Tran Viet Khoa, Do Hai Son, Dinh Thai Hoang, Nguyen Linh Trung · 8 authors
This article aims to study intrusion attacks and then develop a novel cyberattack detection framework to detect cyberattacks at the network layer (e.g., Brute Password and Flooding of Transactions) of blockchain networks. Specifically, we first design and implement a blockchain network in our laboratory. This blockchain network will serve two purposes, i.e., to generate the real traffic data (including both normal data and attack data) for our learning models and to implement real-time experiments to evaluate the performance of our proposed intrusion detection framework. To the best of our knowledge, this is the first dataset that is synthesized in a laboratory for cyberattacks in a blockchain network. We then propose a novel collaborative learning model that allows efficient deployment in the blockchain network to detect attacks. The main idea of the proposed learning model is to enable blockchain nodes to actively collect data, learn the knowledge from data using the Deep Belief Network, and then share the knowledge learned from its data with other blockchain nodes in the network. In this way, we can not only leverage the knowledge from all the nodes in the network but also do not need to gather all raw data for training at a centralized node like conventional centralized learning solutions. Such a framework can also avoid the risk of exposing local data's privacy as well as excessive network overhead/congestion. Both intensive simulations and real-time experiments clearly show that our proposed intrusion detection framework can achieve an accuracy of up to 98.6% in detecting attacks.
Smart Contracts (SCs) publicly deployed on blockchain have been shown to include multiple vulnerabilities, which can be maliciously exploited by users. In this paper, we present extorsionware, a novel attack exploiting the public nature of vulnerable SCs to gain control over the victim's SC assets. Thanks to the control gained over the SC, the attacker obliges the victim to pay a price to re-gain exclusive control of the SC.
Blockchain technology is essentially a decentralized database maintained by relevant parties and has been widely used in various scenarios such as logistics and finance. In terms of applications in the medical field, it is becoming more and more important because the patient's symptoms may be related to a certain vaccine. Whether the patient has been vaccinated with this vaccine will lead to different diagnostic results by the doctor. However, in the current vaccination environment of many regions, the vaccination record (VR) can only be kept in the patient's vaccination booklet, which is easy to lose or destroy. Therefore, the doctor needs to retrieve the patient's VR through a centralized database maintained by the government, which is time-consuming and will increase the medical risk. This study proposes a traceable blockchain-based vaccination record storage and sharing system. In the proposed system, the patient gets the vaccination at any legal clinic and the VR can be saved accompanied by the signature into the blockchain center, which ensures traceability. When the patient visits the hospital for treatment, the doctor can obtain the detail of the VR from the blockchain center and then make a diagnosis. The security of the proposed system will be protected by the programmed smart contracts. Through mutual authentication, our system can also provide and guarantee data integrity and nonrepudiation. Moreover, the proposed system has resistance to replay and man-in-the-middle attacks, and the performance is good.
Matthew Gregor Peterson, Todd R. Andel, Ryan Benton
Selfish mining is an attack against a blockchain where miners hide newly discovered blocks instead of publishing them to the rest of the network. The selfish miners continue to mine on their private chain while the honest miners waste resources mining on a shorter chain. According to the blockchain protocol, a longer chain takes precedent and shorter chains are discarded which allows the selfish miners to gain an advantage by keeping their chain secret. This attack can be used by malicious miners to earn a disproportionate share of the mining rewards or in conjunction with other attacks to steal money from cryptocurrency exchanges. Several of these attacks were launched in 2018 and 2019 with the attackers stealing as much as $18 Million. Developers made several different attempts to fix this issue, but the effectiveness of the fixes is currently unknown. Although this attack is possible against both Proof-of-Work and Proof-of-Stake blockchains, this research concentrates on detection in Proof-of-Work blockchains. As is difficult to evaluate security advances in the real-time blockchain, it is imperative to focus on simulation to evaluate blockchain security properties. To this end, we extend a blockchain simulator and add the ability to simulate selfish mining attacks. Several existing simulators are examined before choosing SimBlock for this research. Our goal is to identify the factors that identify selfish mining. Using existing research, we choose several factors that could identify an attack in an unlaunched state, an active state, or historically. We plan to use simulated data to train a machine learning model to detect selfish mining. Using the modified simulator, we generate training and test data for unlaunched and active attacks. For historical attacks, we will use historical data from known selfish mining attacks. While some existing research has examined the detection of selfish mining, it only examines active attacks. In this paper, we seek to lay the groundwork for future research into detecting attacks that are unlaunched, active, or historical.
