As the next-generation network architecture, software-defined networking (SDN) has great potential. But how to forward data packets safely is a big challenge today. In SDN, packets are transferred according to flow rules which are made and delivered by the controller. Once flow rules are modified, the packets might be redirected or dropped. According to related research, we believe that the key to forward data flows safely is keeping the consistency of flow rules. However, existing solutions place little emphasis on the safety of flow rules. After summarizing the shortcomings of the existing solutions, we propose FRChain to ensure the security of SDN data forwarding. FRChain is a novel scheme that uses blockchain to secure flow rules in SDN and to detect compromised nodes in the network when the proportion of malicious nodes is less than one-third. The scheme places the flow strategies into blockchain in form of transactions. Once an unmatched flow rule is detected, the system will issue the problem by initiating a vote and possible attacks will be deduced based on the results. To simulate the scheme, we utilize BigchainDB, which has good performance in data processing, to handle transactions. The experimental results show that the scheme is feasible, and the additional overhead for network performance and system performance is less than similar solutions. Overall, FRChain can detect suspicious behaviors and deduce malicious nodes to keep the consistency of flow rules in SDN.
Cryptocurrencies have enhanced financial transactions, but being decentralized, they pose numerous security threats to their users, warranting new anomaly detection systems for fraud prevention.The present research focuses on the machine learning (ML) techniques used in detecting suspicious activities in cryptocurrency networks, focusing on their contribution to AML and CFT compliance.The paper also compares supervised and unsupervised learning techniques and their merits and demerits.The supervised learning techniques, including Decision Trees, SVMs, and Neural Networks, are presented for their accuracy and flexibility, and, on the other hand, the unsupervised learning approaches, including Clustering, Isolation Forests, and Autoencoders are considered for their potential to discover new fraud patterns even if the training data is not labeled.An analysis of the use of explainability tools such as LIME and SHAP in artificial intelligence systems is also carried out to improve how users understand the results given to them by the AI models.These models have their real-life application illustrated by case studies, which prove helpful in identifying anomalies in Bitcoin and Ethereum transactions.New research directions suggest improvements in machine learning methods, the connection of the results with analysis tools based on blockchain, and cooperation with relevant authorities to improve the identification of threats and conformity with established guidelines.The potential of applying the idea of this work in traditional finance and cybersecurity is discussed, highlighting the possibility of applying ML in multiple fields to enhance security and compliance.The study then informs the significance of continued research and collaboration among disciplines to combat the emerging issues of financial fraud and cybercrimes related to cryptocurrencies.
Distributed Denial of Service (DDoS) attack is a major threat impeding service to legitimate requests on any network. Although the first DDoS attack was reported in 1996, the complexity and sophistication of these attacks has been ever increasing. A 2 TBps attack was reported in mid-August 2020 directed towards critical infrastructure, such as finance, amidst the COVID-19 pandemic. It is estimated that these attacks will double, reaching over 15 million, in the next 2 years. A number of mitigation schemes have been designed and developed since its inception but the increasing complexity demands advanced solutions based on emerging technologies. Blockchain has emerged as a promising and viable technology for DDoS mitigation. The inherent and fundamental characteristics of blockchain such as decentralization, internal and external trustless attitude, immutability, integrity, anonymity and verifiability have proven to be strong candidates, in tackling this deadly cyber threat. This survey discusses different approaches for DDoS mitigation using blockchain in varied domains to date. The paper aims at providing a comprehensive review, highlighting all necessary details, strengths, challenges and limitations of different approaches. It is intended to serve as a single platform to understand the mechanics of current approaches to enhance research and development in the DDoS mitigation domain.
