As smart contracts process digital assets, their security is essential for blockchain applications. Many approaches have been proposed to detect smart contract vulnerabilities. Studies show that few of the reported vulnerabilities are exploited and hypothesize that many of the reported vulnerabilities are false positives. However, no follow-up study is performed to confirm the hypothesis and understand why the reported vulnerabilities are not exploited. In this study, we first collect 136,969 unique real-world smart contracts and analyze them using four vulnerability detectors, namely Oyente, SmartCheck, Slither, and SolDetector. Then, we apply Straussâ grounded theory approach to manually analyze the source code of the smart contracts reported as vulnerable to recognizing false positives and understand the reasons for false results. In addition, we analyze the transaction logs of the smart contracts reported as vulnerable to identifying and understanding their exploitations. Our results show that 75.37% of the 4,364 smart contracts reported as vulnerable are false positives, and eleven reasons are causing the false positives. After analyzing the 4,106,134 transaction logs of the contracts reported as vulnerable, we find that vulnerabilities of only 67 (0.015%) of the contracts have been exploited in history. We also identify six reasons for demotivating and preventing the attackers from exploiting the vulnerabilities. Our results reveal that state-of-the-art smart contract vulnerability detectors primarily treat the smart contracts as yet another application developed using Object Oriented (OO) languages when analyzing and reporting the smart contract vulnerabilities. Without considering the specific design principles of the Solidity programming language and the characteristics of smart contractsâ application scenarios and execution environments, many of the reported vulnerabilities are not exploitable or not cost-effective to be exploited by adversaries.
Sebastian Holler, Sebastian Biewer, Clara Schneidewind
The cryptocurrency Ethereum is the most widely used execution platform for smart contracts. Smart contracts are distributed applications, which govern financial assets and, hence, can implement advanced financial instruments, such as decentralized exchanges or autonomous organizations (DAOs). Their financial nature makes smart contracts an attractive attack target, as demonstrated by numerous exploits on popular contracts resulting in financial damage of millions of dollars. This omnipresent attack hazard motivates the need for sound static analysis tools, which assist smart contract developers in eliminating contract vulnerabilities a priori to deployment. Vulnerability assessment that is sound and insightful for EVM contracts is a formidable challenge because contracts execute low-level bytecode in a largely unknown and potentially hostile execution environment. So far, there exists no provably sound automated analyzer that allows for the verification of security properties based on program dependencies, even though prevalent attack classes fall into this category. In this work, we present HoRStify, the first automated analyzer for dependency properties of Ethereum smart contracts based on sound static analysis. HoRStify grounds its soundness proof on a formal proof framework for static program slicing that we instantiate to the semantics of EVM bytecode. We demonstrate that HoRStify is flexible enough to soundly verify the absence of famous attack classes such as timestamp dependency and, at the same time, performant enough to analyze real-world smart contracts.
Millions of smart contracts have been deployed onto the Ethereum platform, posing potential attack subjects. Therefore, analyzing contract binaries is vital since their sources are unavailable, involving identification comprising function entry identification and detecting its boundaries. Such boundaries are critical to many smart contract applications, e.g. reverse engineering and profiling. Unfortunately, it is challenging to identify functions from these stripped contract binaries due to the lack of internal function call statements and the compiler-inducing instruction reshuffling. Recently, several existing works excessively relied on a set of handcrafted heuristic rules which impose several faults. To address this issue, we propose a novel neural network-based framework for EVM bytecode Function Entries and Boundaries Identification (neural-FEBI) that does not rely on a fixed set of handcrafted rules. Instead, it used a two-level bi-Long Short-Term Memory network and a Conditional Random Field network to locate the function entries. The suggested framework also devises a control flow traversal algorithm to determine the code segments reachable from the function entry as its boundary. Several experiments on 38,996 publicly available smart contracts collected as binary demonstrate that neural-FEBI confirms the lowest and highest F1-scores for the function entries identification task across different datasets of 88.3 to 99.7, respectively. Its performance on the function boundary identification task is also increased from 79.4% to 97.1% compared with state-of-the-art. We further demonstrate that the identified function information can be used to construct more accurate intra-procedural CFGs and call graphs. The experimental results confirm that the proposed framework significantly outperforms state-of-the-art, often based on handcrafted heuristic rules.
