Intrusion detection systems that have emerged in recent decades can identify a variety of malicious attacks that target networks by employing several detection approaches. However, the current approaches have challenges in detecting intrusions, which may affect the performance of the overall detection system as well as network performance. For the time being, one of the most important creative technological advancements that plays a significant role in the professional world today is blockchain technology. Blockchain technology moves in the direction of persistent revolution and change. It is a chain of blocks that covers information and maintains trust between individuals no matter how far apart they are. Recently, blockchain was integrated into intrusion detection systems to enhance their overall performance. Blockchain has also been adopted in healthcare, supply chain management, and the Internet of Things. Blockchain uses robust cryptography with private and public keys, and it has numerous properties that have leveraged security’s performance over peer-to-peer networks without the need for a third party. To explore and highlight the importance of integrating blockchain with intrusion detection systems, this paper provides a comprehensive background of intrusion detection systems and blockchain technology. Furthermore, a comprehensive review of emerging intrusion detection systems based on blockchain technology is presented. Finally, this paper suggests important future research directions and trending topics in intrusion detection systems based on blockchain technology.
Caciano dos Santos Machado, Renan R. S. dos Santos, Carla Merkle Westphall
Community networks are prone to free-riders, i.e., participants who take advantage of cooperation from others' routers but do not contribute reciprocally. In this paper, we present HARPIA, a system for credit-based incentive mechanisms for data forwarding in community networks aimed to prevent selfish behavior. HARPIA does not require a trusted third-party or tamper-resistant security modules as in other incentive mechanisms. Instead, it uses a distributed accounting scheme (DPIFA) to estimate the balance of data forwarding contribution and consumption of each network router and settle correspondent cryptocurrency debts on an Ethereum smart contract. On-chain settlement transactions are performed every HARPIA cycle (e.g., daily, weekly, monthly) and must be validated by at least m-of-n network routers using a multi-signature scheme (MuSig). We also realized a performance evaluation, security threat assessment, and cryptocurrency costs estimation. Results show that our proposal is suitable for community networks with up to 64 infrastructure routers under specific m-of-n MuSig thresholds.
Social media news are most important in today's worlds, it puts positive or negative influence on social views. There is a wide propagation of fake news on social media so it will be difficult to believe on the news. Fake news has negative impacts on individuals as well as on society. Information spreads rapidly over the social media and so there is a need of mechanism which detects and stops the spreading of fake news. Therefore, detection of fake news is the need of time and also a challenging problem. The goal of this proposed research work is to detect fake news and minimize spreading of the fake news. In the proposed research a machine learning approach is used for detection of fake news with blockchain framework. In first section a supervised machine learning techniques is design to identify the trustiness of specific news while blockchain framework revoke the malicious activity of spreading fake news. A blockchain environment is created with mining, smart contract as well as Proof of Work (PoW) of consensus. The current systematic review broadly focuses on the various methods to detect fake news in social media. After partial implementation of system, performance evaluation has done with traditional blockchain framework. It is found that 10% less time for transaction verification by consensus in P2P environment over the existing systems.
The development and application of blockchain technology makes it possible to build a more robust and flexible botnet command and control channel. In order to better study this type of potential new botnet threats, a highly confrontational botnet model based on blockchain smart contracts-SCBot was proposed. The SCBot model adopts a hierarchical hybrid topology structure, builds a command transmission channel based on smart contracts at the zombie subnet layer, and establishes a credibility evaluation mechanism to determine the authenticity of nodes, and enhances the confrontation of the network from the two major levels of traffic and terminals. The construction of small botnet clusters were simulated, comparative experiments on SCBot's command transmission efficiency and robustness were conducted, and its feasibility in the real environment from the perspective of economic costs was analyzed. Finally, a brief analysis and discussion of the defense strategy of this type of botnet were given.