Electronic voting systems have several necessarily requirements, such as anonymity that others cannot link voters with votes, the fairness that votes should not be leaked before the tally, and the accuracy that eligible voters' votes should be counted correctly. There have been proposed various methods to realize the requirements. Some of them require anonymous communication paths as necessary elements to satisfy the anonymity requirement for a practical electronic voting system. Cruz et al. proposed an electronic voting system that does not need anonymous communication paths, using Bitcoin, a cryptographic currency, as a distributed database. However, Bitcoin is a system in which all data are disclosed, and anyone can check what exchanges a person of a certain ID (Bitcoin address) has done. It is possible to reveal which voter made what vote, and hence(anonymity is not satisfied. In this paper, we propose a method to solve the above problem by using Bitcoin mixing. We propose an electronic voting system using Zerocoin, a variant of Bitcoin, as a database, in which zero knowledge proof is used instead of blind signature for mixing.
As the most fundamental infrastructure in the current Internet, the Border Gateway Protocol (BGP) supports the inter-connectivity of different Autonomous Systems (ASs) and then the reachability can be achieved from any network in the Internet. However, due to the lack of security consideration during its original design, the BGP suffers from multiple security threats. Another challenge is that it cannot support the future sophisticated applications with deterministic routing. In this article, we propose a novel BGP management architecture, namely BGPChain, which is based on the blockchain in order to establish a secure, smart, and agile routing infrastructure for the future Internet.
Cyber threat is a major issue that has been terrorizing the computing work. A typical cyber-physical system is crucial in ensuring a safe and secure architecture of a sustainable computing ecosystem. Cyber Threat Intelligence (CTI) is a new methodology that is used to address some of the existing cyber threats and ensure a more secure environment for communication. Data credibility and reliability plays a vital role in increasing the potential of a typical CTI and the data collected for this purpose is said to be highly reliable. In this paper, we have introduced a CTI system using blockchain to tackle the issues of sustainability, scalability, privacy and reliability. This novel approach is capable of measuring organizations contributions, reducing network load, creating a reliable dataset and collecting CTI data with multiple feeds. We have testing various parameters to determine the efficiency of the proposed methodology. Experimental results show that when compared to other methodologies, we can save upto 20% of storage space using the proposed methodology.
In a distributed system such as Internet of things, the data volume from each node may be limited. Such limited data volume may constrain the performance of the machine learning classification model. How to effectively improve the performance of the classification in a distributed system has been a challenging problem in the field of data mining. Sharing data in the distributed network can enlarge the training data volume and improve the machine learning classification model’s accuracy. In this work, we take data sharing and the quality of shared data into consideration and propose an efficient Blockchain-based ID3 Decision Tree Classification (BIDTC) framework for distributed networks. The proposed BIDTC takes advantage of three techniques: blockchain-based ID3 decision tree, enhanced homomorphic encryption, and stimulation smart contract to conduct classification while effectively considering the data privacy and the value of user data. BIDTC employs the data federation scheme based on homomorphic encryption and blockchain to achieve more training data sharing without sacrificing data privacy. Meanwhile, smart contracts are integrated into BIDTC to incentivize users to share more high-quality data. Our extensive experiments have demonstrated that the proposed BIDTC significantly outperforms existing schemes in constructed consortium blockchain networks.
The rapid development of blockchain technology has provided new ideas for network security research. Blockchain-based network security enhancement solutions are attracting widespread attention. This paper proposes an Internet... | Find, read and cite all the research you need on Tech Science Press
Low-rate Distributed DoS (LDDoS) attack is a complex large-scale attack behavior with strong time-domain characteristics in blockchain-based wireless network. Blockchain with Machine learning-based models, as promising ways, are taken to detect them and secure wireless network. However, researchers focused on how to improve models' detection performance and work out new blockchain-based protection technologies during the past decades. Due to lack of evolving data, these models and technologies may have poor stability in the face of confrontational samples. To cope with the problem, this paper proposes a novel LSTM-CGAN method to generate high-quality LDDoS adversarial samples for blockchain-based wireless network detection models. In this method, we give a brief feature analysis about LDDoS attack in blockchain-based wireless network and work out its corresponding time series model firstly. And then, we take use of Long Short-Term Memory Networks (LSTM) to learn relationships among sequenced network packages in the same flow. At last, we establish a Condition Generative Adversarial Networks (CGAN) model to use above relationships as specific conditions for generating mimicking behaviors of LDDoS attacks in blockchain-based wireless network. The experimental results show that these generated adversarial samples based on both public and private datasets can cheat the machine learning detection models, and have the similar attack characteristics with the real samples. Consequently, they can be used as blockchain-based wireless network dataset of machine learning classifiers for training to enhance models' stability.