As is well known, smart contracts on the blockchain store plenty of digital assets, and these contracts deployed on the blockchain are difficult to be modified. For this reason, the analysis and detection of smart contract vulnerabilities have received extensive attention. Smartcheck, a typical Java-implemented static analysis tool of smart contracts, is capable of converting Solidity source code into path diagrams based on the lexical and syntactic analysis, and finds smart contract vulnerabilities by path matching. Although Smartcheck can analyze most of the real-world vulnerabilities, some imperceptible vulnerabilities may be ignored, causing huge economic losses. In order to address these issues, we develop a new tool named MSmart to analyze the vulnerabilities of high risk such as timestamp dependence vulnerabilities, integer overflow vulnerabilities, self-destruct vulnerabilities, etc. MSmart converts the smart contract source code into an intermediate representation, and looks for smart contract vulnerabilities based on intermediate representation and XPath rules. We add new intermediate representation rules of Smartcheck to detect more kinds of vulnerabilities and optimize existing rules to suit the complexity of smart contract. We also implemented smart contract batch detection to shorten the time it takes to find vulnerabilities. To analysis the performance of MSmart, we collect 6000 real-world contracts from Etherscan and design some comparative experiments with other tools. The results of experiment show that MSmart is able to analyze related vulnerabilities better, and false positives and false negatives have been reduced due to our improvements.
Abstract The attack named Distributed Denial of Service (DDoS) that takes place in the large blockchain network requires an efficient and robust attack detection and prevention mechanism for authenticated access. Blockchain is a distributed network in which the attacker tries to hack the network by utilizing all the resources with the application of enormous requests. Several methods like Rival Technique, filter modular approach and so on, were developed to detect and prevent the DDoS attack in the blockchain; still, detection accuracy is a challenging task. Hence, this research introduces an efficient technique using optimizationâbased deep learning by considering the blockchain network and smart contract for the detection and prevention of DDoS attacks. Based on the user request, the traffic is analyzed, and the verification using the smart contract is made to find the authenticated user. After the verification, the response is provided for the authenticated user, and the suspicious traffic is utilized for the detection of DDoS attacks using the Poaching Raptor Optimizationâbased deep neural network (Poaching Raptorâbased DNN), in which the classifier is tuned using the proposed optimization algorithm to reduce the training loss. The proposed algorithm is designed by hybridizing the habitual practice of the raptor by considering the concurring behavior, hunting style along with poaching behavior of the Lobo to enhance the detection accuracy. After the attack detection, the nonattacker is responded, and the attacker is prevented by entering the IP/MAC address in the logfile. The performance of the proposed method is evaluated in terms of recall, precision, FPR, and accuracy and obtained the values of 96.3%, 98.22%, 3.33%, and 95.12%, respectively.
With the growing demand for application software , there is a race among industries to develop software as quickly as possible. However, maintaining pace and ensuring bug-free software has become increasingly challenging in a work-from-home arrangement as software developers are not under constant supervision. It increases the possibility of buggy products, and traditional testing techniques fail to provide optimal performance . We propose an Artificial Intelligence (AI) and blockchain-based novel decentralized software testing system. The proposed system aims to detect and prevent vulnerable code by synergizing deep learning capabilities and smart-contract-powered blockchain . The vulnerability detection is performed automatically without relying on manually written rules. We propose a non-vulnerability score range map to classify the source code . Furthermore, we integrate an InterPlanetary File System (IPFS) to ensure efficient storage over the blockchain . We conduct a testbed-based experiment to demonstrate the effectiveness of AI and blockchain integration for secure code development and testing.
Abstract In areas of activity where the notion of accountability is strong, the adoption of artificial intelligence (AI) is limited by the opacity and lack of understanding of its behavior, all the more so in the embedded domain where neural networks are compressed and executed on microcontrollers. While the NIST introduced in 2021 several principles allowing the AI explainability, this paper introduces a novel scheme, HistoTrust, combining secure hardware and blockchain technology to bring trust in the traceability of AI behavior and allow its explainability. HistoTrust attests in an Ethereum ledger all the relevant data produced by a physical device, especially the heuristics inferred by AI. Thus, the audition of the ledger allows security verifications and AI behavior analysis.
