Smart contracts are computer programs running on blockchain platforms to manage large sums of cryptocurrency, govern and carry out transactions of assets between multiple parties. The security of smart contracts has attracted great attention, ever since their adoption in the management of massive cryptocurrency transactions. However, current works mainly rely on the priori security patterns, e.g., reentrancy, delegatecall, gasless send and tainted owner. Although these priori security patterns have been proven effective in finding smart contract vulnerabilities, they are very limited in finding deeper design flaws such as permission bugs, bookkeeping bugs, etc. Moreover, the reliability analysis of smart contracts becomes difficult since most smart contracts have little to no documentation for specifications. Fairness is also an important quality attribute of smart contracts and fairness issues have been proved widely existing in smart contracts such as Ponzi schemes. However, fairness has not yet attracted much research attention. Most security and reliability issues can be detected via conformance checking between software implementation and its specification. As dynamic specification mining has been proven an effective way to learn specifications from software execution traces, in this dissertation, we aim to address the aforementioned challenges by proposing a systematic approach to study the security and reliability of smart contracts based on the learned specifications through dynamic specification mining techniques. In general, contract specifications can be categorized into function-level and contract level specifications. This thesis presents the implementation of InvCon, a dynamic invariant detector for Solidity smart contracts. InvCon analyzes past transac tion histories of a contract to generate likely program invariants, which represent function-level properties that must be maintained during function execution. By combining these invariants with finite event traces from historical transactions, a novel counterexample-guided abstraction refinement algorithm is proposed and implemented in SmCon to mine compact and precise contract-level automata. Additionally, the thesis also presents SPCon that mines the role structures of smart contracts from the past transaction histories for the application of permission bug detection. The thesis demonstrates the applications of program invariants in seman tic bug detection and automated fairness verification. An invariant-based semantic test oracle, implemented in a grey-box fuzzing tool ContraMaster, is developed to enhance vulnerability detection in smart contracts, effectively addressing issues like reentrancy, exception disorder, gasless send, and integer overflow/underflow. For fairness issues, a verification framework FairCon is proposed that treats smart contracts as games and focuses on four fairness properties derived from mechanism design and game theory. Mechanism models are employed for bounded fairness property checking, while program invariants are used to analyze unbounded cases. The thesis also explores the applications of contract-level models in model-based testing and access control bug detection. ModCon is introduced as a tool that allows users to provide test models for smart contracts, specifying state definitions, transition relations, pre/post conditions, invariants, and mapping to the contract code. SPCon leverages the aforementioned role mining to identify permission bugs in smart contracts through conformance testing. The evaluation results demonstrate the high accuracy of permission bug detection, uncovering 11 previously unknown bugs in a well-known smart contract benchmark. Briefly, we have successfully derived various smart contract specifications with dy namic specification mining and studied their applications on security and reliability of smart contracts
Metaverse is expected to rely on massive Internet of Things (IoT) connections so it inherits various security threats from the IoT network and also faces other sophisticated attacks related to virtual reality technology. As traditional security approaches show various limitations in the large-scale distributed metaverse, this paper proposes MetaCIDS, a novel collaborative intrusion detection (CID) framework that leverages metaverse devices to collaboratively protect the metaverse. In MetaCIDS, a federated learning (FL) scheme based on unsupervised au-toencoder and an attention-based supervised classifier enables metaverse users to train a CID model using their local network data, while the blockchain network allows metaverse users to train a machine learning (ML) model to detect intrusion network flows over their monitored local network traffic, then submit verifiable intrusion alerts to the blockchain to earn metaverse tokens. Security analysis shows that MetaCIDS can efficiently detect zero-day attacks, while the training process is resistant to SPoF, data tampering, and up to 33% poisoning nodes. Performance evaluation illustrates the efficiency of MetaCIDS with 96% to 99% detection accuracy on four different network intrusion datasets, supporting both multi-class detection using labeled data and anomaly detection trained on unlabeled data.