Internet of Things (IoT) is a unique element in the realm of Cybersecurity. It constitutes countless applications, including defense, health, agriculture, finance, amongst other industries. The majority of existing studies focus on various developments of IoT products and services essential to our day-to-day activities, with little emphasis on the security of developed systems. This has led to the proliferation of IoT solutions acquired through rapid development and overlooking the need for a structured security framework during the systems’ development stages. IoT security capability can be improved by using complementary technologies. This paper explores applying Risk-Based Access Control Model using Blockchain to control access to IoT devices. Although current access control models provide efficient security measures to control who can access the system resources, there is no way to detect and prevent malicious attacks after granting access. The proposed solution utilizes smart contracts under the Hyperledger Fabric (HLF) Blockchain Framework to create access permissions and measure the security risks associated with any event in the IoT system and create access permissions to determine what processes may be performed. This will allow the detection of any malicious activity at the early stages of the attack and grant or deny access based on the risk associated with any activity.
In satellite communication systems, satellite power and processing capacities are limited, which means that storage and security are also constrained. Satellite communication channels are extremely vulnerable to hackers and external interference signals. Protecting satellite networks from illegal information access and use can be extremely challenging. In this paper, an architecture composed of satellite and ground equipment is developed that integrates communication network authentication and privacy protection structures. In the proposed scheme, the communication, registration, authentication, and revocation of information are achieved through stages to improve communication security. The satellite forwards the collected information to a ground base station, which has a strong data processing capacity. The ground base station records all the key parameters in the distributed blockchain, and all malicious node certificates are removed from the system. To further enhance data transmission security, the key is transferred using an asymmetric encryption algorithm. To measure the robustness of using the proposed network architecture, under the same attack condition, an invulnerability analysis is performed. After conducting simulation experiments, the results show that the proposed scheme greatly improves communication security and protection.
Multicontroller software‐defined networks have been widely adopted to enable management of large‐scale networks. However, they are vulnerable to several attacks including false data injection, which creates topology inconsistency among controllers. To deal with this issue, we propose BMC‐SDN, a security architecture that integrates blockchain and multicontroller SDN and divides the network into several domains. Each SDN domain is managed by one master controller that communicates through blockchain with the masters of the other domains. The master controller creates blocks of network flow updates, and its redundant controllers validate the new block based on a proposed reputation mechanism. The reputation mechanism rates the controllers, i.e., block creator and voters, after each voting operation using constant and combined adaptive fading reputation strategies. The evaluation results demonstrate a fast and optimal detection of fraudulent flow rule injection.
Blockchain is really trendy these days. A distributed ledger on a peer-to-peer network that is completely open to everyone was the block chain. It is composed of blocks that include hash values and data. Before a new transaction can be added to the block chain, researchers must validate it; this process is called mining. Mining is expensive and requires a lot of processing power. Since the block chain is a peer-to-peer network, the data is maintained in every node. The block chain network has increased to 190GB thanks to the increasing number of transactions that are processed through it. It is a problem because a cheap laptop can only hold so much data. This study developed a revolutionary, less expensive system than the block chain method. We choose web applications as our use case since they are increasingly overtaking all other methods of accessing internet services in popularity. The immutability, data security, and data dissemination features of the block chain were all taken into account. The Merle tree concept provides immutability, hashing was used to achieve security, and an open source data distribution tool is used to spread the data. This paper provides innovative methods for preventing malicious data upload using MIME, cross-site programming, and cross-site request manipulation.
