Muneeb Ul Hassan, Mubashir Husain Rehmani, Jinjun Chen
Over the past decade, blockchain technology has attracted a huge attention from both industry and academia because it can be integrated with a large number of everyday applications of modern information and communication technologies (ICT). Peer-to-peer (P2P) architecture of blockchain enhances these applications by providing strong security and trust-oriented guarantees, such as immutability, verifiability, and decentralization. Despite these incredible features that blockchain technology brings to these ICT applications, recent research has indicated that the strong guarantees are not sufficient enough and blockchain networks may still be prone to various security, privacy, and reliability issues. In order to overcome these issues, it is important to identify the anomalous behaviour within the actionable time frame. In this article, we provide an in-depth survey regarding integration of anomaly detection models in blockchain technology. For this, we first discuss how anomaly detection can aid in ensuring security of blockchain based applications. Then, we demonstrate certain fundamental evaluation metrics and key requirements that can play a critical role while developing anomaly detection models for blockchain. Afterwards, we present a thorough survey of various anomaly detection models from the perspective of each layer of blockchain. Finally, we conclude the article by highlighting certain important challenges alongside discussing how they can serve as future research directions for new researchers in the field.
Deepesh Chaudhari, Rachit Agarwal, Sandeep K. Shukla
The temporal aspect of blockchain transactions enables us to study the address's behavior and detect if it is involved in any illicit activity. However, due to the concept of change addresses (used to thwart replay attacks), temporal aspects are not directly applicable in the Bitcoin blockchain. Several pre-processing steps should be performed before such temporal aspects are utilized. We are motivated to study the Bitcoin transaction network and use the temporal features such as burst, attractiveness, and inter-event time along with several graph-based properties such as the degree of node and clustering coefficient to validate the applicability of already existing approaches known for other cryptocurrency blockchains on the Bitcoin blockchain. We generate the temporal and non-temporal feature set and train the Machine Learning (ML) algorithm over different temporal granularities to validate the state-of-the-art methods. We study the behavior of the addresses over different time granularities of the dataset. We identify that after applying change-address clustering, in Bitcoin, existing temporal features can be extracted and ML approaches can be applied. A comparative analysis of results show that the behavior of addresses in Ethereum and Bitcoin is similar with respect to in-degree, out-degree and inter-event time. Further, we identify 3 suspects that showed malicious behavior across different temporal granularities. These suspects are not marked as malicious in Bitcoin.
Recently, phishing scams have posed a significant threat to blockchains. Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses’ transaction behavior features by random walking or constructing static subgraphs. The random walking methods, unfortunately, usually miss structural information due to limited sampling sequence length, while the static subgraph methods tend to ignore temporal features lying in the evolving transaction behaviors. More importantly, their performance undergoes severe degradation when the malicious users intentionally hide phishing behaviors. To address these challenges, we propose TEGDetector, a dynamic graph classifier that learns the evolving behavior features from transaction evolution graphs (TEGs). First, we cast the transaction series into multiple time slices, capturing the target address’s transaction behaviors in different periods. Then, we provide a fast nonparametric phishing detector (FD) to narrow down the search space of suspicious addresses. Finally, TEGDetector considers both the spatial and temporal evolutions toward a complete characterization of the evolving transaction behaviors. Moreover, TEGDetector utilizes adaptively learned time coefficient to pay distinct attention to different periods, which provides several novel insights. Extensive experiments on the large-scale Ethereum transaction dataset demonstrate that the proposed method achieves state-of-the-art (SOTA) detection performance. The code of TEGDetector is open sourced at https://github.com/Seaocn/TEGDetector.
