Smart contracts are decentralized applications running on blockchain platforms and have been widely used in a variety of scenarios in recent years. However, frequent smart contract security incidents have focused more and more attention on their security and reliability, and smart contract vulnerability detection has become an urgent problem in blockchain security. Most of the existing methods rely on fixed rules defined by experts, which have the disadvantages of single detection type, poor scalability, and high false alarm rate. To solve the above problems, this paper proposes a method that combines Bi-LSTM and an attention mechanism for multiple vulnerability detection of smart contract opcodes. First, we preprocessed the data to convert the opcodes into a feature matrix suitable as the input of the neural network and then used the Bi-LSTM model based on the attention mechanism to classify smart contracts with multiple labels. The experimental results show that the model can detect multiple vulnerabilities at the same time, and all evaluation indicators exceeded 85%, which proves the effectiveness of the method proposed in this paper for multiple vulnerability detection tasks in smart contracts.
In recent years, counterfeit luxury products have become a major concern for consumers worldwide. The reason for the proliferation of counterfeit products is that the manufacturing and distribution process is not transparent to consumers and this information can be easily falsified or altered by others. To solve this problem, this paper proposes the development of a management system using blockchain and smart contract technology to solve the problems of data forgery and data tampering, while tracking the information related to luxury products and ensuring the accuracy and authenticity of the relevant data, to achieve the purpose of luxury product anti-counterfeiting. When using Hyperledger Fabric to deploy the blockchain and execute smart contracts, all information related to the production and logistics process of luxury goods will be uploaded to the blockchain. No human intervention is required to create a complete, traceable, tamper-proof, and trusted repository. Compared to previous work, this paper combines blockchain technology with specific processes in the supply chain, employing a variety of security methods to secure the communication process. Moreover, our proposed solution is more flexible in transmission, with more secure protocols also making data harder to tamper with and falsify, thereby solving the problem of forgery and tracking of luxury products.
Digital forensic examiners and stakeholders face increasing challenges during the investigation of Internet of Things (IoT) environments due to the heterogeneous nature of the IoT infrastructure. These challenges include guaranteeing the integrity of forensic evidence collected and stored during the investigation process. Similarly, they also encounter challenges in ensuring the transparency of the investigation process which includes the chain-of-custody and evidence chain. In recent years, some blockchain-based secure evidence models have been proposed especially for IoT forensic investigations. These proof-of-concept models apply the inherent properties of blockchain to secure the evidence chain of custody, maintain privacy, integrity, provenance, traceability, and verification of evidence collected and stored during the investigation process. Although there have been few prototypes to demonstrate the practical implementation of some of these proposed models, there is a lack of descriptive review of these blockchain-based IoT forensic models. In this paper, we report a comprehensive Systematic Literature Review (SLR) of the latest blockchain-based IoT forensic investigation process models. Particularly, we systematically review how blockchain is being used to securely improve the forensic investigation process and discuss the efficiency of these proposed models. Finally, the paper highlights challenges, open issues, and future research directions of blockchain technology in the field of IoT forensic investigations.
Tin Tironsakkul, Manuel Maarek, Andrea Eross, Mike Just
Bitcoin and other cryptocurrencies are well-known for their privacy properties that allow for the “anonymous” exchange of money. Bitcoin tracking with taint analysis remains challenging as it does not account for the change in Bitcoins' ownership or the usage of Privacy-Enhancing Technologies (PETs) to obscure Bitcoins' movement, and often produces unessential incidents with transactions unlikely to be related to the targeted activity. In this paper, we propose to improve the Bitcoin taint analysis tracking process that adapts to the context of address ownership and avoid following unrelated transactions. First, we introduce an approach in which we incorporate Bitcoin taint analysis with address profiling. Second, we propose two context-based taint analysis strategies. Third, we introduce a set of metrics using hypothesised behaviours related to illegal Bitcoins and recognisable patterns within the blockchain. We conducted an experiment using sample data from known Bitcoin theft cases to illustrate and evaluate the approach. The results on address profile integration reveal distinct transaction behaviours in tracking theft cases following all the metrics, such as address reuse, address size and transaction fee payment. One of the context-based tracking strategies, Dirty-First, shows positive potential for illustrating illegal Bitcoins’ spending and obscuring strategies. The majority of the six metrics we defined give distinct results in transaction behaviours between the theft cases and the control groups. Our context-based tracking methodology provides a solution for one of the shortcomings in the current Bitcoin tracking methodology and the next step for future cryptocurrency and cybercrime forensic research.
