In blockchain, ensuring integrity of data when updating distributed ledgers is a challenging and very fundamental process. Most of blockchain networks use Merkle tree to verify the authenticity of data received from other peers on the network. However, creating Merkle tree for each block in the network and composing Merkle branch for every transaction verification request are time-consuming process requiring heavy computations. Moreover, sending these data through the network generates a lot of traffic. Therefore, we proposed an updated mechanism that uses incremental hash chain with probabilistic filter to verify block data, provide a proof of data integrity and efficiently update blockchain light nodes. In this article, we prove that our model provides better performance and less required computations than Merkle tree while maintaining the same security level.
Abstract The technology of Ethereum blockchain enables the implementation of smart contracts. Nowadays smart contracts are one of the most successful applications of blockchain technology, which are widely used in many fields, such as finance, energy and services. The decentralization and immutability properties of Ethereum blockchain provide security for transactions from smart contracts. However, these properties are possible to lead to unfixable vulnerabilities of smart contracts. In recent years, vulnerability detection on smart contracts has attracted more attention from researchers and many related tools have emerged. Nevertheless, the existing vulnerability detection tools have not yet been put into formal use. Due to the lack of suitable smart contract sets and fair metrics with other factors, it remains complex work to conduct authoritative performance tests on these tools. In this paper, we first summarize eight common vulnerabilities of smart contracts, and then divide them into call-related and call-irrelated vulnerabilities according to whether they involve caller functions or not. In addition, we propose a detection framework called SuperDetector, which combines a variety of vulnerability detection tools based on static analysis technology. And the framework mainly measures the detection performance, which contains vulnerability coverage, detection accuracy, usability and execution time on the two types of vulnerabilities. The results indicate that the framework can analyze the performance from different perspectives, and the performance of vulnerability coverage and detection accuracy on call-related vulnerabilities is much better than that on call-irrelated vulnerabilities. Finally, we design a selector based on the detection results in the framework for improving the vulnerability coverage and detection accuracy.
A smart contract that is deployed to a blockchain system like Ethereum is, under reasonable circumstances, expected to be immutable and tamper-proof. This is both a feature (promoting integrity and transparency) and a bug (preventing security patches and feature updates). Modern smart contracts use software tricks to enable upgradeability, raising the research questions of how upgradeability is achieved and who is authorized to make changes. In this paper, we summarize and evaluate six upgradeability patterns. We develop a measurement framework for finding how many upgradeable contracts are on Ethereum that use certain prominent upgrade patters. We find 1.4 million proxy contracts which 8,225 of them are unique upgradeable proxy contracts. We also measure how they implement access control over their upgradeability: about 50% are controlled by a single Externally Owned Address (EOA), and about 14% are controlled by multi-signature wallets in which a limited number of persons can change the whole logic of the contract.
Fake News has become a huge alarming issue since the previous few years.It can be used to influence people on any political, economical or social topics and change people’s thoughts on a particular subject. We’re using a blockchain based technique to overcome this problem. More specifically the proposed approach uses concepts of customized proof of authority and proof of truthfulness consensus algorithm serving as an incentive mechanism to determine the integrity of fake news. As Blockchain is a decentralized system no one will be able to tamper with the original news. Also, we are maintaining the reputation score of each organization. Due to fear of lowering credibility score, no one will produce fake news and the probability of fake news getting viral will be reduced. This platform which is a blockchain based Decentralized application can provide normal readers on the platform with a reliable way of verifying the content and the source by which it gets published. Our work demonstrates that the solutions proposed in this paper ensure data integrity, data security, data transparency, and data traceability by consideration of such a blockchain-based framework for tackling fake news. Key Words: Decentralized Applications, Decentralised Autonomous Organisation, Decentralized Exchange, Peer To Peer, Ethereum Virtual Machine
This paper investigates the cryptocurrency giveaway scam with the YouTube live stream carried out on 5/15/2022 and 5/16/2022. In this scam scheme, the scammer plays a recorded video of a famous person in a YouTube live stream annotated with a cryptocurrency giveaway announcement. In the annotated announcement, the victims are directed to the scammer's webpage. The scammer's webpage is designed intelligently to deceive victims such that they believe the legitimacy of the giveaway. The scammer claims that whatever donation the victim sends to a cryptocurrency wallet address, the giveaway scheme will double the donated amount and immediately send it back to the victim. By analyzing the scammers' wallet addresses, it can be seen that scammers could steal a significant amount of money in a short time. After analyzing the attackers' techniques, tactics, and procedures, this paper discusses the countermeasures that can be applied to mitigate such a fraudulent activity in the future.