Yinxing Xue, Jiaming Ye, Wei Zhang, Jun Sun · 7 authors
Smart contract transactions are increasingly interleaved by cross-contract calls. While many tools have been developed to identify a common set of vulnerabilities, the cross-contract vulnerability is overlooked by existing tools. Cross-contract vulnerabilities are exploitable bugs that manifest in the presence of more than two interacting contracts. Existing methods are however limited to analyze a maximum of two contracts at the same time. Detecting cross-contract vulnerabilities is highly non-trivial. With multiple interacting contracts, the search space is much larger than that of a single contract. To address this problem, we present xFuzz, a machine learning guided smart contract fuzzing framework. The machine learning models are trained with novel features (e.g., word vectors and instructions) and are used to filter likely benign program paths. Comparing with existing static tools, machine learning model is proven to be more robust, avoiding directly adopting manually-defined rules in specific tools. We compare xFuzz with three state-of-the-art tools on 7,391 contracts. xFuzz detects 18 exploitable cross-contract vulnerabilities, of which 15 vulnerabilities are exposed for the first time. Furthermore, our approach is shown to be efficient in detecting non-cross-contract vulnerabilities as well -- using less than 20% time as that of other fuzzing tools, xFuzz detects twice as many vulnerabilities.
Jochen Schäfer, Christian Müller, Frederik Armknecht
Abstract Bitcoin and similar cryptocurrencies are becoming increasingly popular as a payment method in both legitimate and illegitimate online markets. Such markets usually deploy a review system that allows users to rate their purchases and help others to determine reliable vendors. Consequently, vendors are interested into accumulating as many positive reviews (likes) as possible and to make these public. However, we present an attack that exploits these publicly available information to identify cryptocurrency addresses potentially belonging to vendors. In its basic variant, it focuses on vendors that reuse their addresses. We also show an extended variant that copes with the case that addresses are used only once. We demonstrate the applicability of the attack by modeling Bitcoin transactions based on vendor reviews of two separate darknet markets and retrieve matching transactions from the blockchain. By doing so, we can identify Bitcoin addresses likely belonging to darknet market vendors.
Surfing Online Social Media (OSM) websites have become a daily activity for a large number of people worldwide. People use OSMs to satisfy their innate need to socialise, but also as a source of information or to share personal facts. Thanks to the massive success of cryptocurrencies, the blockchain technology gained popularity among researchers, giving birth to a new generation of social media. Steemit is the most well-known blockchain-based social media, and it is based on the public blockchain Steem. Steemit employs Steem as data storage, and to implement a rewarding mechanism that grants cryptocurrency to pieces of content that are considered relevant by the users. Steem represents the first experiment that integrates OSMs and an economic rewarding system on the same platform, and in this paper, we inspect the interactions among the users from a community perspective. We apply two community detection algorithms on five graphs that model just as many facets of the Steem blockchain and test the detected structure against three measures for community structure evaluation. Findings show that communities tend to be very large, index of how much users are encouraged to interact as much as possible, and in particular, in the monetary graph, we detect a large number of the block producers of Steem.
JT Hamrick, Farhang Rouhi, Arghya Mukherjee, Marie Vasek · 6 authors
As the number of cryptocurrencies has exploded in recent years, so too has the fraud. One popular strategy is when actors promote coordinated purchases of coins in hopes of temporarily driving up prices. Prior work investigating such pump and dump schemes has focused on the immediate impact to prices following pump signals, which were largely interpreted as following the same strategy. The reality, as with most cybercrimes, is that the operators of the schemes try out a much more heterogeneous mix of tactics. From a population of 12,252 pump signals observed between July 2017 and January 2019, we identify and examine 3,683 so-called target-based pump signals that announce promoted coins alongside buy and sell targets, but without a coordinated purchase time. We develop a strategy to measure the success of target pumps over longer time horizons. We find that around half of these pumps reach at least one of their sell targets, and that reaching their peak price often takes days, as opposed to the seconds or minutes required in pumps studied previously. We also examine the various groups promoting coins and present evidence that groups try a variety of distinct strategies and experience varying success. We find that the most successful groups promote many coins and issue many pumps, but not for the same coins. As decentralized finance becomes more popular, a deeper understanding of price manipulation techniques like target pumps is needed to combat fraud.
On an Ethereum node, txpool (a.k.a. mempool) is a buffer storing unconfirmed transactions and controls what downstream services can see, such as mining and transaction propagation. This work presents the first security study on Ethereum txpool designs.