With the mass expansion of Internet of Things (IoT) in industry and consumer life, IoT security has become a focal point of research and development. New technologies are enabling unprecedented methods of developing and securing IoT devices. This thesis focuses on studying and applying Web 3.0 technologies in an IoT device and service context while addressing IoT security vulnerabilities through the use of good security design practices. Through the application of Web 3.0 technologies this thesis illustrates the advantages and disadvantages that these technologies offer. The practi- cal implementation utilizes a custom Ethereum based security protocol that enables an IoT device to use a decentralized data network as its dedicated backend infrastructure. The results of the implementation will be analyzed through the lens of security and practicality.
Ibrahim Aliyu, Marco Carlo Feliciano, Sélinde van Engelenburg, Dong Ok Kim · 5 authors
In-vehicle communication systems are usually managed by controller area networks (CAN). By broadcasting packets to their bus, the CAN facilitates the interaction between Electronic Control Units (ECU) that coordinate, monitor and control internal vehicle components. With no authentication mechanism for identifying the legitimacy and source of packets, CAN are vulnerable to cyber-attacks. An Intrusion Detection System (IDS) can detect attacks on CAN and machine learning can be used to create the models for the IDSs to detect non-linear attack patterns. However, car manufacturers and owners might want to keep the sensitive information required for training the models confidential. Therefore, we proposed a Blockchain-based Federated Forest Software-Defined Networking (SDN)-enabled IDS (BFF-IDS) to address the problem of data sharing the sensitive CAN data. To ensure scalability, we used InterPlanetary File System (IPFS) to host the models, and the blockchain is designed to store only a hash of the model and a pointer to its location. The SDN provides the dynamic routing of packets and model exchanges. We used Federated Learning (FL) to create a random forest model. Individuals provide partially trained models, allowing them to keep the underlying data confidential. Using Fourier transform, we decomposed the CAN IDs cycle from CAN bus traffic in the frequency domain for better generalization in multiclass detection of attacks. Multiple statistical and entropy features were extracted to handle the high complexity and non-linearity in CAN bus traffic. The proposed system allows manufacturers and car owners to contribute to the training of the models, as their sensitive data is protected. By storing hashes of the models on a blockchain, the risk of adversaries poisoning the models is reduced and a single point of failure is avoided. We evaluated the proposed system by conducting experiments on a testbed. We found that the proposed system has efficient use of memory and CPU resources and that the detection rate of closely related attacks was high. We recorded the highest model attack detection rate of about 0.981.
Sunoo Park, Michael A. Specter, Neha Narula, Ronald L. Rivest
Abstract Voters are understandably concerned about election security. News reports of possible election interference by foreign powers, of unauthorized voting, of voter disenfranchisement, and of technological failures call into question the integrity of elections worldwide. This article examines the suggestions that “voting over the Internet” or “voting on the blockchain” would increase election security, and finds such claims to be wanting and misleading. While current election systems are far from perfect, Internet- and blockchain-based voting would greatly increase the risk of undetectable, nation-scale election failures. Online voting may seem appealing: voting from a computer or smartphone may seem convenient and accessible. However, studies have been inconclusive, showing that online voting may have little to no effect on turnout in practice, and it may even increase disenfranchisement. More importantly, given the current state of computer security, any turnout increase derived from Internet- or blockchain-based voting would come at the cost of losing meaningful assurance that votes have been counted as they were cast, and not undetectably altered or discarded. This state of affairs will continue as long as standard tactics such as malware, zero day, and denial-of-service attacks continue to be effective. This article analyzes and systematizes prior research on the security risks of online and electronic voting, and shows that not only do these risks persist in blockchain-based voting systems, but blockchains may introduce ‘additional’ problems for voting systems. Finally, we suggest questions for critically assessing security risks of new voting system proposals.