Microblogging has become an extremely popular communication tool among Internet users worldwide. Millions of users daily share a huge amount of information related to various aspects of their lives, which makes the respective sites a very important source of data for analysis. Bitcoin (BTC) is a decentralized cryptographic currency and is equivalent to most recurrently known currencies in the way that it is influenced by socially developed conclusions, regardless of whether those conclusions are considered valid. This work aims to assess the importance of Twitter users’ profiles in predicting a cryptocurrency’s popularity. More specifically, our analysis focused on the user influence, captured by different Twitter features (such as the number of followers, retweets, lists) and tweet sentiment scores as the main components of measuring popularity. Moreover, the Spearman, Pearson, and Kendall Correlation Coefficients are applied as post-hoc procedures to support hypotheses about the correlation between a user influence and the aforementioned features. Tweets sentiment scoring (as positive or negative) was performed with the aid of Valence Aware Dictionary and Sentiment Reasoner (VADER) for a number of tweets fetched within a concrete time period. Finally, the Granger causality test was employed to evaluate the statistical significance of various features time series in popularity prediction to identify the most influential variable for predicting future values of the cryptocurrency popularity.
Blockchain is an emerging technology based on a distributed digital ledger system. Decentralized trust is one of the key factors behind the blockchain-based system. The transparency of such a system is better than a conventional centralized ledger system. By using a blockchain-based transaction system, any business organization can harness key benefits like data integrity, confidentiality, and anonymity without involving any third party in control of the transactions. Since the blockchain is used in numerous applications, the horizon is expanding at an unprecedented pace. It was found that tracking COVID vaccination in a transparent and accountable way is an emerging need, especially after the pandemic outbreak around the world. The blockchain platform is a good match for such applications. In this study, a blockchain-based COVID-19 testing and vaccination tracking system, called COVAC, has been designed to manage the COVID testing and vaccination process for local organizations. The “Prototype Software Development" approach was used to determine the system requirements according to the practical knowledge obtained through the vaccine monitoring and screening tests process and then communicated with local healthcare facilities to determine whether these requirements were satisfied. The blockchain-based implementation ensured the system transparency, integrity, and security of data on COVID-19 testing and vaccination
Many existing timed-release encryption schemes uses time-lock puzzles to avoid relying on a trusted timeserver or a key holder which could be a weak spot in data security. However, it is unavoidable to consume massive computing power for solving time-lock puzzles and it is difficult for encryptors to predict the amount of time to solve a puzzle by decryptors. In this study, an efficient dual-purpose proof-of-work consensus allows users to release a time-locked content, which is encrypted by an asymmetric key encryption scheme on a blockchain, without trust in any third-party agents. The release time is predictable as the block time in a proof-of-work blockchain is adaptively controlled. The mining work is reproposed so that once a new block was mined on the blockchain network, time-lock puzzles were also solved immediately. No additional work is required to reveal the time-locked contents and the encryption is secured by monetary incentive mechanisms since it would be very costly to arrange an attack attempt, which must overtake the total hash rate of the whole blockchain network.