Social media is becoming one of the dominant ways to communicate. Before social media, people were extremely limited in their means to interact with others, and they were limited largely to the people that they knew in person. However, this impact on people in real life has damaged privacy. Alternative solutions have been proposed in order to overcome current social media issues. In this direction, blockchain is one of the most promising, and several blockchain-based social media have been proposed. In this paper, we analyze blockchain online social media from the technical point of view in order to understand the current trend of social DApps and to describe which characteristics are important in a blockchain-based social media scenario. We analyze real data by exploiting one of the most well-known DApps sites, and we compare current technologies in order to highlight which ones can be better applied to a real social scenario, such as Facebook.
Social bots can cause social, political, and economical disruptions by spreading rumours. The state-of-the-art methods to prevent social bots from spreading rumours are centralised and such solutions may not be accepted by users who may not trust a centralised solution being biased. In this paper, we developed a decentralised method to prevent social bots. In this solution, the users of a social network create a secure and privacy-preserving decentralised social network and may accept social media content if it is sent by its neighbour in the decentralised social network. As users only choose their trustworthy neighbours from the social network to be part of its neighbourhood in the decentralised social network, it prevents the social bots to influence a user to accept and share a rumour. We prove that the proposed solution can significantly reduce the number of users who are share rumour.
Raja Wasim Ahmad, Khaled Salah, Raja Jayaraman, Ibrar Yaqoob · 5 authors
Today's systems, approaches, and technologies leveraged for managing oil and gas supply chain operations fall short in providing operational transparency, traceability, audit, security, and trusted data provenance features. Also, a large portion of the existing systems is centralized, manual, and highly disintegrated which make them vulnerable to manipulation and the single point of failure problem. In this survey, we explore the potential opportunities and applications of blockchain technology in managing the exploration, production, and supply chain and logistics operations in the oil and gas industry as it can offer traceability, immutability, transparency, and audit features in a decentralized, trusted, and secure manner. We discuss state-of-the-art blockchain-based schemes, research projects, business initiatives, and case studies to highlight the practicability of blockchain in the oil and gas industry. We present the potential opportunities brought about by blockchain technology in various use cases and application scenarios. We introduce several systems that leverage blockchain-based smart contracts to automate the important services in terms of tracking and tracing of petroleum products, protection of international trade documents, and coordination of purchasing and bidding activities for granting oil exploration rights to petroleum exploration and development companies. Finally, we present open challenges acting as future research directions.
This study examined the characteristics of internet rumors in the user-generated content (UGC) mode, analysed the advantages of using the blockchain technology to curb internet rumors, and proposed a framework of the internet rumor reporting system based on the blockchain incentive mechanism. With Truffle as a development framework, intelligent contracts such as create, read, update, and delete were created using Solidity. The end users were connected to the blockchain using the MetaMask plugin. Finally, rewards were obtained by the participants, and the decentralizing program Dapp was created. The results showed that the TRUES could support multiuser reporting and execute intelligent contracts automatically and efficiently in a complex internet rumor environment; for the range of 1–2896 participants, virtual currency rewards could be obtained in 0.5–2.5 d. The conclusion showed that the internet rumor reporting system under the blockchain incentive mechanism had the characteristics of multilevel management, and distributed ledger and digital signatures contributed to the retention and traceability of rumors. Intelligent contracts and consensus mechanisms have obvious advantages in dealing with the complex forms of internet rumors.
Mwrwan Abubakar, Zakwan Jaroucheh, Ahmed Al Dubai, Bill Buchanan
The Session Initiation Protocol (SIP) is the principal signalling protocol in Voice over IP (VoIP) systems, responsible for initialising, terminating, and maintaining sessions amongst call parties. However, the problem with the SIP protocol is that it was not designed to be secure by nature as the HTTP digest authentication used in SIP is insecure, making it vulnerable to a variety of attacks. The current solutions rely on several standardised encryption protocols, such as TLS and IPsec, to protect SIP registration messages. However, the current centralised solutions do not scale well and cause algorithm overload when encoding and decoding SIP messages. In trying to rectify this issue, we propose in this paper a blockchain-based lightweight authentication mechanism, which involves a decentralised identity model to authenticate the SIP client to the SIP server. Our mechanism uses a smart contract on the Ethereum blockchain to ensure trust, accountability and preserves user privacy. We provided a proof-of-concept implementation to demonstrate our work. Further analysis of this approach's usability, mainly CPU and memory usage, was conducted comparing to IPsec and TLS. Then we discussed our system's security and presented a security analysis. Our analysis proves that our approach satisfies the SIP protocol security requirements.