Luca Caviglione, Michał Choraś, Igino Corona, Artur Janicki · 7 authors
Cyber attacks are currently blooming, as the attackers reap significant profits from them and face a limited risk when compared to committing the “classical” crimes. One of the major components that leads to the successful compromising of the targeted system is malicious software. It allows using the victim’s machine for various nefarious purposes, e.g., making it a part of the botnet, mining cryptocurrencies, or holding hostage the data stored there. At present, the complexity, proliferation, and variety of malware pose a real challenge for the existing countermeasures and require their constant improvements. That is why, in this paper we first perform a detailed meta-review of the existing surveys related to malware and its detection techniques, showing an arms race between these two sides of a barricade. On this basis, we review the evolution of modern threats in the communication networks, with a particular focus on the techniques employing information hiding. Next, we present the bird’s eye view portraying the main development trends in detection methods with a special emphasis on the machine learning techniques. The survey is concluded with the description of potential future research directions in the field of malware detection.
Existing communication protocols in security networks are highly centralized. While this naively makes the controls easier to physically secure, external actors require fewer resources to disrupt the system because there are fewer points in the system can be interrupted without the entire system failing. We present a solution to this problem using a proof-of-work-based blockchain implementation built on MultiChain. We construct a test-bed network containing visual imagers and microwave sensor information. These data types are ubiquitous in perimeter security systems and allow a realistic representation of a real-world network architecture. The cameras in this system use an object detection algorithm to find important targets in the scene. The raw data from both the sensors and imagers are placed in a transaction. These transactions are then bundled into blocks and broadcast to the rest of the network using the Bitcoin-based MultiChain protocol. We develop five tests to examine the security metrics of our network. We performed the five security metric test using different sized networks from 7 to 39 nodes to determine how the metrics scale with respect to size. We find that when compared to a centralized architecture our implementation provides a resiliency increase that is expected from a blockchain- based protocol without slowing the system so much that a human operator would notice. Furthermore, our approach is able to detect tampering in real time. Based on these results, we theorize that security networks in general could use a blockchain- based approach in a meaningful way.
With the increase of Internet usage, the identification and recovery from cyber-attacks become the major concerns for cyber industries. Therefore, the harm caused by network attacks has caused widespread concern. Distributed Denial of Service (DDoS) attack is a very common destructive cyber attack. This is a network attack that destroys the network and can cause multiple computers to be attacked at the same time, failing to perform services properly. Therefore, based on the understanding of blockchain structure and DDoS characteristics, a blockchain-based DDoS detection model framework is proposed to form a blockchain-based collaborative detection system. We use the blockchain consortium chain structure to treat all participants as part of the private chain in the system. Each participating organization has its own channel, and other organizations cannot access its information, thus fully protecting the privacy of each participant. Our experimental results show that smart contracts can detect DDoS data and generate anomalous chains on each node. The time required to generate an exception chain and information sharing is very short, which indicates that the system can protect the privacy of user data. While sharing data in time, good results can be obtained as a collaborative detection system.
Smart contract-enabled blockchains allow building decentralized applications in which mutually-distrusted parties can work together. Recently, oracle services emerged to provide these applications with real-world data feeds. Unfortunately, these capabilities have been used for malicious purposes under what is called criminal smart contracts. A few works explored this dark side and showed a variety of such attacks. However, none of them considered collaborative attacks against targets that reside outside the blockchain ecosystem. In this paper, we bridge this gap and introduce a smart contract-based framework that allows a sponsor to orchestrate a collaborative attack among (pseudo)anonymous attackers and reward them for that. While all previous works required a technique to quantify an attacker's individual contribution, which could be infeasible with respect to real-world targets, our framework avoids that. This is done by developing a novel scheme for trustless collaboration through betting. That is, attackers bet on an event (i.e., the attack takes place) and then work on making that event happen (i.e., perform the attack). By taking DDoS as a usecase, we formulate attackers' interaction as a game, and formally prove that these attackers will collaborate in proportion to the amount of their bets in the game's unique equilibrium. We also model our framework and its reward function as an incentive mechanism and prove that it is a strategy proof and budget-balanced one. Finally, we conduct numerical simulations to demonstrate the equilibrium behavior of our framework.