In this paper, we address the problems of fraud and anomalies in the Bitcoin network. These are common problems in e-banking and online transactions. However, as the financial sector evolves, so do the methods for fraud and anomalies. Moreover, blockchain technology is being introduced as the most secure method integrated into finance. However, along with these advanced technologies, many frauds are also increasing every year. Therefore, we propose a secure fraud detection model based on machine learning and blockchain. There are two machine learning algorithms-XGboost and random forest (RF)-used for transaction classification. The machine learning techniques train the dataset based on the fraudulent and integrated transaction patterns and predict the new incoming transactions. The blockchain technology is integrated with machine learning algorithms to detect fraudulent transactions in the Bitcoin network. In the proposed model, XGboost and random forest (RF) algorithms are used to classify transactions and predict transaction patterns. We also calculate the precision and AUC of the models to measure the accuracy. A security analysis of the proposed smart contract is also performed to show the robustness of our system. In addition, an attacker model is also proposed to protect the proposed system from attacks and vulnerabilities.
In recent years, cryptocurrencies' economic application and speculative value have soared. Cryptocurrency is being used as a means of trade, even in Pakistan. The government does not legalize it, but it is traded like many other states. Globally it causes fraudulent investment schemes. Cryptocurrencies are speculative, as the dot-com boom of the 1990s. Even though these organizations lacked a product, business plan, and profit potential, the stock market was eager to invest heavily in internet-related companies. A few years later, a dot-com catastrophe ended an era of unjustified and speculative online firms. The gold rush occurred much earlier. In the 1800s, people worldwide sought their fortune in the U.S., Canada, and Australia. They rapidly understood that mining a significant gold stake was dangerous and unlikely to succeed. In 2021, cryptocurrencies will become the dominant form of money. 2021 was the landmark year. Bitcoin became the new gold rush and caused online fraud, known as cryptocurrency fraud. We will examine cryptocurrency, crimes, laws, and regulations to combat crypto crimes.
Muhammad Umar Nasir, Safiullah Khan, Shahid Mehmood, Muhammad Adnan Khan · 6 authors
The study presents a framework to analyze and detect meddling in real-time network data and identify numerous meddling patterns that may be harmful to various communication means, academic institutes, and other industries. The major challenge was to develop a non-faulty framework to detect meddling (to overcome the traditional ways). With the development of machine learning technology, detecting and stopping the meddling process in the early stages is much easier. In this study, the proposed framework uses numerous data collection and processing techniques and machine learning techniques to train the meddling data and detect anomalies. The proposed framework uses support vector machine (SVM) and K-nearest neighbor (KNN) machine learning algorithms to detect the meddling in a network entangled with blockchain technology to ensure the privacy and protection of models as well as communication data. SVM achieves the highest training detection accuracy (DA) and misclassification rate (MCR) of 99.59% and 0.41%, respectively, and SVM achieves the highest-testing DA and MCR of 99.05% and 0.95%, respectively. The presented framework portrays the best meddling detection results, which are very helpful for various communication and transaction processes.
Detecting malicious activity in advance has become increasingly important for public safety, economic stability, and national security. However, the disparity in living standards incites the minds of certain undesirable members of society to commit crimes, which may disrupt society’s stability and mental calm. Breakthroughs in deep learning (DL) make it feasible to address such challenges and construct a complete intelligent framework that automatically detects such malicious behaviors. Motivated by this, we propose a convolutional neural network (CNN)-based Xception model, i.e., BlockCrime, to detect crimes and improve public safety. Furthermore, we integrate blockchain technology to securely store the detected crime scene locations and alert the nearest law enforcement authorities. Due to the scarcity of the dataset, transfer learning has been preferred, in which a CNN-based Xception model is used. The redesigned Xception architecture is evaluated against various assessment measures, including accuracy, F1 score, precision, and recall, where it outperforms existing CNN architectures in terms of train accuracy, i.e., 96.57%.
Anokye Acheampong Amponsah, Adebayo Felix Adekoya, Benjamin Asubam Weyori
Healthcare fraud is a global problem affecting both developing and developed countries. It is the deliberate attempt of the perpetrators to take undue advantage of the inefficiencies in current healthcare systems. Fraud tends to deny legitimate beneficiaries of universal health coverage, especially those under health insurance protection. In this work, we propose using machine learning techniques and blockchain technology to detect and prevent fraud in healthcare, especially in claims processing. A decision tree classification algorithm is adopted to classify the original claims dataset. The extracted knowledge is programmed in the Ethereum blockchain smart contract to detect and prevent healthcare fraud. The comparative experimental results show that the best performing tool achieves a classification accuracy of 97.96% and a sensitivity of 98.09%. This means that the proposed system enhances the blockchain smart contract’s ability to detect fraud with an accuracy of 97.96%.
