been able to construct and launch variations of the Mirai botnet thanks to the open‐sourcing of the Mirai code. These variants make the signature‐based detection of these attacks challenging. Moreover, DDoS attacks are typically detected and mitigated reactively, making DDoS mitigation solutions very expensive. This paper presents a proactive IoT botnet detection system that detects the anomalies in the behavior of the IoT device and mitigates the DDoS botnet exploitation at the source end, which makes our proposal a low‐cost solution. Further, this paper uses a collaborative trust relationship‐based threat intelligence‐sharing mechanism to prevent other IoT devices from being compromised by the detected botnet. The researchers have evaluated the collaborative threat intelligence sharing mechanism using Ethereum Virtual Machine and Hyperledger. The performance of our proposed system can detect 97% of the Mirai botnet attack activities. Furthermore, our collaborative threat intelligence sharing mechanism based on the Ethereum Virtual Machine showed more scalability.
With the growing interest in blockchain in both academic research and industry, the security and privacy of blockchains have attracted huge interest, even though only a small part of the blockchain platforms can achieve the set of abovementioned security goals in practice. Leveraging from the state-of-the-art security paradigms, we propose 5irechain protective covering which has the ability to continuously identify, map, scan, assess, and grade the risk portfolio of all the assets, vendors, and acquisitions of a company giving a hackers perspective to the company. The dashboard gives visibility of not just only the web2 infrastructure in place, but also covers the web3 space and allows 5ire to monitor all of its nodes and their activities including historical data, tracking large wallets, monitoring bot activity, detecting transaction stats and volume along with the ability to block possible large scale attacks.
Arzu Özkan, Umutcan Korkmaz, Cemal Dak, Enis Karaarslan
Disaster and emergency management are under the responsibility of many organizations and there are serious coordination problems in post-disaster crisis management. This paper proposes a decentralized non-governmental organization resource management system for disasters (NGO-RMSD / STK-AKYS). This system is based on blockchain technology and it will enable the non-governmental organizations (NGO) and public institutions to manage and coordinate the resources in a trusted environment in the case of disasters. A proof of concept implementation is developed by using the Quorum blockchain framework which is more energy-efficient than crypto currency-based blockchain solutions. Smart contracts are developed for the autonomous working of the system. These smart contacts are used for the verification of the needs of the one who is in need, delivering resources to the right people, and identifying the urgent needs. The system aims to reach more disaster victims in a more timely manner. NGO-RMSD is designed according to the needs of the NGOs in the field. The application is shared with the free software license and further development with the community is aimed.