Ethereum Smart Contracts based on Blockchain Technology (BT) enables monetary transactions among peers on a blockchain network independent of a central authorizing agency. Ethereum Smart Contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This enables consumers to make agreements in a transparent and conflict-free environment. However, there exist some security vulnerabilities within these smart contracts that are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. This paper presents a framework and empirical analysis that use code clone detection techniques for identifying vulnerabilities and their variations in smart contracts. Our empirical analysis is conducted using the Nicad code clone detection tool on a dataset of approximately 50k Ethereum smart contracts. We evaluated VOLCANO on two datasets, one with confirmed vulnerabilities and another with approximately 50k random smart contracts collected from the Etherscan. Our approach shows an improvement in the detection of vulnerabilities in terms of coverage and efficiency when compared to two of the publicly available static analyzers to detect vulnerabilities in smart contracts. To the best of our knowledge, this is the first study that uses a clone detection technique to identify vulnerabilities and their evolution in Ethereum smart contracts.
Finans, sağlık, sosyal medya vb ortamlardaki insanların ihtiyacı olan güven problemine blok zinciri teknolojisi, şifreli algoritmalar ile çözümler sunmaktadır. Güven problemini çözen ve verileri dağıtık olarak kayıt altına alan ve her şeyi şeffaf olarak bizlere sunan blok zinciri bir devrim niteliğindedir. Blok zinciri, akıllı sözleşmeler sayesinde kurumsal projelerde de kullanabilmektedir. Kurumların arasında yeni nesil bir ağ olarak da adlandırılan blok zinciri ile bir çok şeyin değişmesi beklenmektedir. İnternetin, mobile cihazların ve sensörlerin yaygınlaşmasıyla birlikte güven problemi her geçen gün daha da önem kazanmaktadır. Farklı amaçlara hizmet eden Ethereum, Cardano, EOS, Cosmos, Hyperledger gibi blok zincir platformları vardır. Altyapılarında Proof of Work (PoW), Proof of Stake (PoS), Delegated Proof of Stake (DPoS) ve Directed Acyclic Graph (DAG) gibi farklı fikir birliği mekanizmalarını kullanmaktadırlar. Bu çalışmada blok zinciri platformları, altyapılarında kullandıkları mutabakat mekanizmaları ve blok zinciri ağının güvenliği araştırılmıştır.
The status of the money-prospects of cryptocurrencies in both conventional and Shari’ah based literature remains hotly debated and largely indecisive. We apply/used the bibliometric approach to review the literature on/regarding the money-prospects of cryptocurrencies. We selected 264 articles published during the years 2011-2021 from Web of Science (WoS) through systematic screening to explore their influential and intellectual aspects. Bibliometric citation analysis was conducted to present/identify influential research categories, leading authors, top articles, prominent countries, and major journals within the sample. We also highlighted the trend of annual scientific production to show sustained growth in the area under research. Furthermore, keyword analysis and bibliometric coupling analysis were applied/carried out to generate networks to highlight the intellectual aspects of the money-prospects of cryptocurrencies. We used the networks of emerging themes and main clusters to conduct content analysis further. We included and reviewed studies which discussed the money-prospects of cryptocurrencies in the light of Shari’ah precepts in relevant clusters. We also identified potential future research areas (cluster-wise). Theis study helps the researchers to understand the evolution, dimensions, and emerging themes regarding the money-prospects of cryptocurrencies.
Blacklists are a widely-used Internet security mechanism to protect Internet users from financial scams, malicious web pages and other cyber attacks based on blacklisted URLs. In this demo, we introduce PhishChain, a transparent and decentralized system to blacklisting phishing URLs. At present, public/private domain blacklists, such as PhishTank, CryptoScamDB, and APWG, are maintained by a centralized authority, but operate in a crowd sourcing fashion to create a manually verified blacklist periodically. In addition to being a single point of failure, the blacklisting process utilized by such systems is not transparent. We utilize the blockchain technology to support transparency and decentralization, where no single authority is controlling the blacklist and all operations are recorded in an immutable distributed ledger. Further, we design a page rank based truth discovery algorithm to assign a phishing score to each URL based on crowd sourced assessment of URLs. As an incentive for voluntary participation, we assign skill points to each user based on their participation in URL verification.