Bugs enable security attacks on smart contracts-computer programs operating on the blockchain and managing significant financial assets. In 2022, smart contracts control tens of billions of dollars, forming an entire ecosystem of so-called decentralized financial (DeFi) applications. The ever-increasing popularity of DeFi is largely attributed to its key principles, such as transparency, permissionlessness, and immutability. Unfortunately, the devastating hacks that accompany smart contract adoption demonstrate how these properties can also have adverse effects on the security of decentralized applications, considering that, like any other software, smart contracts can contain bugs or vulnerabilities. A seminal property of smart contracts-immutability-makes sure that all these implementation errors will have a long-lasting effect on the application. Considering that smart contracts also hold large amounts of funds, it is crucial to ensure that they are secure, correct, and free of vulnerabilities.
Liqun Chen, Changyu Dong, Nada El Kassem, Christopher J. P. Newton · 5 authors
Direct Anonymous Attestation (DAA) was designed for the Trusted Platform Module (TPM) and versions using RSA and elliptic curve cryptography have been included in the TPM specifications and in ISO/IEC standards. These standardised DAA schemes have their security based on the factoring or discrete logarithm problems and are therefore insecure against quantum attackers. Research into quantum-resistant DAA has resulted in several lattice-based schemes. Now in this paper, we propose the first post-quantum DAA scheme from symmetric primitives. We make use of a hash-based signature scheme, which is a slight modification of SPHINCS+, as a DAA credential. A DAA signature, proving the possession of such a credential, is a multiparty computation-based non-interactive zero-knowledge proof. The security of our scheme is proved under the Universal Composability (UC) model. While maintaining all the security properties required for a DAA scheme, we try to make the TPM’s workload as low as possible. Our DAA scheme can handle a large group size (up to 2 60 group members), which meets the requirements of rapidly developing TPM applications.
Rexford Nii Ayitey Sosu, Jinfu Chen, Edward Kwadwo Boahen, Zikang Zhang
Smart contracts have gained immense popularity in recent years as self‐executing programs that operate on a blockchain. However, they are not immune to security flaws, which can result in significant financial losses. These flaws can be detected using dynamic analysis methods that extract various aspects from smart contract bytecode. Methods currently used for identifying vulnerabilities in smart contracts mostly rely on static analysis methods that search for predefined vulnerability patterns. However, these patterns often fail to capture complex vulnerabilities, leading to a high rate of false negatives. To overcome this limitation, researchers have explored machine learning‐based methods. However, the accurate interpretation of complex logic and structural information in smart contract code remains a challenge. In this study, we present a technique that combines real‐time runtime batch normalization and data augmentation for data preprocessing, along with n‐grams and one‐hot encoding for feature extraction of opcode sequence information from the bytecode. We then combined bidirectional long short‐term memory (BiLSTM), convolutional neural network, and the attention mechanism for vulnerability detection and classification. Additionally, our model includes a gated recurrent units memory module that enhances efficiency using historical execution data from the contract. Our results demonstrate that our proposed model effectively identifies smart contract vulnerabilities.