The Internet has become one of the most important technologies in the world, and hackers use various methods to launch cyber attacks to profit from it. Phishing is one of famous social engineering attacks, it is often used to steal user data, including login credentials and credit card numbers. Although the Transport Layer Security certificate is used to verify the trust of websites, there are still a series of vulnerabilities. The demand for trusted IP addresses has led a lot of research, including IP whitelisting, DNS filtering and so on. However, these technologies still have many shortcomings. In view of this, we proposed a novel mechanism for verifying websites using blockchain technology. The URL and IP address of a permissioned website are recorded in blockchain through a specific smart contract. A DNS query is executed through a smart contract designed to avoid URL redirection attacks. With the help of immutable nature of blockchian, phishing websites can be detected. The mechanism will not add any load to users and provides tamper-proof functions based on the characteristics of blockchain. The comparison of related works shows that the proposed mechanism is more secure. We also provided a reference implementation of the proposed mechanism on Ethereum Quorum simulation platform, which proves the effectiveness and practicability of the mechanism.
Online advertising, which depends on consumers’ click, creates revenue for media sites, publishers, and advertisers. However, click fraud by criminals, i.e., the ad is clicked either by malicious machines or hiring people, threatens this advertising system. To solve the problem, many schemes are proposed which are mainly based on machine learning or statistical analysis. Although these schemes mitigate the problem of click fraud, several problems still exist. For example, some fraudulent clicks are still in the wild since their schemes only discover the fraudulent clicks with a probability approaching but not 100%. Also, the process of detecting a click fraud is executed by a single publisher, which makes a chance for the publisher to obtain illegal income by deceiving advertisers and media sites. Besides, the identity privacy of consumers is also exposed because the schemes deal with the plain text of consumers’ real identity. Therefore, in this paper, a blockchain-based click fraud detection and prevention scheme (BCFDPS) for online advertising is proposed to deal with the above problems. Specifically, the BCFDPS mainly introduces bilinear pairing to implicitly verify whether a consumer’s real digital identity is contained in a click message to significantly avoid click fraud and employs a consortium blockchain to ensure the transparency of the detection and prevention process. In our scheme, the clicks by machines or fraud ones by a human can be accurately detected and prevented by media sites, publishers, and advertisers. Furthermore, ciphertext-policy attribute-based encryption is adopted to protect the identity privacy of consumers. The implementation and evaluation results show that compared with the existing click fraud detection and prevention schemes based on machine learning and statistical analysis, BCFDPS achieves detection of each fraudulent click with a probability of 100% and consumes lower computation cost; furthermore, BCFDPS adds functions of consumers’ privacy protection and click fraud detection and prevention, compared to the existing blockchain-based online advertising scheme, by introducing limited communication cost ( 4,984 bytes) at lower storage cost.
Open access
Blockchain Technology Applications and Security
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
Nowadays, Blockchain-based rating/review systems are gaining popularity as a backbone for recommender systems due to the inherent cryptographically secured decentralised architecture, immutability, user anonymity, and inclusion of smart contracts. However, the existing Blockchain-based rating/review systems address resistance to the standard attacks, i.e. collusion attack, user threatening, and unfair rating. Still, they do not present security analyses of smart contracts that may result in substantial threats to the users of the systems. This manuscript presents an in-depth study of twelve publicly available security analysis tools and standard vulnerabilities in smart contracts and reviews. The experimental setup uses a two-step approach for selecting the security analysis tool. The first step identifies the seven tools their proposers or independent researchers have compared, and the second step proposes a new method for selecting tools based on continuous improvement. Our experimental results show security issues in 51.72% of the analysed smart contracts of four Blockchain-based rating/review systems. 6.67% of vulnerable smart contracts exhibit high-level severity threats that raise an alarming condition for the current state of system developments.
Miners of a blockchain exchange information about blocks and transactions with one another via a peer-to-peer (P2P) network. The speed at which they learn of new blocks and transactions in the network determines the likelihood of forks in the chain, which in turn has implications for the efficiency as well as security of proof-of-work (PoW) blockchains. Despite the importance of information propagation delays in a blockchain's peer-to-peer network, little is known about them. The last known empirical study was conducted, for instance, by Decker and Wattenhofer in 2013 [11].