Since the Ethereum virtual machine is Turing complete, Ethereum can implement various complex logics such as mutual calls and nested calls between functions. Therefore, Ethereum has suffered a lot of attacks since its birth, and there are still many attackers active in Ethereum transactions. To this end, we propose a traceability method on Ethereum, using graph analysis to track attackers. We collected complete user transaction data to construct the graph and analyzed data on several harmful attacks, including reentry attacks, short address attacks, DDoS attacks, and Ponzi contracts. Through graph analysis, we found accounts that are strongly associated with these attacks and are still active. We have done a systematic analysis of these accounts to analyze their threats. Finally, we also analyzed the correlation between the information collected through RPC and these accounts and finally found that some accounts can find their IP addresses.
Yuriy Kamenivskyy, Abhinav Palisetti, Layal Hamze, Sara Saberi
The COVID-19 vaccine distribution chain faced multiple challenges associated with the lack of production capacity, security issues, and miscommunication between different actors. Blockchain technology has been shown to solve the security and miscommunication issues in other industries. We first identify distribution chain challenges via literature reviews and primary interviews. Case studies that solved these challenges in other industries also served as a source. This information allowed us to devise a blockchain framework for the vaccine distribution chain and evaluate its application feasibility. We present the framework using data flow diagrams. The proposed framework helps minimize the circulation of counterfeit vaccines and vaccination records, improves communication between stakeholders in the distribution chain, increases supply chain security, and simplifies vaccine inventorying and handling processes.
Security incidents such as scams and hacks have become a major threat to the health of the blockchain ecosystem, resulting in billions of dollars in losses to blockchain users each year. To reveal the real-world entities behind pseudonymous blockchain accounts and recover stolen funds from massive transaction data, much effort has recently been put into tracing illicit financial flows in blockchain by academia and industry. However, most of the current blockchain fund tracing methods are heuristics and taint analysis methods that are designed on the basis of expert experience and specific events, which have limitations in terms of universality, effectiveness and efficiency. This paper models blockchain transaction records as a transaction graph and tackles blockchain transaction tracing as a graph search task. To achieve efficient and effective tracing of fund transfers on the transaction graphs, we propose a scalable transaction tracing tool, TRacer, which to the best of our knowledge is thefirstintelligent transaction tracing tool that is generalized to multiple account-based blockchain platforms and can handle complex transaction behavior in decentralized finance (DeFi). Particularly, we tackle the transaction tracing task via a subgraph searching approach which employ a novel ranking method to infer the relevance between accounts during the graph search process in the multi-relational blockchain transaction graph. Theoretical analysis and experimental results on datasets from multiple blockchain platforms demonstrate that TRacer can efficiently perform the transaction tracing task at a lower cost and achieve better tracing results than existing methods or even expert manual audits.
Hai Trieu Le, Tran Thanh Lam Nguyen, Tuan Anh Nguyen, Xuan Son Ha · 5 authors
Due to the rapid change of population structure, leading to lower birth rates and quick aging rates, the demand for blood supply is increasing significantly. In most countries, blood quality and origin are managed by blood management information systems, such as national authorities. Nevertheless, the traditional system has limitations in this field, such as a lack of detailed blood information, making it challenging to manage blood quality, supply, and demand. Hence, to solve these issues, this paper proposes a blockchain-based system called BloodChain, an improved system to support blood information management, providing more detailed information about blood, such as blood consumption and disposal. BloodChain exploits private blockchain techniques with a limited number of relatively fast and reliable participants, making them suitable for B2B (Business to Business) transactions. In this paper, we also develop a proposed system based on the architecture of Hyperledger Fabric. The evaluation of BloodChain is performed in several scenarios to prove our proposed model’s effectiveness.