Open access
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security
Ransomware attacks are one of the most dangerous related crimes in the coin market. To increase the challenge of fighting the attack, early detection of ransomware seems necessary. In this article, we propose a high-performance Bitcoin transaction predictive system that investigates Bitcoin payment transactions to learn data patterns that can recognize and classify ransomware payments for heterogeneous bitcoin networks into malicious or benign transactions. The proposed approach makes use of three supervised machine learning methods to learn the distinctive patterns in Bitcoin payment transactions, namely, logistic regression (LR), random forest (RF), and Extreme Gradient Boosting (XGBoost). We evaluate these ML-based predictive models on the BitcoinHeist ransomware dataset in terms of classification accuracy and other evaluation measures such as confusion matrix, recall, and F1-score. It turned out that the experimental results recorded by the XGBoost model achieved an accuracy of 99.08%. As a result, the resulting model accuracy is higher than many recent state-of-the-art models developed to detect ransomware payments in Bitcoin transactions.
Bello Musa Yakubu, Majid Iqbal Khan, Abid Khan, Farhana Jabeen · 5 authors
Smart home devices are vulnerable to a variety of attacks. The matter gets more complicated when a number of devices collaborate to launch a colluding attack (e.g. Distributed-Denial-of-Service (DDoS)) in a network (e.g., Smart home). To handle these attacks, most studies have hitherto proposed authentication protocols that cannot necessarily be implemented in devices, especially during Device-to-Device (D2D) interactions. Tapping into the potential of Ethereum blockchain and smart contracts, this work proposes a lightweight authentication mechanism that enables safe D2D interactions in a smart home. The Ethereum blockchain enables the implementation of a decentralized prototype as well as a peer-to-peer distributed ledger system. The work also uses a single server queuing system model and the authentication mechanism to curtail DDoS attacks by controlling the number of service requests in the system. The simulation was conducted twenty times, each with varying number of devices chosen at random (ranging from 1 to 30). Each requester device sends an arbitrary request with a unique resource requirement at a time. This is done to measure the system's consistency across a variety of device capabilities. The experimental results show that the proposed protocol not only prevents colluding attacks, but also outperforms the benchmark protocols in terms of computational cost, message processing, and response times.
With the increase of the adoption of blockchain technology in providing decentralized solutions to various problems, smart contracts have become more popular to the point that billions of US Dollars are currently exchanged every day through such technology. Meanwhile, various vulnerabilities in smart contracts have been exploited by attackers to steal cryptocurrencies worth millions of dollars. The automatic detection of smart contract vulnerabilities therefore is an essential research problem. Existing solutions to this problem particularly rely on human experts to define features or different rules to detect vulnerabilities. However, this often causes many vulnerabilities to be ignored, and they are inefficient in detecting new vulnerabilities. In this study, to overcome such challenges, we propose a framework to automatically detect vulnerabilities in smart contracts on the blockchain. More specifically, first, we utilize novel feature vector generation techniques from bytecode of smart contract as source code is rarely publicly available. These feature vectors are then analyzed using our innovative metric learning-based Deep Neural Networks (DNNs) to produce detection results. The frameworkâs predictions are further refined through a voting mechanism to achieve consensus. We conduct comprehensive experiments on large-scale benchmarks, and the quantitative results demonstrate the effectiveness and efficiency of our approach.