In distributed environments, such as distributed ledgers technologies and other peer-to-peer architectures, communication represents a crucial topic. The ability to efficiently disseminate contents is strongly influenced by the type of system architecture, the protocol used to spread such contents over the network and the actual dynamicity of the communication links (i.e. static vs. temporal nets). In particular, the dissemination strategies either focus on achieving an optimal coverage, minimizing the network traffic or providing assurances on anonymity (that is a fundamental requirement of many cryptocurrencies). In this work, the behaviour of multiple dissemination protocols is discussed and studied through simulation. The performance evaluation has been carried out on temporal networks with the help of LUNES-temporal, a discrete event simulator that allows to test algorithms running on a distributed environment. The experiments show that some gossip protocols allow to either save a considerable number of messages or to provide better anonymity guarantees, at the cost of a little lower coverage achieved and/or a little increase of the delivery time.
The popularity and amazing attractiveness of cryptocurrencies, and especially Bitcoin, absorb countless enthusiasts daily. Although Blockchain technology prevents fraudulent behavior, it cannot detect fraud on its own. There are always unimaginable ways to commit fraud, and the need to use anomaly detection methods to identify abnormal and fraudulent behaviors has become a necessity. The main purpose of this study is to present a new method for detecting anomalies in Bitcoin with more appropriate efficiency. For this purpose, in this study, the diagnosis of the collective anomaly was used, and instead of diagnosing the anomaly of individual addresses and wallets, the anomaly of users was examined, and the anomaly was more visible among users who had multiple wallets. In addition to using the collective anomaly detection method in this study, the Trimmed_Kmeans algorithm was used for clustering and the proposed method succeeded in identifying 14 users who had committed theft, fraud, and hack with 26 addresses in 9 cases. Compared to previous works, which detected a maximum of 7 addresses in 5 cases of fraud, the proposed method has performed well. Therefore, the proposed method, by presenting a new approach, in addition to reducing the processing power to extract features, succeeded in detecting abnormal users and also was able to find more transactions and addresses committed a scam.
Android mobile devices are a prime target for a huge number of cyber-criminals as they aim to create malware for disrupting and damaging the servers, clients, or networks. Android malware are in the form of malicious apps, that get downloaded on mobile devices via the Play Store or third-party app markets. Such malicious apps pose serious threats like system damage, information leakage, financial loss to user, etc. Thus, predicting which apps contain malicious behavior will help in preventing malware attacks on mobile devices. Identifying Android malware has become a major challenge because of the ever-increasing number of permissions that applications ask for, to enhance the experience of the users. And most of the times, permissions and other features defined in normal and malicious apps are generally the same. In this paper, we aim to detect Android malware using machine learning, deep learning, and natural language processing techniques. To delve into the problem, we use the Android manifest files which provide us with features like permissions which become the basis for detecting Android malware. We have used the concept of information value for ranking permissions. Further, we have proposed a consensus-based blockchain framework for making more concrete predictions as blockchain have high reliability and low cost. The experimental results demonstrate that the proposed model gives the detection accuracy of 95.44% with the Random Forest classifier. This accuracy is achieved with top 45 permissions ranked according to Information Value.
TeraFlow proposes a new type of secure, cloud-native Software Defined Networking (SDN) controller that will radically advance the state-of-the-art in beyond 5G networks by introducing novel micro-services architecture, and provide revolutionary features for both flow management (service layer) and optical/microwave network equipment integration (infras-tructure layer) by adapting new data models. TeraFlow will also incorporate security using Machine Learning (ML) and forensic evidence for multi-tenancy based on Distributed Ledgers. Finally, this new SDN controller shall be able to integrate with the current Network Function Virtualization (NFV) and Multi-access Edge Computing (MEC) frameworks as well as to other networks. The target pool of TeraFlow stakeholders expands beyond the traditional telecom operators towards edge and hyperscale cloud providers.