In this paper, we identify and review key challenges to bridge the knowledge-gap between SME's, companies, organisations, businesses, government institutions and the general public in adopting, promoting and utilising Blockchain technology. The challenges indicated are Cybersecurity and Data privacy in this instance. Additional challenges are set out supported by literature, in researching data security management systems and legal frameworks to ascertaining the types and varieties of valid encryption, data acquisition, policy and outcomes under ISO 27001 and the General Data Protection Regulations. Blockchain, a revolutionary method of storage and immutability, provides a robust storage strategy, and when coupled with a Smart Contract, gives users the ability to form partnerships, share information and consent via a legally-based system of carrying out business transactions in a secure digital domain. Globally, ethical and legal challenges significantly differ; consent and trust in the public and private sectors in deploying such defensive data management strategies, is directly related to the accountability and transparency systems in place to deliver certainty and justice. Therefore, investment and research in these areas is crucial to establishing a dialogue between nations to include health, finance and market strategies that should encompass all levels of society. A framework is proposed with elements to include Big Data, Machine Learning and Visualisation methods and techniques. Through the literature we identify a system necessary in carrying out experiments to detect, capture, process and store data. This includes isolating packet data to inform levels of Cybersecurity and privacy-related activities, and ensuring transparency demonstrated in a secure, smart and effective manner.
Blockchain technology has made significant success, but it is also vulnerable for cyberattacks. As a particular form of attacks, Black Bird 51% hash rate attack has not been studied in depth, and it deserves particular attention. It is important to analyze its core construction, origin, and perniciousness. Black Bird Attack (BBA) could jeopardize a decentralized system more than centralized one, because centralized system has higher priority to control the dataflow than its users, whereas decentralized systems are vulnerable to attack, since everyone has almost the same privilege. Black Bird Attack can potentially destroy the fairness of blockchain networks. With this in mind, we have built a blockchain network simulation to examine this form of attacks, as presented in a detailed case study. This case study demonstrates Black Bird Attack is completely possible. Since Black Bird 51% hash rate attack is particularly dangerous in the post-quantum computing era, an intensive research agenda on this topic is in urgent need.
Hieu Le Van, Hong Khanh Vo, Huong Hoang Luong, Phuc Nguyen Trong · 12 authors
More and more new health care solutions are born based on the development of science and technology. The subjects who benefit the most, in this case, are not only patients (i.e., shorter healing time, faster recovery) but also medical staff, e.g., doctors/nurses (i.e., easy monitoring of the patient’s recovery process, proposing new treatment). However, there are still products that have not found an alternative: blood and blood products. Regardless of how science and technology can affect all aspects of patient treatment as well as medical care, blood still plays an important role in the treatment method. In addition to the above, blood and blood products may only be obtained from volunteers (i.e., blood donors). The preservation process is also very difficult, and no medical facility has enough facilities to preserve them. Therefore, the current process of blood preservation and transportation is done manually and contains many potential risks (e.g., data loss, personal information collection). In addition to the above barriers, developing countries (including Vietnam) also face many difficulties due to limited facilities. It is for this reason that this paper aims at a Blockchain-based technology solution for efficient management and distribution of blood from blood products. On the one hand, the paper contributes to the limitations in the information management process of storing and transporting blood and its products in the traditional database being applied in medical facilities in the cities and provinces in the Mekong Delta (the West-South of Vietnam). On the other hand, the article offers technology-based solutions to increase transparency and reduce the fear of centralized data storage (i.e., security and privacy issues). We also implement a proof-of-concept to evaluate the feasibility of the proposed approach.
The credibility of information is known as a major cause of a wide range of issues, such as: altered product information in food supply chains; fake transactions on E-commerce platforms; lengthy claim settlement time in agricultural insurance; and costly borrowings in agricultural financing. For a more specific example in food supply chains, end customers want to check the product information, but either doubt the authenticity of information, or simply do not have access to the information. The reason is that upstream suppliers and downstream retailers are often reluctant to share data, fearing privacy loss or business secret leakage. The consequence is that regulatory departments may face enormous challenges to identify accurate contamination sources, if there is scarce information or falsely recorded information at any stage of the food supply chain. In this paper, we focus on four common scenarios demanding information credibility in the agricultural supply chain: product traceability, E-commerce platforms, agricultural insurance, and agricultural financing. We review some high-profile smart credibility applications with emphasis on how blockchain related technologies can provide the information credibility by examining extant issues and relevant frameworks.