In recent years, phishing scams have become the most serious type of crime involved in Ethereum, the second-largest blockchain platform. The existing phishing scams detection technology on Ethereum mostly uses traditional machine learning or network representation learning to mine the key information from the transaction network to identify phishing addresses. However, these methods adopt the last transaction record or even completely ignore these records, and only manual-designed features are taken for the node representation. In this paper, we propose a Temporal Transaction Aggregation Graph Network (TTAGN) to enhance phishing scams detection performance on Ethereum. Specifically, in the temporal edges representation module, we model the temporal relationship of historical transaction records between nodes to construct the edge representation of the Ethereum transaction network. Moreover, the edge representations around the node are aggregated to fuse topological interactive relationships into its representation, also named as trading features, in the edge2node module. We further combine trading features with common statistical and structural features obtained by graph neural networks to identify phishing addresses. Evaluated on real-world Ethereum phishing scams datasets, our TTAGN (92.8% AUC, and 81.6% F1-score) outperforms the state-of-the-art methods, and the effectiveness of temporal edges representation and edge2node module is also demonstrated.
While blockchain technology triggers new industrial and technological revolutions, it also brings new challenges. Recently, a large number of new scams with a "blockchain" sock-puppet continue to emerge, such as Ponzi schemes, money laundering, etc., seriously threatening financial security. Existing fraud detection methods in blockchain mainly concentrate on manual feature and graph analytics, which first construct a homogeneous transaction graph using partial blockchain data and then use graph analytics to detect anomaly, resulting in a loss of pattern information. In this paper, we mainly focus on Ponzi scheme detection and propose HFAug, a generic Heterogeneous Feature Augmentation module that can capture the heterogeneous information associated with account behavior patterns and can be combined with existing Ponzi detection methods. HFAug learns the metapath-based behavior characteristics in an auxiliary heterogeneous interaction graph, and aggregates the heterogeneous features to corresponding account nodes in the homogeneous one where the Ponzi detection methods are performed. Comprehensive experimental results demonstrate that our HFAug can help existing Ponzi detection methods achieve significant performance improvement on Ethereum datasets, suggesting the effectiveness of heterogeneous information on detecting Ponzi schemes.
The “Bitcoin Generator Scam” (BGS) is a cyberattack in which scammers promise to provide victims with free cryptocurrencies in exchange for a small mining fee. In this paper, we present a data-driven system to detect, track, and analyze the BGS. It works as follows: we first formulate search queries related to BGS and use search engines to find potential instances of the scam. We then use a crawler to access these pages and a classifier to differentiate actual scam instances from benign pages. Last, we automatically monitor the BGS instances to extract the cryptocurrency addresses used in the scam. A unique feature of our system is that it proactively searches for and detects the scam pages. Thus, we can find addresses that have not yet received any transactions. Our data collection project spanned 16 months, from November 2019 to February 2021. We uncovered more than 8,000 cryptocurrency addresses directly associated with the scam, hosted on over 1,000 domains. Overall, these addresses have received around 8.7 million USD, with an average of 49.24 USD per transaction. Over 70% of the active addresses that we are capturing are detected before they receive any transactions, that is, before anyone is victimized. We also present some post-processing analysis of the dataset that we have captured to aggregate attacks that can be reasonably confidently linked to the same attacker or group. Our system is one of the first academic feeds to the APWG eCrime Exchange database. It has been actively and automatically feeding the database since November 2020.
In recent years, vaccine safety incidents have occurred frequently. To protect vaccine safety, researchers have proposed to use blockchain to secure the vaccine circulation process. Technically, blockchain has some limitations in solving vaccine and other supply chain problems, such as large on-chain storage consumption and low throughput. To better alleviate these restrictions, we propose an improved, blockchain-based, storage-efficient vaccine safety protection scheme in this work. Specifically, we first model the vaccine circulation process. We then design a system to protect vaccine circulation using blockchain, cloud, and cryptographic mechanisms. The proposed system leverages the cloud to implement the vaccine circulation model. Correspondingly, it uses the blockchain to store circulating data certificates and signatures. We evaluated the proposed conceptual model using a consortium blockchain. The experimental results show that the proposed system is efficient.