Traditional ways of distributing and verifying academic certificates are not efficient. Certificates are distributed as hard copy. Verifying the integrity of the certificate is a time and resource consuming process. As a result, forged certificates have become common. It is very difficult to differentiate between a real and a forged certificate. Through our system, we intend to make the certificate generation, distribution, and verification process seamless. Any student can enter his or her personal details, academic coursework details, and the university code, and thus submit a certificate request to the university. University admins can verify the certificate requests, and approve or reject the requests as per their policy. Any student or third party could verify the integrity of the certificate by entering the details of the certificate under scrutiny into the system.
Blockchain, the technology infrastructure behind the famous cryptocurrency bitcoin, can take away the notion of trust from centralized organizations to a decentralized platform that is mathematically verifiable and cryptographically secure. It is gaining more significant momentum exponentially and disrupts the way businesses function beyond the digital currency aspects. This work presents a text mining literature analysis of research articles published in major digital libraries on blockchain technology and cybersecurity. This literature analysis employs automated text mining approaches such as topic modeling and keyphrase extraction for unearthing the themes from a vast body of literature. This analysis highlights the multidisciplinary nature of blockchain technology within the cybersecurity domain. The findings also show the cyber threats and vulnerabilities that evolve with blockchain technology developments. This analysis also showcases the computer security research community’s vulnerabilities and provides future research dimensions that are crucial for designing secure blockchain applications and platforms.
Cyber Threat Intelligence (CTI) is the knowledge of cyber and physical threats that help mitigate potential cyber attacks. The rapid evolution of the current threat landscape has seen many organisations share CTI to strengthen their security posture for mutual benefit. However, in many cases, CTI data contains attributes (e.g., software versions) that have the potential to leak sensitive information or cause reputational damage to the sharing organisation. While current approaches allow restricting CTI sharing to trusted organisations, they lack solutions where the shared data can be verified and disseminated `differentially' (i.e., selective information sharing) with policies and metrics flexibly defined by an organisation. In this paper, we propose a blockchain-based CTI sharing framework that allows organisations to share sensitive CTI data in a trusted, verifiable and differential manner. We discuss the limitations associated with existing approaches and highlight the advantages of the proposed CTI sharing framework. We further present a detailed proof of concept using the Ethereum blockchain network. Our experimental results show that the proposed framework can facilitate the exchange of CTI without creating significant additional overheads.
Cross-Chain bridges have become the most popular solution to support asset interoperability between heterogeneous blockchains. However, while providing efficient and flexible cross-chain asset transfer, the complex workflow involving both on-chain smart contracts and off-chain programs causes emerging security issues. In the past year, there have been more than ten severe attacks against cross-chain bridges, causing billions of loss. With few studies focusing on the security of cross-chain bridges, the community still lacks the knowledge and tools to mitigate this significant threat. To bridge the gap, we conduct the first study on the security of cross-chain bridges. We document three new classes of security bugs and propose a set of security properties and patterns to characterize them. Based on those patterns, we design Xscope, an automatic tool to find security violations in cross-chain bridges and detect real-world attacks. We evaluate Xscope on four popular cross-chain bridges. It successfully detects all known attacks and finds suspicious attacks unreported before. A video of Xscope is available at https://youtu.be/vMRO_qOqtXY.
The core of many cryptocurrencies is the decentralised validation network operating on proof-of-work technology. In these systems, validation is done by so-called miners who can digitally sign blocks once they solve a computationally-hard problem. Conventional wisdom generally considers this protocol as secure and stable as miners are incentivised to follow the behaviour of the majority. However, whether some strategic mining behaviours occur in practice is still a major concern. In this paper we target this question by focusing on a security threat: a selfish mining attack in which malicious miners deviate from protocol by not immediately revealing their newly mined blocks. We propose a statistical test to analyse each miner's behaviour in five popular cryptocurrencies: Bitcoin, Litecoin, Monacoin, Ethereum and Bitcoin Cash. Our method is based on the realisation that selfish mining behaviour will cause identifiable anomalies in the statistics of miner's successive blocks discovery. Secondly, we apply heuristics-based address clustering to improve the detectability of this kind of behaviour. We find a marked presence of abnormal miners in Monacoin and Bitcoin Cash, and, to a lesser extent, in Ethereum. Finally, we extend our method to detect coordinated selfish mining attacks, finding mining cartels in Monacoin where miners might secretly share information about newly mined blocks in advance. Our analysis contributes to the research on security in cryptocurrency systems by providing the first empirical evidence that the aforementioned strategic mining behaviours do take place in practice.