Phuc Nguyen Trong, Hong Khanh Vo, Huong Hoang Luong, Khiem Huynh Gia · 13 authors
YouTube connects people with each other through an online video sharing service platform. With the great devel-opment of the entertainment industry, content on YouTube is accessible to many people of different ages. However, verifying the content posted on YouTube is clean or not is a difficult problem. Dirty content is violent, pornographic and vulgar content that causes serious psychological harm to the segment of users under the age of 18, i.e., especially those of an age who are not yet aware of the harmful effects of content. Toxic will bring to the child’s behavior. Agree that Google (i.e., YouTube) has developed a YouTube Kid application where the videos are only for children under the age of 13. However, cultural and educational differences between regions strongly influence the choice of children. Select content for children. Therefore, the content restrictions on the YouTube Kid application have not yet met all the requirements of parents around the world. There have been many development directions to identify videos containing malicious content based on deep learning. However, there is no method to build a tool to support parents of children to share and identify videos with objectionable content (e.g., violence, pornography, obscene words) on the YouTube platform. In this research paper, we introduce YVC, a YouTube-verified content platform by applying blockchain’s distributed, public validation. This tool helps parents validate YouTube content and issue a report to reduce dirty content on YouTube. To demonstrate the effectiveness of our approach, we implement the proof-of-concept in the three most popular EVM platforms: Ethereum, Fantom, and the Binance smart chain. Compared to the YouTube Kids (i.e., the most common shared video platform for the under 13-year-old kid), our approach is able to capture the video preferences of the parents covering the difference areas/countries.
Wenjun Fan, Shubham Kumar, Sang‐Yoon Chang, Younghee Park
Abstract Collaborative intrusion detection approach uses the shared detection signature between the collaborative participants to facilitate coordinated defense. In the context of collaborative intrusion detection system (CIDS), however, there is no research focusing on the efficiency of the shared detection signature. The inefficient detection signature costs not only the IDS resource but also the process of the peer-to-peer (P2P) network. In this paper, we therefore propose a blockchain-based retribution mechanism, which aims to incentivize the participants to contribute to verifying the efficiency of the detection signature in terms of certain distributed consensus. We implement a prototype using Ethereum blockchain, which instantiates a token-based retribution mechanism and a smart contract-enabled voting-based distributed consensus. We conduct a number of experiments built on the prototype, and the experimental results demonstrate the effectiveness of the proposed approach.
Abstract Nowadays, the cyberspace search engines have showed great power to find entities and services in the network, which provide new ideas and methods to detect the Bitcoin nodes. This paper introduces the Bitcoin’s P2P network and nodes including the reachable nodes and the unreachable nodes. Then, the results of detecting reachable nodes by the cyberspace search engines are showed. Next, the author proposes a new approach to find and verify the unreachable nodes by the cyberspace search engines. Finally, this paper illustrates the de-anonymization of some Bitcoin nodes by the cyberspace search engines, which map some node’s IP addresses to real Bitcoin entities, such as Zeblockchain (a browser website), Microwallet (a wallet website) and Laurentia Pool (a non-profit pool website).
Open access
Blockchain Technology Applications and Security
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
We constructed a cryptographic interaction method museum art exchange protocol (MAXP) for museum digital collections on the basis of blockchain technology. Using our method, we build a digital collection exchange system on Ethereum to realize the digital collection’s online exchange between two museums. Compared with the traditional centralized collection digital resource database method, MAXP can avoid the security risks caused by subjective factors and force majeure factors in the exchange process of digital collections, such as hackers and network viruses. In our exchange system we have built, the expression of content covered by digital collections is more convenient, and copyright disputes can be quickly resolved. Concurrently, given the decentralization and anonymity of the blockchain, a regulatory mechanism has been added to MAXP to avoid fraud, illegal fundraising, money laundering and smuggling. The regulatory mechanism we constructed is a dual receiver public key encryption scheme based on the Diffie-Hellman algorithm and the SM2 elliptic curve public key encryption algorithm. The sender encrypts the collection data, and both receivers can decrypt the messages using their respective private keys. One of the receivers is the museum that obtained the collection information, and the other receiver is the regulator. These two receivers can decrypt simultaneously, and the regulator can regulate the information exchange on the blockchain. The Beijing Planetarium and the Beijing Museum of Natural History have completed the exchange of collections through the system we have built. The analysis results show that the regulatory scheme based on the exchange blockchain system of the museum’s digital collections proves to be feasible, with security and expansibility. Our new encrypted exchange management method of digital collections in museums can effectively promote the exchange of collections between museums, and is of great significance to the promotion of cultural heritage and the dissemination of scientific knowledge.