Cryptocurrencies do not only allow for money transfers in the absence of a trusted third party but also enable the execution of distributed applications. Due to the rapid pace of development of cryptocurrencies, the foundations of such applications have not been rigorously studied. This is particularly problematic since in these applications, real money is at stake, and security breaches regularly cause severe financial losses.In this thesis, we present two systematic approaches to reliably verify the security of distributed blockchain applications based on formal foundations. To this end, we focus on the cryptocurrencies with the highest market capitalization, Bitcoin and Ethereum. In Ethereum, distributed applications are realized as smart contracts, reactive programs written in Ethereum’s expressive scripting language. In contrast, Bitcoin supports only a basic scripting language, and advanced applications are realized as peer-to-peer cryptographic protocols that resort to the execution of simple smart contracts in case of disputes among peers. As a result, the challenge in verifying distributed applications on the Ethereum blockchain lies in the study and abstraction of the semantics of Ethereum’s evolved scripting language, whereas Bitcoin, the study of distributed applications, requires a systematic analysis of the cryptographic protocols.In the thesis, we first formalize the formerly under-specified semantics of Ethereum’s native smart contract language EVM bytecode and implement the semantics in the proof assistant F*. In this context, we formally characterize relevant generic properties for smart contract security, which capture real-world attack scenarios.We then survey existing automated static analyzers for Ethereum smart contracts unveiling the weaknesses in the semantic foundations of these tools and the practical impact of these weaknesses on the analysis results. Based on these findings, we propose our own automatic static analysis tool for Ethereum smart contracts, which comes with a rigorous soundness proof while still showing competitive performance. In this course, we also propose a general framework for the modular and semantic-driven development of automatic static analyzers. Finally, we study the security of payment channel networks for Bitcoin. Payment channel networks are distributed protocols that allow for efficient and cheap payments between Bitcoin users and offer a promising solution to Bitcoin’s scalability problems. We unveil a security issue in Bitcoin’s existing payment channel network implementation and formally characterize the relevant security and privacy notions in this context. We further develop a cryptographic primitive for the construction of payment channel networks with formal security guarantees
The field of Cryptocurrency has seen tremendous growth and expansion in the last few years. Almost a decade ago the invention of Bitcoin marked a new era of innovation in the financial sector. In our literature survey we take you through the concepts of cryptocurrency outlining its fundamental concepts, the underlying technology like Blockchain and subsequently the viability of this new financial asset. Post examining the knowledge of cryptocurrency we try to predict the price of this volatile asset. Post pricing data and the likelihood of these currencies, specifically Bitcoin. We first examine the price of cryptocurrency or rather try to examine the prices before introducing the Cryptocurrency Analyzer and Predictor web application, as discussed in our project. The research, planning methodologies, technologies, and design and evaluation of this application are described in detail in the later part of this paper followed by a concluding word on this process as a whole.
Bandwidth depletion Denial-of-Service (DoS) attack can impact the propagation of a mined block in the Bitcoin blockchain network. On Bitcoin Proof-of-Work (PoW) consensus several machines try to resolve an expensive cryptographic puzzle faster than anyone else and succeed to mine a valid block. Despite a DoS attack impedes one machine to propagate its mined block allowing it to become valid for most peers, there will be several other peers to resolve the puzzle in time, hence the blockchain will continue to grow. However, from the perspective of the owner of the attacked machine, this can be critical because it will not receive a mining reward. This chapter covers such an attack in the Lisk blockchain that utilizes the Delegated Proof of Stake (DPoS) consensus mechanism. A mitigation strategy was created based on two tools that I have created allowing a delegate account to be configured in more than one node, allowing to forge a block even when one of its nodes is under DoS attack. Also, the transaction flood DoS attack is explored, and a mitigation strategy was created for a specific sidechain in the Lisk ecosystem. The mitigation strategy identifies spam transactions and rejects them to be included on the Lisk nodes transaction pool, hence they will not be propagated into the blockchain. Towards the end, I evaluated scenarios and mitigation strategies created for each attack demonstrating solutions for several scenarios.
Xi He, Ketai He, Shenwen Lin, Jinglin Yang · 5 authors
Abstract Single heuristic method and incomplete heuristic conditions were difficult to cluster a large number of addresses comprehensively and accurately. Therefore, this paper analysed the associations between Bitcoin transactions and addresses and used six heuristic conditions to cluster addresses and entities. We proposed an improved change address detection algorithm and compared it with the original change address algorithm to prove the effectiveness of the improved algorithm. By adding conditional constraints, the identified change address was more accurate, and the convergence speed of the algorithm was accelerated. Our work presented the pseudo‐anonymity mechanism of the Bitcoin system, which could be used by the law enforcement agencies to track and crack down illegal transactions.