Ballots are often hold for fair decisions such as party theme selecting, however, the existing traditional ballot has some problems involving amount of human resources, cost of places, equipment, time and traffic, and repeated procedures. In order to solve the issues aforementioned, a ballot blockchain system is designed and implemented based on the smart contract of Ethereum. It is designed on the core blockchain technologies of the decentralized ledger technology, using a secure hash algorithm, anonymous user, incorruptible data, and adopting a public blockchain. The ballot blockchain system is implemented based on the MetaMask verification and the Remix interface development environment. The smart contract plays the role of the decision-maker for controlling ballot activities instead of numerous human tasks. All ballot transactions are recorded in the ballot blockchain permanently when the ballot completed. The aim of the ballot blockchain system is to achieve a fair, less time-consuming, secured, and transparent environment.
Riri Fitri Sari, Asri Samsiar Ilmananda, Daniela M. Romano
In the current digital era, information exchanges can be done easily through the Internet and social media. However, the actual truth of the news on social media platforms is hard to prove, and social media platforms are susceptible to the spreading of hoaxes. As a remedy, Blockchain technology can be used to ensure the reliability of shared information and can create a trusted communications environment. In this study, we propose a social media news spreading model by adapting an epidemic methodology and a scale-free network. A Blockchain-based news verification system is implemented to identify the credibility of the news and its sources. The effectiveness of the model is investigated by utilizing agent-based modelling using NetLogo software. In the simulations, fake news with a truth level of 20% are assigned a low News Credibility Indicator (NCI ± -0.637) value for all of the different network dimensions. Moreover, the Producer Reputation Credit is also decreased (PRC ± 0.213) so that the trust factor value is reduced. Our epidemic approach for news verification has also been implemented using Ethereum Smart Contract and several tools such as React with Solidity, IPFS, Web3.js, and Metamask. By showing the measurements of the credibility indicator and reputation credit to the user during the news dissemination process, this proposed smart contract can effectively limit user behaviour in spreading fake news and improve the content quality on social media.
Philipp Winter, Anna Harbluk Lorimer, Peter J. Snyder, Benjamin Livshits
Much of the recent excitement around decentralized finance (DeFi) comes from hopes that DeFi can be a secure, private, less centralized alternative to traditional finance systems. However, people moving to DeFi sites in hopes of improving their security and privacy may end up with less of both as recent attacks have demonstrated. In this work, we improve the understanding of DeFi by conducting the first Web measurements of the security, privacy, and decentralization properties of popular DeFi front ends. We find that DeFi applications -- or dapps -- suffer from the same security and privacy risks that frequent other parts of the Web but those risks are greatly exacerbated considering the money that is involved in DeFi. Our results show that a common tracker can observe user behavior on over 56% of websites we analyzed and many trackers on DeFi sites can trivially link a user's Ethereum address with PII (e.g., user name or demographic information), or phish users by initiating fake Ethereum transactions. Lastly, we establish that despite claims to the opposite, because of companies like Amazon and Cloudflare operating significant Web infrastructure, DeFi as a whole is considerably less decentralized than previously believed.