Abstract The Internet of Vehicles (IoV) is the next phase in the evolution of vehicular ad hoc networks (VANETs).Multiple types of Smart Networks exists in our surrounding.i.e., Wireless Sensor Networks (WSNs), Crowd Sensing Networks (CSNs), and Internet of Vehicles, etc A VANET is a collection of mobile nodes (vehicles) that share data through ad hoc on-demand connections. Vehicle Tracking is one of the uses of IOV(Internet of Vehicles) and Vehicle Security is one of the major issues for all vehicle owners. On a vehicle, there are various on-board sensors that sense a vehicleâs motion and the surrounding environment. On-board sensors can also warn drivers about approaching vehicles, speeding, and slippery road conditions. The main aim of the paper is to provide solutions for False Data Injection Attack by Integration of Blockchain Based IPFS-Trust Management System with ML SVR Regression Model. Due to Network Assaults and Threats under Vanet System, the safety of the drivers is under stake and Critical. A rogue node can send out erroneous messages, causing unavoidable scenarios. We first filter the received data from Vehicles creating false traffic jam warning messages using the Machine learning SVR Regression Model where data is created and split into train and test data. We used Machine learning supervised algorithm to find whether the vehicle is a legitimate vehicle or an attacker vehicle and the result is validated using the parameters like Accuracy, Loss Rate, Precision, Recall, and F-Test Score. Algorithm Implementation results show that the FDIA attack strategy achieves a better performance than the without using ML algorithm of SVR Regression Model based attack strategy in Predicting the Vanet Security. Also, we studied the various ways to mitigate the impact of false data injection into the network through a compromised node. Users can access the system through DApp, an Ethereum-distributed application, and manage their vehicle data.
Smart contracts are programs that execute transactions involving independent parties and cryptocurrencies. As programs, smart contracts are susceptible to a wide range of errors and vulnerabilities. Such vulnerabilities can result in significant losses. Furthermore, by design, smart contract transactions are irreversible. This creates a need for methods to ensure the correctness and security of contracts pre-deployment. Recently there has been substantial research into such methods. The sheer volume of this research makes articulating state-of-the-art a substantial undertaking. To address this challenge, we present a systematic review of the literature. A key feature of our presentation is to factor out the relationship between vulnerabilities and methods through properties. Specifically, we enumerate and classify smart contract vulnerabilities and methods by the properties they address. The methods considered include static analysis as well as dynamic analysis methods and machine learning algorithms that analyze smart contracts before deployment. Several patterns about the strengths of different methods emerge through this classification process.
Piergiuseppe Di Pilla, Remo Pareschi, Francesco Salzano, Federico Zappone
Introduction In recent years, software ecosystems have become more complex with the proliferation of distributed systems such as blockchains and distributed ledgers. Effective management of these systems requires constant monitoring to identify any potential malfunctions, anomalies, vulnerabilities, or attacks. Traditional log auditing methods can effectively monitor the health of conventional systems. Yet, they run short of handling the higher levels of complexity of distributed systems. This study aims to propose an innovative architecture for system auditing that can effectively manage the complexity of distributed systems using advanced data analytics, natural language processing, and artificial intelligence. Methods To develop this architecture, we considered the unique characteristics of distributed systems and the various signals that may arise within them. We also felt the need for flexibility to capture these signals effectively. The resulting architecture utilizes advanced data analytics, natural language processing, and artificial intelligence to analyze and interpret the various signals emitted by the system. Results We have implemented this architecture in the DELTA (Distributed Elastic Log Text Analyzer) auditing tool and applied it to the Hyperledger Fabric platform, a widely used implementation of private blockchains. Discussion The proposed architecture for system auditing can effectively handle the complexity of distributed systems, and the DELTA tool provides a practical implementation of this approach. Further research could explore this approach's potential applications and effectiveness in other distributed systems.
A smart contract, as an important part of blockchain technology, has attracted considerable interest from both industry and academia. It provides the basis for the realization of a variety of practical blockchain applications and plays a crucial role in the blockchain ecosystem. While it also holds a large number of digital assets, the frequent occurrence of smart contract vulnerabilities have caused huge economic losses and destroyed the blockchain-based credit system. Currently, the security and reliability of smart contracts have become a new focus of research, and there are a number of smart contract vulnerability detection methods, such as traditional detection tools based on static or dynamic analysis. However, most of them often rely on expert rules, and therefore have poor scalability and high false negative and false positive rates. Recent deep learning methods alleviate this issue, but without considering the semantic information and context of source code. To this end, we propose a hybrid attention mechanism (HAM) model to detect security vulnerabilities in smart contracts. We extract code fragments from the source code, which focus on key points of vulnerability. We conduct extensive experiments on two public smart contract datasets (a total of 24,957 contracts). Empirical results show remarkable accuracy improvement over the state-of-the art methods on five kinds of vulnerabilities, where the detection accuracy could achieve 93.36%, 80.85%, 82.56%, 85.62%, and 82.19% for reentrancy, arithmetic vulnerability, unchecked return value, timestamp dependency, and tx.origin, respectively.