Senthilselvi Ayothi, Shiny Duela Johnson, Ramesh Sekaran, Senthil Pandi Sankareshwaran · 6 authors
Abstract Over the last decade, blockchain has been considered an encouraging solution to secure distributed ledgers. Moreover, with the introduction of a pseudonymous payment method without a centralized database or authoritative person, blockchain has also evolved as the future generation for online payment system. However, with the eruption of a large scale database, scalability has also become a demanding issue. In addition to the obstacle mentioned above, challenges like security and scalability stop accelerated adjustments for the development of smart cities. Without directing this essential scalability and privacy issue, such an encouraging method may not help develop smart cities. This paper bestows a measure to analyze both scalability and security aspects of existing blockchain methods with applications of smart city networks. The proposed method is known as Gradient Smart Load Balancer and Blockchain Dempster Shafer Reputation (GSLB-BDSR). Gradient Smart Load Balancer is designed so that even though with the increase in the number of participating sensors, the load is said to balance by applying gradient function, therefore ensuring scalability. Next, to cover the security aspect, with the aid of scalable blocks in the blockchain network, a Blockchain Dempster Shafer Reputation model is proposed. Evaluation outcomes of proposed security solutions outperform conventional solutions.
A good amount of effort has been dedicated to surveying and systematizing Ethereum smart contract security bug classes. There is, however, a gap in literature when it comes to surveying implementation-level security bugs that commonly occur in basic PoW blockchain node implementations, discovered during the first decade of Bitcoin's existence. This paper attempts to fill this void. In particular, if software which participates in a network by validating and generating new blocks is developed from scratch, WCGW - What Could Go Wrong? Ten broad bug type categories are listed and for each category, known examples are linked. Blockchain, as designed by the Satoshi's paper is exciting and introduces several novel bug classes which are interesting to security researchers. The paper is aimed at security testers aiming to start out in blockchain security reviews and blockchain developers as a reference on common pitfalls.
Sajjad Asefi, Yash Madhwal, Yury Yanovich, Elena Gryazina
The application of renewable energy sources in the power grid increases the necessity of tracking the system's state, especially in smart grids, where there is a bidirectional transfer of data and power. The complexity of coupling between communication and the electrical infrastructure in a smart grid will create a higher chance for security breach. Increasing the state estimation accuracy will help the smart grid operator efficiently manage the system. The paper proposes an integration of distributed state estimation with a blockchain designed communication platform. Additionally, the asynchronous manner for data transmission, which is more likely to happen in the real world, has been considered as the second task of this research. Finally, a detailed analysis of the blockchain-based application in distributed state estimation is provided. The numerical analysis shows that the proposed method meets real-world performance requirements and brings high security and reliability to the distributed state estimation process.
Lampis Alevizos, Vinh‐Thong Ta, Mahmoud Hashem Eiza
Abstract With the purpose of defending against lateral movement in today's borderless networks, zero trust architecture (ZTA) adoption is gaining momentum. With a full‐scale ZTA implementation, it is unlikely that adversaries will be able to spread through the network starting from a compromised endpoint. However, the already authenticated and authorized session of a compromised endpoint can be leveraged to carry out limited, though malicious, activities ultimately rendering the endpoints the Achilles heel of ZTA. To effectively detect such attacks, distributed collaborative intrusion detection systems with an attack scenario‐based approach have been developed. Nonetheless, advanced persistent threats have demonstrated their ability to bypass this approach with a high success ratio. As a result, adversaries can pass undetected or potentially alter the detection logging mechanisms to achieve a stealthy presence. Recently, blockchain technology has demonstrated solid use cases in the cyber security domain. In this paper, motivated by the convergence of ZTA and blockchain‐based intrusion detection and prevention, we examine how ZTA can be augmented onto endpoints. Namely, we perform a state‐of‐the‐art review of ZTA models, real‐world architectures with a focus on endpoints, and blockchain‐based intrusion detection systems. We discuss the potential of blockchain's immutability fortifying the detection process and identify open challenges as well as potential solutions and future directions.