The year 2020 saw remarkable domination of Android devices. Android’s large share of the global market (85%) places it first in the list of preferred targets for mobile cybercrime. Computer attacks try to control and access confidential user information by exploiting the various vulnerabilities present in the various components of the Android ecosystem. This thesis aims to propose a new Framework named ANDROSCANREG (Android Permissions Scan Registry) which incorporates an extensible approach for analyzing Android applications initially based on permissions and deployed in a decentralized and distributed system. The mentioned framework is based on the emerging technology called "Blockchain" whose potential is approved for transparency, availability, security, and reliability without resorting to a central trusted entity. Furthermore, in our efforts to improve the implementation of this Framework, we have proposed a new consensus algorithm called "Proof of Conformity -PoC-" in order to improve the reliability of consensus algorithms whose node weight calculation is based on one (or more) distinctive measurable criterion (stake, power, etc.). This improvement relates to the addition of a new impact factor called "Node Security Metric (NSM)" in the calculation of the node weight. NSM is primarily based on the weight recalculation of each network node based on the security and stability of its respective software and hardware environment. PoC weight recalculation is based on Common Vulnerability Scoring System (CVSS) vulnerabilities, our new approach aims to strengthen the node security index and encourage participants, respecting the recommended security requirements, to take advantage of their proactivity, vigilance, and compliance by increasing their chance of being selected as a Leader (validator) and winning rewards corresponding to the effort deployed. Besides, PoC has been theoretically evaluated via simulation scenarios through which significant results have been obtained showing that our approach ensures more likelihood for the more secure participating nodes to be designated as a validator based on their compliance rates represented by their NSM scores. Moreover, we thought as part of our research axis to equitably reward active participants. Indeed, we have presented a new approach for calculating rewards and penalties for systems based on Blockchain technology. The objective of our proposal is to ensure a new source of income in order to retain participants by guaranteeing them permanent profitability in exchange for their active participation in the stability and security of the Blockchain network to which they belong. We have studied and analyzed existing systems that, in general, favor the monopoly of rewards by attributing them either only to the Leader node (elected by a consensus algorithm) or benefit the Leader from a large part of the rewards and distributing the rest to a shortlist of participants. The result of our study shows that our approach offers more benefits by ensuring permanent, dynamic, and proportional rewards for all participating nodes according to their scores and compliance rate, the latter impacts the gradual penalty system put in place, which verifies the compliance of each node to the Blockchain protocol rules. A new innovative concept of operations execution in a Blockchain network was also proposed in this thesis. Indeed, the new approach improves the traditional data validation processes opted by Blockchain-based systems by allowing their nodes to adopt different and modifiable environments at any time in order to reduce the false positive rate and help identify polymorphic treatments and thus improve the reliability of the final results.
T. Sathya, N Keertika, Sirikonda Shwetha, Deepti Upodhyay · 5 authors
In recent years, ransomware attacks have become a more significant source of computer penetration. Only general-purpose computing systems with sufficient resources have been harmed by ransomware so far. Numerous ransomware prediction strategies have been published, but more practical machine learning ransomware prediction techniques still need to be developed. In order to anticipate ransomware assaults, this study provides a method for obtaining data from artificial intelligence and machine learning systems. A more accurate model for outcome prediction is produced by using the data science methodology. Understanding the data and identifying the variables are essential elements of a successful model. A variety of machine learning algorithms are applied to the pre-processed data, and the accuracy of each technique is compared to determine which approach performed better. Additional performance indicators including recall, accuracy, and f1-score are also taken into account while evaluating the model. It uses machine learning to predict how the ransomware attack would pan out.
Mohammad Madine, Khaled Salah, Raja Jayaraman, Mohamed Jamal Zemerly
Software licenses are legal agreements of sale and usage among software developers and clients. Such legal agreements are crucial to effectively manage ownership and protect the rights of involved parties. Today’s software licensing mechanisms are mostly centralized and do not address the ever-increasing issues and complexities of modern software that may include multiple licenses, open-source distribution, rewarding other contributors of external software libraries, and utilizing royalty payments for monetization. As a result, developers have lost confidence in the existing software licensing models, and many software projects are failing due to lack of funding and royalty payments. This paper addresses such issues and complexities by proposing a novel decentralized software licensing system based on Non-Fungible Tokens (NFTs) and blockchain. The proposed licensing system is applicable to both commercial and open-source software. We use NFTs as digital tokens that encapsulate software code and their artifacts by minting them as unique valuable assets that allow developers to store and manage them on a blockchain ledger. With NFTs, developers can register and license their code, monetize it on NFT marketplaces, and earn royalties from other software projects that use their code. We present system architecture, relevant sequence diagrams, and develop aggregation algorithms for Ethereum smart contracts with ERC-1155 NFTs. Furthermore, we perform functional validation of our system and analyze the cost of its adoption. We also analyze the security of the solution and show how its applicability can be generalized and extended. We have made our smart contract code and related testing scripts publicly available on GitHub.