Ălvaro Reyes, Miguel Jimeno, Ricardo Villanueva-Polanco
As part of agile methodologies seen in the past few years, IT organizations have continuously adopted new practices in their software delivery life-cycle to improve both efficiency and effectiveness of development teams. Two of these practices are continuous integration and continuous deployment, which are part of the DevOps cycle which has helped organizations build software effectively and efficiently. These practices must be considered for new technologies such as smart contracts, where security concerns and bugs might cost more once deployed than traditional software. This paper states the importance of using a proper DevOps routine and how it is possible to apply this practice to a smart contract build. Specifically, this paper introduces a framework to implement DevOps for smart contracts development by describing multiple DevOps tools and their applicability to smart contract development.
Currently, when a security analyst discovers a vulnerability in critical software system, they must navigate a fraught dilemma: immediately disclosing the vulnerability to the public could harm the systemâs users; whereas disclosing the vulnerability only to the softwareâs vendor lets the vendor disregard or deprioritize the security risk, to the detriment of unwittingly-affected users. A compelling recent line of work aims to resolve this by using Zero Knowledge (ZK) protocols that let analysts prove that they know a vulnerability in a program, without revealing the details of the vulnerability or the inputs that exploit it. In principle, this could be achieved by generic ZK techniques. In practice, ZK vulnerability proofs to date have been restricted in scope and expressibility, due to challenges related to generating proof statements that model real-world software at scale and to directly formulating violated properties. This article presents Cheesecloth , a novel proof-statement compiler, which proves practical vulnerabilities in ZK by soundly-but-aggressively preprocessing programs on public inputs, selectively revealing information about executed control segments, and formalizing information leakage using a novel storage-labeling scheme. Cheesecloth âs practicality is demonstrated by generating ZK proofs of well-known vulnerabilities in (previous versions of) critical software, including the Heartbleed information leakage in OpenSSL, a memory vulnerability in the FFmpeg multimedia encoding framework, a cryptographic implementation bug in the Secure Scuttlebutt decentralised social network, and a denial of service vulnerability in OpenSSL.
Emmanuel Baldwin Mbaya, Emmanuel Adetiba, Joke A. Badejo, John S. Wejin · 9 authors
Cloud computing is a technology for efficiently using computing infrastructures and a business model for selling computing resources and services. However, intruders find such complex and distributed infrastructures appealing targets for cyber-attacks. Cyber-attacks are severe threats that can jeopardize the quality of service provided to clients and compromise data integrity, confidentiality, and availability. Cyber-attacks are becoming more complex, making it more challenging to detect intrusions effectively. Due to the high traffic and increased malicious activities on the Internet, a single Intrusion Detection System (IDS) can be overwhelmed. Despite the various Deep Learning (DL) approaches that have been proposed as alternative solutions, there are still pertinent security issues to be addressed especially in federated cloud computing domains. This work proposes a Secure Federated Intrusion Detection Model Version 1 (SecFedIDM-V1) using blockchain technology and Bidirectional Long Short-Term Memory (BiLSTM) Recurrent Neural Network (RNN). The Cobourg Intrusion Detection Dataset (CIDDS) was acquired, pre-processed and split into 60:20:20, 70:15:15, and 80:10:10 for training, testing, and validation respectively to develop the proposed intrusion traffic classification component of the proposed model. The developed SecFedIDM-V1 was later deployed as a Python-based web application that captures network packets for classifying attacks into normal or an attack type. The attack packets are recorded in a Hyperledger Fabric (a private blockchain technology) to serve as a signature database to be used by other nodes in the network. From the evaluation results of the intrusion classifier, the 80:10:10 BiLSTM network performed better than GRU with a Precision of 0.99624, Recall of 0.99906, F1 Score of 0.99614, False Positive Rate (FPR) of 0.00094, False Negative Rate (FNR) of 0.00395 and True Positive Rate (TPR) of 0.99605. The SecFedIDM-V1 can be deployed alongside Firewalls in a federated cloud computing environment to reinforce the security of the infrastructure.