Cryptocurrencies have dramatically increased adoption in mainstream applications in various fields such as financial and online services, however, there are still a few amounts of cryptocurrency transactions that involve illicit or criminal activities. It is essential to identify and monitor addresses associated with illegal behaviors to ensure the security and stability of the cryptocurrency ecosystem. In this paper, we propose a framework to build a dataset comprising Bitcoin transactions between 12 July 2019 and 26 May 2021. This dataset (hereafter referred to as BABD-13) contains 13 types of Bitcoin addresses, 5 categories of indicators with 148 features, and 544,462 labeled data, which is the largest labeled Bitcoin address behavior dataset publicly available to our knowledge. We also propose a novel and efficient subgraph generation algorithm called BTC-SubGen to extract a${k}$-hop subgraph from the entire Bitcoin transaction graph constructed by the directed heterogeneous multigraph starting from a specific Bitcoin address node. We then conduct 13-class classification tasks on BABD-13 by five machine learning models namely${k}$-nearest neighbors algorithm, decision tree, random forest, multilayer perceptron, and XGBoost, the results show that the accuracy rates are between 93.24% and 97.13%. In addition, we study the relations and importance of the proposed features and analyze how they affect the effect of machine learning models. Finally, we conduct a preliminary analysis of the behavior patterns of different types of Bitcoin addresses using concrete features and find several meaningful and explainable modes.
Mamoona Humayun, N. Z. Jhanjhi, Mahmood Niazi, Fathi Amsaad · 5 authors
The purpose of this study is to overcome coordination flaws and enhance end-to-end security in the drug distribution market (DDM). One of the major issues in drug market coordination management is the absence of a centralized monitoring system to provide adequate market control and offer real-time prices, availability, and authentication data. Further, tampering is another serious issue affecting the DDM, and as a consequence, there is a significant global market for counterfeit drugs. This vast counterfeit drug business presents a security risk to the distribution system. This study presents a blockchain-based solution to challenges such as coordination failure, secure drug delivery, and pharmaceutical authenticity. To optimize the drug distribution process (DDP), a framework for drug distribution is presented. The proposed framework is evaluated using mathematical modeling and a real-life case study. According to our results, the proposed technique helps to maintain market equilibrium by guaranteeing that there is adequate demand while maintaining supply. Using the suggested framework, massive data created by the medication supply chain would be appropriately handled, allowing market forces to be better regulated and no manufactured shortages to inflate medicine prices. The proposed framework calls for the Drug Regulatory Authority (DRA) to authenticate users on blockchain and to monitor end-to-end DDP. Using the proposed framework, big data generated through drug supply chain will be properly managed; thus, market forces will be better controlled, and no artificial shortages will be generated to raise drug costs.
Sabreen Ahmadjee, Carlos Mera‐Gómez, Rami Bahsoon, Rick Kazman
Blockchain is a disruptive technology intended to implement secure decentralised distributed systems, in which transactional data can be shared, stored, and verified by participants of the system without needing a central authentication/verification authority. Blockchain-based systems have several architectural components and variants, which architects can leverage to build secure software systems. However, there is a lack of studies to assist architects in making architecture design and configuration decisions for blockchain-based systems. This knowledge gap may increase the chance of making unsuitable design decisions and producing configurations prone to potential security risks. To address this limitation, we report our comprehensive systematic literature review to derive a taxonomy of commonly used architecture design decisions in blockchain-based systems. We map each of these decisions to potential security attacks and their posed threats. MITRE’s attack tactic categories and Microsoft STRIDE threat modeling are used to systematically classify threats and their associated attacks to identify potential attacks and threats in blockchain-based systems. Our mapping approach aims to guide architects to make justifiable design decisions that will result in more secure implementations.
Jinho Choi, Taehwa LEE, Kwanwoo KIM, Min-Jae Seo · 6 authors
Bitcoin is currently a hot issue worldwide, and it is expected to become a new legal tender that replaces the current currency started with El Salvador. Due to the nature of cryptocurrency, however, difficulties in tracking led to the arising of misuses and abuses. Consequently, the pain of innocent victims by exploiting these bitcoins abuse is also increasing. We propose a way to detect new signatures by applying two-fold NLP-based clustering techniques to text data of Bitcoin abuse reports received from actual victims. By clustering the reports of text data, we were able to cluster the message templates as the same campaigns. The new approach using the abuse massage template representing clustering as a signature for identifying abusers is much efficacious.