Open access
2 source records
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Due to the monetary value of Bitcoin, the most influential digital cryptocurrency in the world, Bitcoin has naturally become a valuable target of attacks, resulting in the emergence of many attack strategies on it. Among those attack strategies, selfish mining and block withholding attacks are two typical ones and attackers can obtain higher revenues under certain conditions than with an honest mining strategy. However, the combination of them will be a new type and more serious attack, which has not been analyzed in depth. In this paper, we propose GenSelfHolding, a general combined attack model with one selfish mining pool and random multiple honest pools on Bitcoin. Based on Markov chain, a general state transition graph and a general state distribution probability are presented to describe the internal features of our model. A general principle is then provided to calculate the attacker’s revenue. In addition, we give a detailed proof of the unique stable distribution of state transition probabilities. Such proof is an essential prerequisite for us to further present stable attacker revenue expressions under two specific scenarios, the GenSelfHolding model with two/three honest mining pools. Simulation results validate that the revenues of the attacker in these two specific models can reach up to 40% higher than those of classic selfish attackers in some cases.
Know Your Customer (KYC) process plays a vital role for all banks in authenticating the identity of their customers. KYC verification is crucial to prevent banks from being used by illegal elements for money laundering activities such as drug trafficking, terrorism and other crimes. Manual KYC process in mainstream at present is less secure, time consuming and outdated. Since Blockchain offers features like decentralization, immutability and security, these limitations can be eliminated by using Blockchain based KYC verification. In this paper, we have proposed decentralized KYC verification process using Ethereum Blockchain platform. It would allow all the banks in the Blockchain network to verify and vote for legitimacy of the data provided by the customer. Depending on number of votes KYC status of customer gets stored on the Blockchain. Major enhancement in our proposed method is, banks can also vote for other banks if any bank is tampering with the KYC data and it will get removed from the network based on this voting. In this way, Blockchain can be used to improve the efficiency of KYC process with its distinctive features.
The current legacy system used in processing health insurance claims causes a huge amount of financial loss every year due to fraud claims. It is also highly prone to privacy and security threats due to the use of traditional methods. Health insurance claims for prescription drugs are one such claim that is highly prone to being tampered with. Also, there is a lack of linkage in the prescription data between the medical care provider and the pharmacy, which also leads to miscommunication and the use of false prescriptions. In this paper, we propose processing health insurance claims for drug prescriptions using blockchain technology that manages the processing of prescription drugs in a private, secure, trustworthy, and decentralized manner. The proposed system utilizes a private Ethereum blockchain. The system includes two smart contracts: registration and approval smart contracts, which provide traceability and trustworthiness to the system. The system was integrated with off-chain storage (IPFS) and a fronted decentralized applications (DApps), which improves the accessibility of centralized patient information by authorized parties. To maintain the privacy of the data, a gateway is used to filter the data that can be viewed by the participants. We present the system architecture, sequence diagrams, entity-relationship diagram, and algorithms to demonstrate the working principles of the proposed process for processing health insurance claims for prescription drugs using blockchain. The performance of the proposed solution is evaluated by conducting security analysis and comparing it to the existing solutions. Our smart contract code is publicly available on GitHub.
Marco Di Gennaro, Lorenzo Italiano, Giovanni Meroni, Giovanni Quattrocchi
Thanks to built-in immutability and persistence, the blockchain is often seen as a promising technology to certify information. However, when the information does not originate from the blockchain itself, its correctness cannot be taken for granted. To address this limitation, blockchain oracles -- services that validate external information before storing it in a blockchain -- were introduced. In particular, when the validation cannot be automated, oracles rely on humans that collaboratively cross-check external information. In this paper, we present DeepThought, a distributed human-based oracle that combines voting and reputation schemes. An empirical evaluation compares DeepThought with a state-of-the-art solution and shows that our approach achieves greater resistance to voters corruptions in different configurations.