Annabelle Lee, Sri Nikhil Gupta Gourisetti, D. Jonathan Sebastian-Cardenas, Kent Lambert · 15 authors
In recent times, Distributed Ledger Technology (DLT) has gained significant attention for its potential application in the energy sector. Utilizing blockchain and DLT has demonstrated the ability to enhance the resilience of the electric infrastructure, which will support a more flexible infrastructure and advance grid modernization. However, the deployment of these technologies increases the overall attack surface. The MITRE ATT&CK® matrices have been developed to document an adversary’s tactics and techniques based on real-world observations. The MITRE ATT&CK® matrices provide a common taxonomy for offense and defense and have become a valuable conceptual tool across multiple cybersecurity disciplines for conveying threat intelligence, performing testing through red teaming or adversary emulation, and enhancing network and system defenses against intrusions. The MITRE ATT&CK® for Industrial Control Systems (ICS) matrix was created to provide knowledge about adversary behavior in the ICS technology domain. This study analyzes the relevance of various tactics and techniques across a seven-layer DLT engineering and cybersecurity stack, known as the DLT stack, designed by the Cybersecurity Taskforce under IEEE P2418.5 - Standard for Blockchain in Energy working group sponsored by Power and Energy Systems - Smart Buildings, Loads and Customer Systems (PES/SBLC) Technical Committee. Additionally, this paper identifies specific mitigation strategies tailored to the energy ICS environment.
The rapid evolution of the Internet, particularly the emergence of Web3, has transformed the ways people interact and share data. Web3, although still not well defined, is thought to be a return to the decentralization of corporations' power over user data. Despite the obsolescence of the idea of building systems to detect and prevent cyber intrusions, this is still a topic of interest. This paper proposes a novel conceptual approach for implementing decentralized collaborative intrusion detection networks (CIDN) through a proof-of-concept. The study employs an analytical and comparative methodology, examining the synergy between cutting-edge Web3 technologies and information security. The proposed model incorporates blockchain concepts, cyber non-fungible token (cyberNFT) rewards, machine learning algorithms, and publish/subscribe architectures. Finally, the paper discusses the strengths and limitations of the proposed system, offering insights into the potential of decentralized cybersecurity models.
In recent years, with the great success of pre-trained language models, the pre-trained BERT model has been gradually applied to the field of source code understanding. However, the time cost of training a language model from... | Find, read and cite all the research you need on Tech Science Press
Blockchain smart contracts have given rise to a variety of interesting and compelling applications and emerged as a revolutionary force for the Internet. Smart contracts from various fields now hold over one trillion dollars worth of virtual coins, attracting numerous attacks. Quite a few practitioners have devoted themselves to developing tools for detecting bugs in smart contracts. One line of efforts revolve around static analysis techniques, which heavily suffer from high false positive rates. Another line of works concentrate on fuzzing techniques. Unfortunately, current fuzzing approaches for smart contracts tend to conduct fuzzing starting from the initial state of the contract, which expends too much energy revolving around the initial state of the contract and thus is usually unable to unearth bugs triggered by other states. Moreover, most existing methods treat each branch equally, failing to take care of the branches that are rare or more likely to possess bugs. This might lead to resources wasted on normal branches. In this paper, we try to tackle these challenges from three aspects: 1) generating function invocation sequences, we explicitly consider data dependencies between functions to facilitate exploring richer states. We further prolong a function invocation sequence$\mathcal {S}_{1}$by appending a new sequence$\mathcal {S}_{2}$, so that the appended sequence$\mathcal {S}_{2}$can start fuzzing from states that are different from the initial state; 2) we incorporate a branch distance-based measure to evolve test cases iteratively towards a target branch; 3) we engage a branch search algorithm to discover rare and vulnerable branches, and design an energy allocation mechanism to take care of exercising these crucial branches. We implement IR-Fuzz and extensively evaluate it over 12K real-world contracts. Empirical results show that: (i) IR-Fuzz achieves 28% higher branch coverage than state-of-the-art fuzzing approaches, (ii) IR-Fuzz detects more vulnerabilities and increases the average accuracy of vulnerability detection by 7% over current methods, and (iii) IR-Fuzz is fast, generating an average of 350 test cases per second. Our implementation and dataset are released athttps://github.com/Messi-Q/IR-Fuzz, hoping to facilitate future research.