<span>Signature-based collaborative intrusion detection system (CIDS) is highly depends on the reliability of nodes to provide IDS attack signatures. Each node in the network is responsible to provide new attack signature to be shared with other node. There are two problems exist in CIDS highlighted in this paper, first is to provide data consistency and second is to maintain trust among the nodes while sharing the attack signatures. Recently, researcher find that blockchain has a great potential to solve those problems. Consensus algorithm in blockchain is able to increase trusts among the node and allows data to be inserted from a single source of truth. In this paper, we are investigating three blockchain consensus algorithms: proof of work (PoW), proof of stake (PoS), and hybrid PoW-PoS chain-based consensus algorithm which are possibly to be implemented in CIDS. Finally, we design an extension of hybrid PoW-PoS chain-based consensus algorithm to fulfill the requirement. This extension we name it as proof of attack signature (PoAS).</span>
In blockchain, approved transactions, including illegal ones, cannot be modified unlike existing bank transactions. To prevent the damage caused by illegal transactions, rapid anomaly detection of transactions is required because transactions can be modified before approval. However, existing anomaly detection methods must process all transactions in blockchain, and the processing time is longer than the interval of each approval. In this paper, we propose a subgraph-based anomaly detection method to perform the detection using a part of the blockchain data. The proposed structure of the subgraph is suitable for graphics processing units (GPUs) to accelerate detection by using parallel processing. In an evaluation using real Bitcoin transaction data, when the number of targeted transactions was one hundred, the proposed method was 11.1x faster than an existing GPU-based method without lowering the detection accuracy.
O. Lutz, Huili Chen, Hossein Fereidooni, Christoph Sendner · 7 authors
Ethereum smart contracts are automated decentralized applications on the blockchain that describe the terms of the agreement between buyers and sellers, reducing the need for trusted intermediaries and arbitration. However, the deployment of smart contracts introduces new attack vectors into the cryptocurrency systems. In particular, programming flaws in smart contracts can be and have already been exploited to gain enormous financial profits. It is thus an emerging yet crucial issue to detect vulnerabilities of different classes in contracts in an efficient manner. Existing machine learning-based vulnerability detection methods are limited and only inspect whether the smart contract is vulnerable, or train individual classifiers for each specific vulnerability, or demonstrate multi-class vulnerability detection without extensibility consideration. To overcome the scalability and generalization limitations of existing works, we propose ESCORT, the first Deep Neural Network (DNN)-based vulnerability detection framework for Ethereum smart contracts that support lightweight transfer learning on unseen security vulnerabilities, thus is extensible and generalizable. ESCORT leverages a multi-output NN architecture that consists of two parts: (i) A common feature extractor that learns the semantics of the input contract; (ii) Multiple branch structures where each branch learns a specific vulnerability type based on features obtained from the feature extractor. Experimental results show that ESCORT achieves an average F1-score of 95% on six vulnerability types and the detection time is 0.02 seconds per contract. When extended to new vulnerability types, ESCORT yields an average F1-score of 93%. To the best of our knowledge, ESCORT is the first framework that enables transfer learning on new vulnerability types with minimal modification of the DNN model architecture and re-training overhead.
Bin Wang, Han Liu, Chao Liu, Zhiqiang Yang · 7 authors
Decentralized finance, i.e., DeFi, has become the most popular type of application on many public blockchains (e.g., Ethereum) in recent years. Compared to the traditional finance, DeFi allows customers to flexibly participate in diverse blockchain financial services (e.g., lending, borrowing, collateralizing, exchanging etc.) via smart contracts at a relatively low cost of trust. However, the open nature of DeFi inevitably introduces a large attack surface, which is a severe threat to the security of participants funds. In this paper, we proposed BLOCKEYE, a real-time attack detection system for DeFi projects on the Ethereum blockchain. Key capabilities provided by BLOCKEYE are twofold: (1) Potentially vulnerable DeFi projects are identified based on an automatic security analysis process, which performs symbolic reasoning on the data flow of important service states, e.g., asset price, and checks whether they can be externally manipulated. (2) Then, a transaction monitor is installed offchain for a vulnerable DeFi project. Transactions sent not only to that project but other associated projects as well are collected for further security analysis. A potential attack is flagged if a violation is detected on a critical invariant configured in BLOCKEYE, e.g., Benefit is achieved within a very short time and way much bigger than the cost. We applied BLOCKEYE in several popular DeFi projects and managed to discover potential security attacks that are unreported before. A video of BLOCKEYE is available at https://youtu.be/7DjsWBLdlQU.