Large-scale power systems are composed of regional utilities with assets that stream sensor readings in real time. In order to detect cyberattacks, the globally acquired, real-time sensor data needs to be analyzed in a centralized fashion. However, owing to operational constraints, such a centralized sharing mechanism turns out to be a major obstacle. In this article, we propose a blockchain-based decentralized framework for detecting coordinated replay attacks with full privacy of sensor data. We develop a Bayesian inference mechanism employing locally reported attack probabilities that is tailor made for a blockchain framework. We compare our framework to a traditional decentralized algorithm based on the broadcast gossip framework both theoretically as well as empirically. With the help of experiments on a private Ethereum blockchain, we show that our approach achieves good detection quality and significantly outperforms gossip-driven approaches in terms of accuracy, timeliness, and scalability.
Miquel Ferriol-Galmés, Roger Coll Aumatell, Albert Cabellos‐Aparicio, Shoushou Ren · 6 authors
In the inter-domain routing infrastructure, a route leak is defined as a violation of the routing policy agreed between two Autonomous Systems (AS). Route leaks have resulted in large-scale outages on the Internet, taking down several services. Although route leaks seem a simple problem, the solution is complex because: (i) ASes consider -partially- routing policy private, (ii) lack of a formal and standard language to express routing policy and (iii) BGP lacks adequate cryptographic-based security. In this paper, we present an experimental analysis of a distributed ledger-based architecture that provides a solution to route leaks. Specifically, the routing policy is unambiguously expressed using a formal language, that is then stored in a blockchain. This decentralized architecture allows private policies and interfaces seamlessly with the current BGP infrastructure, requiring no changes to routers. We build a prototype to evaluate our proposed architecture using Hyperledger, we analyze its performance using a real-world BGP dataset. Our results show that our architecture scales linearly with relevant metrics. Additionally, we validate the architecture preventing an artificially introduced route leak in a realistic 10 AS topology.
Financial services must monitor their transactions to prevent being used for money laundering and combat the financing of terrorism. Initially, organizations in charge of fraud regulation were only concerned about financial institutions such as banks. However, nowadays, the Fintech industry, online businesses, or platforms involving virtual assets can also be affected by similar criminal schemes. Regardless of the differences between the entities mentioned above, malicious activities affecting them share many common patterns. This dissertation's first goal is to compile and compare existing studies involving machine learning to detect and analyze suspicious transactions. The second goal is to synthesize methodologies from the last goal for tackling different use cases in an organized manner. Finally, the third goal is to assess the applicability of deep generative models for enhancing existing solutions. In the first part of the thesis, we propose an unsupervised methodology for detecting suspicious transactions applied to two case studies. One is related to transactions from a money remittance network, and the other is related to a novel payment network based on distributed ledger technologies. Anomaly detection algorithms are applied to rank user accounts based on recency, frequency, and monetary features. The results are manually validated by domain experts, confirming known scenarios and finding unexpected new cases. In the second part, we carry out an analogous analysis employing supervised methods, along with a case study where we classify Ethereum smart contracts into honeypots and non-honeypots. We take features from the source code, the transaction data, and the funds' flow characterization. The proposed classification models proved to generalize well to unseen honeypot instances and techniques and allowed us to characterize previously unknown techniques. In the third part, we analyze the challenges that tabular data brings into the domain of deep generative models, a particular type of data used to represent financial transactions in the previous two parts. We propose a new model architecture by adapting state-of-the-art methods to output multiple variables from mixed types distributions. Additionally, we extend the evaluation metrics used in the literature to the multi-output setting, and we show empirically that our approach outperforms the existing methods. Finally, in the last part, we extend the work from the third part by applying the presented models to enhance classification tasks from the second part, commonly containing a severe class imbalance. We introduce the multi-input architecture to expand models alongside our previously proposed multi-output architecture. We compare three techniques to sample from deep generative models defining a transparent and fair large-scale experimental protocol and interesting visual analysis tools. We showed that general machine learning detection and visualization techniques could help address the fraud detection domain's many challenges. In particular, deep generative models can add value to the classification task given the imbalanced nature of the fraudulent class, in exchange for implementation and time complexity. Future and promising applications for deep generative models include missing data imputation and sharing synthetic data or data generators preserving privacy constraints.