Front-running attacks have been a major concern on the blockchain. Attackers launch front-running attacks by inserting additional transactions before upcoming victim transactions to manipulate victim transaction executions and make profits. Recent studies have shown that front-running attacks are prevalent on the Ethereum blockchain and have caused millions of US dollars loss. It is the vulnerabilities in smart contracts, which are blockchain programs invoked by transactions, that enable the front-running attack opportunities. Although techniques to detect front-running vulnerabilities have been proposed, their performance on real-world vulnerable contracts is unclear. There is no large-scale benchmark based on real attacks to evaluate their capabilities. We make four contributions in this paper. First, we design an effective algorithm to mine real-world attacks in the blockchain history. The evaluation shows that our mining algorithm is more effective and comprehensive, achieving higher recall in finding real attacks than the previous study. Second, we propose an automated and scalable vulnerability localization approach to localize code snippets in smart contracts that enable front-running attacks. The evaluation also shows that our localization approaches are effective in achieving higher precision in pinpointing vulnerabilities compared to the baseline technique. Third, we build a benchmark consisting of 513 real-world attacks with vulnerable code labeled in 235 distinct smart contracts, which is useful to help understand the nature of front-running attacks, vulnerabilities in smart contracts, and evaluate vulnerability detection techniques. Last but not least, we conduct an empirical evaluation of seven state-of-the-art vulnerability detection techniques on our benchmark. The evaluation experiment reveals the inadequacy of existing techniques in detecting front-running vulnerabilities, with a low recall of$\leq$6.04%. Our further analysis identifies four common limitations in existing techniques: lack of support for inter-contract analysis, inefficient constraint solving for cryptographic operations, improper vulnerability patterns, and lack of token support.
The Internet of Things is an essential component in the growth of an ecosystem that enables quick and precise judgments to be made for communication on the battleground. The usage of the battlefield of things (BoT) is, however, subject to several restrictions for a variety of reasons. There is a potential for instances of replay, data manipulation, breaches of privacy, and other similar occurrences. As a direct result of this, the implementation of a security mechanism to protect the communication that occurs within BoT has turned into an absolute requirement. To this aim, we propose a blockchain-based solution that is both safe and private for use in communications inside the BoT ecosystem. In addition, research is conducted on the benefits of integrating blockchain technology and cybersecurity into BoT application implementations. This work elaborates on the importance of integrating cybersecurity and blockchain-based tools, techniques and methodologies for BoT.
Social engineering (SE) attacks (also called social hacking) refer to various methods used by cybercriminals to exploit the weak nature of human beings rather than the logical and physical security measures used by organizations. This research paper studies the various methods of SE used by criminals to exploit the psychological vulnerabilities of human beings. On this basis, the paper proposes a new defense categorization of SE attacks based on two security principles: dual control (i.e., more than one entity to complete the task) and split knowledge (i.e., dual controlling of the knowledge to complete the task). We describe how those measures could stop SE attacks and avoid human weaknesses. Then, we propose an original new SE defense model that implements the security principles using blockchain technology to both dual control the transactions and record them safely for organizations. The proposed model’s first aim is to avoid the dependence on the cognitive or psychological status of the victim and enable more verification steps to be taken in a fast and flexible manner. The paper demonstrates the quick and easy adoption of the existing private blockchain platform to implement the proposed SE defense model.