The Internet of Things (IoT) has been revolutionizing this world by introducing exciting applications almost in all walks of daily life, such as healthcare, smart cities, smart environments, safety, remote sensing, and many more. This paper proposes a new framework based on the blockchain and deep learning model to provide more security for Android IoT devices. Moreover, our framework is capable to find the malware activities in a real-time environment. The proposed deep learning model analyzes various static and dynamic features extracted from thousands of feature of malware and benign apps that are already stored in blockchain distributed ledger. The multi-layer deep learning model makes decisions by analyzing the previous data and follow some steps. Firstly, it divides the malware feature into multiple level clusters. Secondly, it chooses a unique deep learning model for each malware feature set or cluster. Finally, it produces the decision by combining the results generated from all cluster levels. Furthermore, the decisions and multiple-level clustering data are stored in a blockchain that can be further used to train every specialized cluster for unique data distribution. Also, a customized smart contract is designed to detect deceptive applications through the blockchain framework. The smart contract verifies the malicious application both during the uploading and downloading process of Android apps on the network. Consequently, the proposed framework provides flexibility to features for run-time security regarding malware detection on heterogeneous IoT devices. Finally, the smart contract helps to approve or deny to uploading and downloading harmful Android applications.
Cryptocurrencies have emerged as a new form of digital money that has not escaped the eyes of cyber-attackers. Traditionally, they have been maliciously used as a medium of exchange for proceeds of crime in the cyber dark-market by cyber-criminals. However, cyber-criminals have devised an exploitative technique of directly acquiring cryptocurrencies from benign users' CPUs without their knowledge through a process called crypto mining. The presence of crypto mining activities in a network is often an indicator of compromise of illegal usage of network resources for crypto mining purposes. Crypto mining has had a financial toll on victims such as corporate networks and individual home users. This paper addresses the detection of crypto mining attacks in a generic network environment using dynamic network characteristics. It tackles an in-depth overview of crypto mining operational details and proposes a semi-supervised machine learning approach to detection using various crypto mining features derived from complex network characteristics. The results demonstrate that the integration of semi-supervised learning with complex network theory modeling is effective at detecting crypto mining activities in a network environment. Such an approach is helpful during security mitigation by network security administrators and law enforcement agencies.
Network topology is one of the major factors in defining the behavior of a network. In the present scenario, the demand for network security has increased due to an increase in the possibility of attacks by malicious users. In this paper, a blockchain-based system is suggested for securely discovering and storing networks. Techniques such as cloud-based storage systems are not efficient and are lacking in trust, privacy, security, and data control. The blockchain-based technique suggested in this paper is capable of resolving these challenges. Experiments were performed using Mininet, Cisco Packet Tracer, and Ethereum blockchain with the network inference algorithm. This algorithm is capable of inferring the network topology even when only partial information regarding the network is available. The results obtained clearly show that the network is resistant to malicious users and various external attacks, making the network robust.
In the current work we discuss the notion of gateways as a means for interoperability across different blockchain systems. We discuss two key principles for the design of gateway nodes and scalable gateway protocols, namely (i) the opaque ledgers principle as the analogue of the autonomous systems principle in IP datagram routing, and (ii) the externalization of value principle as the analogue of the end-to-end principle in the Internet architecture. We illustrate the need for a standard gateway protocol by describing a unidirectional asset movement protocol between two peer gateways, under the strict condition of both blockchains being private/permissioned with their ledgers inaccessible to external entities. Several aspects of gateways and the gateway protocol is discussed, including gateway identities, gateway certificates and certificate hierarchies, passive locking transactions by gateways, and the potential use of delegated hash-locks to expand the functionality of gateways.