S Sheela, S. Shalini, D Sai Harsha, Vani Chandrashekar · 5 authors
This research introduces an approach to detect malware attacks using blockchain technology that integrates signature-based and behavioralbased methods. The proposed system uses a decentralized blockchain network to share and store malware signatures and behavioral patterns. This enables faster and more efficient detection of new malware files. The signature-based method involves storing the signatures in the blockchain and the sharing of the signature of malware files among the user nodes of the p2p blockchain network, while the behavioral-based approach analyzes the behavior and actions of files in a separate virtualized environment to identify suspicious patterns. This system addresses the limitations of conventional signature-based methods, which can be evaded by polymorphic malware, and behavioral-based methods, which may generate false positives. The results of the evaluation indicate that the proposed system achieves high detection rates while maintaining low false positives. Overall, the proposed system offers an effective and efficient approach to malware detection by utilizing the strengths of both signature-based and behavioral-based methods and utilizing the security and transparency benefits of blockchain technology.
Ahmed A. M. Sharadqh, Hazem Hatamleh, Asâad Mahmoud Asâad Alnaser, Said S. Saloum · 5 authors
Internet of Things (IoT) is an emerging technology and its applications are flattering amidst many users, as it makes everything easier. As a consequence of its massive growth, security and privacy are becoming crucial issues where the IoT devices are perpetually vulnerable to cyber-attacks. To overcome this issue, intrusion detection and mitigation is accomplished which enhances the security in IoT networks. In this paper, we proposed Blockchain entrenched Bi-level intrusion detection and graph based mitigation framework named as HybridChain-IDS. The proposed work embrace four sequential processes includes time-based authentication, user scheduling and access control, bi-level intrusion detection and attack graph generation. Initially, we perform time-based authentication to authenticate the legitimate users using NIK-512 hashing algorithm, password and registered time are stored in Hybridchain which is an assimilation of blockchain and Trusted Execution Environment (TEE) which enhances data privacy and security. After that, we perform user scheduling using Cheetah Optimization Algorithm (COA) which reduces the complexity and then the access control is provided to authorized users by smart contract by considering their trust and permission level. Then, we accomplish bi-level intrusion detection using ResCapsNet which extracts sufficient features and classified effectively. Finally, risk of the attack is evaluated, and then the attacks graphs are generated by employing Enhanced k-nearest neighbor (KNN) algorithm to identify the attack path. Furthermore, the countermeasures are taken based on the attack risk level and the attack graph is stored in Hybridchain for eventual attack prediction. The implementation of this proposed work is directed by network simulator of NS-3.26 and the performance of the proposed HybridChain-IDS is enumerated based on various performance metrics.
Data integrity and security protection are needed in the Internet of Things. IOTA technology with a Directed Acyclic Graph (DAG) structure is a solution to realize secure and scalable data transactions. Recent research IOTA is still faced with the issue of being vulnerable to splitting attacks and left-behind transactions. The splitting attack causes the network to confirm conflict transactions. Then, left-behind transactions cause the network to generate transactions that will not be confirmed. The selection tip weighted random walk (WRW) algorithm uses the Markov Chain Monte Carlo (MCMC) to overcome these two issues by applying the appropriate bias parameter (α). However, when the α is too large, it will produce a lot of left-behind transactions. Determining the optimal value of α is still an important research topic today. An E-IOTA study that gives several α values statically with random selection but can still produce more left-behind transactions than pure WRW. This paper proposes an optimization of the tip selection algorithm (DA-IOTA) to determine the optimal alpha (α) using an approach to dynamically determine each WRW step. The experimental results show that DA-IOTA produces fewer left-behind transactions than MCMC (WRW) and E-IOTA which use α parameters statically.