Hacks on blockchains are prevalent nowadays because a wide range of vulnerabilities exists in smart contracts. To deal with the vulnerabilities, security auditing has been emerging and widely adopted for manual code inspection. However, little is known about how manual security auditing impacts the blockchain community. In this work, we investigated security audits on blockchain by answering three research questions covering the type, severity, and resolve status of issues in the audit reports. We in total collected 2,421 security audit reports consisting of the details of 28,782 security issues. We found that manual security auditing has superior merit over static analysis tools in identifying logic-related issues, considering 27.65% of all findings are logical issues. We also found that 87.28% of 2,421 projects have at least one centralization issue that breaks the decentralization primitive of blockchain. Moreover, while 21.17% of issues are of major or critical severity, we surprisingly found that 61.83% of all issues were unresolved or partially resolved. We concluded that while manual security auditing can help identify security vulnerabilities uniquely, project developers need to take serious actions to address and secure their smart contracts.
The classification of the smart contract can effectively reduce the search space and improve retrieval efficiency. The existing classification methods are based on natural language processing technologies. Because the processing of source code by these technologies lacks extraction and processing in the software engineering field, there is still a lot of room for improvement in their methods of feature extraction. Therefore, this paper proposes a multi-feature fusion method for smart contract classification (MFF-SC) based on the code processing technology. From the source code perspective, source code processing method and attention mechanism are used to extract local code features. Structure-based traversal method are used to extract global code features from abstract syntax tree. Local and global code features introduce attention mechanism to generate code semantic features. From the perspective of account transaction, the feature of account transaction is extracted by using TransR. Next, the code semantic features and account transaction features generate smart contract semantic features by an attention mechanism. Finally, the smart contract semantic features are fed into a stacked denoising autoencoder and a softmax classifier for classification. Compared with other baselines and variants, experimental results on a real-world dataset show that MFF-SC achieves an accuracy rate of 83.9%.
Huma Jamshed, Ansha Zahid, Rizwan Ul Hassan, Ahmad Hussain · 5 authors
Trustworthy smart contracts is usually challenging due to the multifaceted semantics of essential domain-specific languages and their testability. A vulnerability in smart contracts possibly comprises numerous code-security and may allow an attacker to gain control of a system resulting in financial tribulations. Therefore, it is very essential to design safe and secure smart contracts in blockchain’s immutable environment by applying numerous techniques for assessing flaws before deployment. Application programmers building smart contracts must test their code for vulnerabilities. Security and privacy is top in the list. The objective of this research is to explore: 1) the emerging landscape of smart contracts, 2) identifies the vulnerabilities faced by the developers and 3) What tools are available to address these issues? Our study showed: 1) comprehensive realistic studies in the smart contract security are at present lagging as related to primary studies. 2) 73% of contracts implemented in Solidity had security vulnerabilities. 3) Poor programming technique and 4) Slack programming activity.
SMT. M. VANI, M. Doshi, Amit A. Nanavati, A. Kundu
Blockchain platforms and smart contracts are vulnerable to security breaches. Security breaches of smart contracts have led to huge financial losses in terms of cryptocurrencies and tokens. In this paper, we present a systematic survey of vulnerability analysis of smart contracts. We begin by providing a brief about the major types of attacks and vulnerabilities that are present in smart contracts. Then we discuss existing frameworks, methods and technologies used for vulnerability detection. We summarise our findings in a table which lists each framework and the attacks it protects against.
The search for smart contract source codes has drawn research attention to fulfill developers’ and researchers’ needs. Yet, the existing studies are not mature enough to address smart contracts’ technical properties and functionalities. This paper proposes a system to improve the naive search for smart contract codes; for example, Etherscan has one keyword search feature without regard to the contract structure. We consider clustering smart contracts based on developers’ preferences, which increases the probability that the resulting source codes match developers’ needs. Our experimental results show a significant improvement in the complexity of the retrieved source codes of smart contracts compared with the baseline scenario using blockchain search engines (e.g., Etherscan). Our solution reduces the number of retrieved smart contract codes the developer has to check if the codes match her/his needs by 94%, 88%, 82%, or 98%, depending on the user’s search preferences.