Counterfeiting drugs has been a global concern for years. Considering the lack of transparency within the current pharmaceutical distribution system, research has shown that blockchain technology is a promising solution for an improved supply chain system. This study aims to explore the current solution proposals for distribution systems using blockchain technology. Based on a literature review on currently proposed solutions, it is identified that the secrecy of the data within the system and nodes' reputation in decision making has not been considered. The proposed prototype uses a zero-knowledge proof protocol to ensure the integrity of the distributed data. It uses the Markov model to track each node's 'reputation score' based on their interactions to predict the reliability of the nodes in consensus decision making. Analysis of the prototype demonstrates a reliable method in decision making, which concludes with overall improvements in the system's confidentiality, integrity, and availability. The result indicates that the decision protocol must be significantly considered in a reliable distribution system. It is recommended that the pharmaceutical distribution systems adopt a relevant protocol to design their blockchain solution. Continuous research is required further to increase performance and reliability within blockchain distribution systems.
İlk kripto para birimi olan Bitcoin, son zamanlarda araştırmacılardan büyük ilgi görmektedir. Bitcoin literatürüne daha fazla katkı sağlamak için araştırmacılar tarafından yapılan çalışmalar bulunmaktadır. Bununla birlikte, Bitcoin literatürünü farklı çalışmalarla desteklemek önemlidir. Bu çalışma, teknoloji kabul modelini güven yapısı ile genişleten entegre bir modelin yapısal geçerliliğini test ederken, kullanıcıların Bitcoin'i kolay ve faydalı olarak algılamalarına ve Bitcoin'e olan güvenlerine dayalı olarak Bitcoin kullanma niyetlerini açıklamayı amaçlamaktadır. Bu amaçla 206 katılımcıdan online anket kullanılarak veri toplanmıştır. Process macro tekniği ile test edilen modelin yapısal geçerliliği istatistiksel analizlerle doğrulanmıştır. İstatistiksel analiz sonuçlarına göre Bitcoin'in algılanan kullanım kolaylığı, Bitcoin'in algılanan faydası ve Bitcoin'e olan güven ile bu faktörler arasındaki mevcut ilişkiler Bitcoin kullanma niyeti üzerinde etkilidir. Bununla birlikte, kullanıcıların Bitcoin kullanma niyetlerinin cinsiyet, yaş aralığı/jenerasyon, eğitim durumu ve aylık gelir açısından önemli ölçüde farklılık göstermediği belirtilmelidir. Bu çalışma hem teori hem de uygulama için çıkarımların yanı sıra gelecekteki araştırmalar için öneriler sunmaktadır.
Miner malware has been steadily increasing in recent years as the value of cryptocurrency rises, which poses a considerable threat to users’ device security. Miner malware has obvious behavior patterns in order to participate in blockchain computing. However, most miner malware detection methods use raw bytes feature and sequential opcode as detection features. It is difficult for these methods to obtain better detection results due to not modeling robust features. In this paper, a miner malware identification method based on graph classification network is designed by analyzing the features of function call graph and control flow graph of miner malware, called MBGINet. MBGINet can model the behavior graph relationship of miner malware by extracting the connection features of critical nodes in the behavior graph. Finally, MBGINet transforms these node features into the feature vectors of the graph for miner malware identification. In the test experiments, datasets with different volumes are used for simulating real-world scenarios. The experimental results show that the MBGINet method achieves a leading and stable performance compared to the dedicated opcode detection method and obtains an accuracy improvement of 3.08% on the simulated in-the-wild dataset. Meanwhile, MBGINet gains an advantage over the general malware detection method Malconv. These experimental results demonstrate the superiority of the MBGINet method, which has excellent characteristics in adapting to realistic scenarios.