Tong Cao, Jérémie Decouchant, Jiangshan Yu, Paulo Esteves-Veríssimo
While previous works have discussed the network delay upper bound that guarantees the consistency of Nakamoto consensus, measuring the actual network latencies and evaluating their impact on miners/pools in Bitcoin remain open questions. This paper fills this gap by: (1) defining metrics that quantify the impact of network latency on the mining network; (2) developing a tool, named miner entanglement (ME), to experimentally evaluate these metrics with a focus on the network latency of the top mining pools; and (3) quantifying the impact of the current network delays on Bitcoin's mining network. For example, we evaluated that Poolin, a Bitcoin mining pool, was able to gain between 0.5% and 1.9% of blocks in addition (i.e., from 36.27 BTC to 137.83 BTC) per week thanks to its low network latency. Moreover, as pools are rational in Bitcoin, we model the strategy a pool would follow to improve its network latency (e.g., by leveraging our ME tool) as a two party game. We show that a Bitcoin mining pool could improve its effective hash rate by up to 4.5%. For a multi-party game, we use a state-of-the-art Bitcoin mining simulator to study the situation where all pools attempt to improve their network latency and show that the largest mining pools would improve their revenue and reach a Nash equilibrium while the smaller mining pools would suffer from a decreased access to the network, and therefore a decreased revenue. These conclusions further incentivize the centralisation of the mining network in Bitcoin, and provide an empirical explanation for the observed tendency of pools to design and rely on low latency private networks.
Open access
Blockchain Technology Applications and Security
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
This paper explores how cryptocurrency affects Nigeria’s socio-economic and digital landscape, highlighting both its potential as an instrument of economic leveraging and its use in cybercrime. It explores how the decentralized characteristics of cryptocurrencies facilitate innovation and financial inclusion — and allow for anonymity, too, that enables cybercriminal activities. Today, cryptocurrency is a hot topic around the world. Nigeria, which registers some of the highest cryptocurrency adoption rates in the world, has used this class of digital asset as a key enabler of both breaking with traditional banking constraints and promoting economic resilience. But its decentralized and anonymous design also stands as a superpower to various forms of cybercrimes, from fraud and ransomware to money laundering. Such duality offers serious challenges to policymakers, law enforcement agencies, and financial institutions. The paper explores Nigeria’s regulatory experiences, technological barriers, and ethical dilemmas through in-depth analysis and case studies. This paper analyzes the phenomenon of cryptocurrency and cybercriminality in Nigeria, a phenomenon in which innovative technologies can be used as a vehicle for socioeconomic empowerment but also as a space for illegal activities. It examines case studies and statistical analyses revealing the systemic exploitation of cryptocurrency by cybercriminals and assessing the effectiveness of current legal and regulatory frameworks. This is against international best practices that expose Nigeria to grave dangers in tackling cybercrime linked to cryptocurrencies. We make sure that both the opportunities and threats it offers become bearable in how we balance the opportunities with threats this technology presents. Prescribing solutions for these challenges, the report highlights the importance of improving the regulatory environment, enhancing law enforcement capability in cyberspace, and developing a partnership between the private and public sectors to strike an appropriate balance between innovation and security. The research sent a clear message that articulated an approach to policy that would make the most of the potential of cryptocurrency while mitigating its weaknesses. Addressing these matters will allow Nigeria to seize the opportunities presented by cryptocurrency without compromising its frontier of digital security.
Intrusion detection systems that have emerged in recent decades can identify a variety of malicious attacks that target networks by employing several detection approaches. However, the current approaches have challenges in detecting intrusions, which may affect the performance of the overall detection system as well as network performance. For the time being, one of the most important creative technological advancements that plays a significant role in the professional world today is blockchain technology. Blockchain technology moves in the direction of persistent revolution and change. It is a chain of blocks that covers information and maintains trust between individuals no matter how far apart they are. Recently, blockchain was integrated into intrusion detection systems to enhance their overall performance. Blockchain has also been adopted in healthcare, supply chain management, and the Internet of Things. Blockchain uses robust cryptography with private and public keys, and it has numerous properties that have leveraged security’s performance over peer-to-peer networks without the need for a third party. To explore and highlight the importance of integrating blockchain with intrusion detection systems, this paper provides a comprehensive background of intrusion detection systems and blockchain technology. Furthermore, a comprehensive review of emerging intrusion detection systems based on blockchain technology is presented. Finally, this paper suggests important future research directions and trending topics in intrusion detection systems based on blockchain technology.
Siddhartha R. Dalal, Zihe Wang, Siddhanth Sabharwal
Due to the pseudo-anonymity of the Bitcoin network, users can hide behind their bitcoin addresses that can be generated in unlimited quantity, on the fly, without any formal links between them. Thus, it is being used for payment transfer by the actors involved in ransomware and other illegal activities. The other activity we consider is related to gambling since gambling is often used for transferring illegal funds. The question addressed here is that given temporally limited graphs of Bitcoin transactions, to what extent can one identify common patterns associated with these fraudulent activities and apply them to find other ransomware actors. The problem is rather complex, given that thousands of addresses can belong to the same actor without any obvious links between them and any common pattern of behavior. The main contribution of this paper is to introduce and apply new algorithms for local clustering and supervised graph machine learning for identifying malicious actors. We show that very local subgraphs of the known such actors are sufficient to differentiate between ransomware, random and gambling actors with 85% prediction accuracy on the test data set.
Social media news are most important in today's worlds, it puts positive or negative influence on social views. There is a wide propagation of fake news on social media so it will be difficult to believe on the news. Fake news has negative impacts on individuals as well as on society. Information spreads rapidly over the social media and so there is a need of mechanism which detects and stops the spreading of fake news. Therefore, detection of fake news is the need of time and also a challenging problem. The goal of this proposed research work is to detect fake news and minimize spreading of the fake news. In the proposed research a machine learning approach is used for detection of fake news with blockchain framework. In first section a supervised machine learning techniques is design to identify the trustiness of specific news while blockchain framework revoke the malicious activity of spreading fake news. A blockchain environment is created with mining, smart contract as well as Proof of Work (PoW) of consensus. The current systematic review broadly focuses on the various methods to detect fake news in social media. After partial implementation of system, performance evaluation has done with traditional blockchain framework. It is found that 10% less time for transaction verification by consensus in P2P environment over the existing systems.
In recent years, a lot of vulnerabilities of smart contracts have been found. Hackers used these vulnerabilities to attack the corresponding contracts developed in the blockchain system such as Ethereum, and it has caused lots of economic losses. Therefore, it is very important to find out the potential problems of the smart contracts and develop more secure smart contracts. As blockchain security events have raised more important issues, more and more smart contract security analysis methods have been developed. Most of these methods are based on traditional static analysis or dynamic analysis methods. There are only a few methods that use emerging technologies, such as machine learning. Some models that use machine learning to detect smart contract vulnerabilities cost much time in extracting features manually. In this paper, we introduce a novel machine learning-based analysis model by introducing the shared child nodes for smart contract vulnerabilities. We build the Abstract-Syntax-Tree (AST) for smart contracts with some vulnerabilities from two data sets including SmartBugs and SolidiFI-benchmark. Then, we build the Abstract-Syntax-Tree (AST) of the labeled smart contract for data sets named Smartbugs-wilds. Next, we get the shared child nodes from both of the ASTs to obtain the structural similarity, and then, we construct a feature vector composed of the values that measure structural similarity automatically to build our machine learning model. Finally, we get a KNN model that can predict eight types of vulnerabilities including Re-entrancy, Arithmetic, Access Control, Denial of Service, Unchecked Low Level Calls, Bad Randomness, Front Running, and Denial of Service. The accuracy, recall, and precision of our KNN model are all higher than 90%. In addition, compared with some other analysis tools including Oyente and SmartCheck, our model has higher accuracy. In addition, we spent less time for training .
Public blockchain records are widely studied in various aspects such as cryptocurrency abuse, anti-money-laundering, and monetary flow of businesses. However, the final blockchain records, usually available from block explorer services or querying locally stored data of blockchain nodes, do not provide abundant and dynamic event logs that are only visible from a live large-scale measurement. In this paper, we collect the network logs of three popular permissionless blockchains, that is, Bitcoin, Ethereum, and EOS. The discrepancy between observed events and the public block data is studied via a noble analysis model provided with the soundness of measurement. We share our key findings including a false universal assumption of previous mining-related studies and the block/transaction arrival characteristics.