Blockchain is making a big impact in various applications, but it is also attracting a variety of cybercrimes. In blockchain, phishing transfers the victim’s virtual currency to make huge profits through fraud, which poses a threat to the blockchain ecosystem. To avoid greater losses, Ethereum, one of the blockchain platforms, can provide information to detect phishing fraud. In this study, to effectively detect phishing nodes, we propose a phishing node detection approach as message passing based graph convolution network. We first form a transaction network through the transaction records of Ethereum and then extract the information of nodes effectively via message passing. Finally, we use a graph convolution network to classify the normal and phishing nodes. Experiments show that our method is effective and superior to other existing methods.
Ningyu He, Haoyu Wang, Lei Wu, Xiapu Luo · 6 authors
EOSIO, as one of the most representative blockchain 3.0 platforms, involves lots of new features, e.g., delegated proof of stake consensus algorithm and updatable smart contracts, enabling a much higher transaction per second and the prosperous decentralized applications (DApps) ecosystem. According to the statistics, it has reached nearly 18 billion USD, taking the third place of the whole cryptocurrency market, following Bitcoin and Ethereum. Loopholes, however, are hiding in the shadows. EOSBet, a famous gambling DApp, was attacked twice within a month and lost more than 1 million USD. No existing work has surveyed the EOSIO from a security researcher perspective. To fill this gap, in this paper, we collected all occurred attack events against EOSIO, and systematically studied their root causes, i.e., vulnerabilities lurked in all relying components for EOSIO, as well as the corresponding attacks and mitigations. We also summarized some best practices for DApp developers, EOSIO official team, and security researchers for future directions.
U ovom radu predstavljeno je potencijalno rešenje za decentralizovanu aplikaciju za sportsku kladionicu u okviru Ethereum blockchain mreže. Objašnjenje su teorijske osnove i navedeni izazovi koji se susreću u ovom domenu. Opisane su terminologije vezane za ovu decentralizovanu aplikaciju kao što su blockchain tehnologija, Ethereum blockchain, koncept pametnih ugovora, Oracle entiteti i Solidity jezik. Na kraju je prikazan model i opis implementacije sistema, kao i završna zaključena zapažanja.
In recent years, cryptocurrencies have increasingly been used in cybercrime and have become the key means of payment in darknet marketplaces, partly due to their alleged anonymity. Furthermore, the research attacking the anonymity of even those cryptocurrencies that claim to offer anonymity by design is growing and is being applied by law enforcement agencies in the fight against cybercrime. Their investigative measures require a certain degree of suspicion and it is unclear whether findings resulting from attacks on cryptocurrencies’ anonymity can indeed establish that required degree of suspicion. The reason for this is that these attacks are partly based upon uncertain assumptions which are often not properly addressed in the corresponding papers. To close this gap, we extract the assumptions in papers that are attacking Bitcoin, Monero and Zcash, major cryptocurrencies used in darknet markets which have also received the most attention from researchers. We develop a taxonomy to capture the different nature of those assumptions in order to help investigators to better assess whether the required degree of suspicion for specific investigative measures could be established. We found that assumptions based on user behaviour are in general the most unreliable and thus any findings of attacks based on them might not allow for intense investigative measures such as pre-trial detention. We hope to raise awareness of the problem so that in the future there will be fewer unlawful investigations based upon uncertain assumptions and thus fewer human rights violations.
Jinho Choi, Jaehan KIM, Minkyoo Song, Hanna KIM · 8 authors
Cryptocurrency abuse has become a critical problem. Due to the anonymous nature of cryptocurrency, criminals commonly adopt cryptocurrency for trading drugs and deceiving people without revealing their identities. Despite its significance and severity, only few works have studied how cryptocurrency has been abused in the real world, and they only provide some limited measurement results. Thus, to provide a more in-depth understanding on the cryptocurrency abuse cases, we present a large-scale analysis on various Bitcoin abuse types using 200,507 real-world reports collected by victims from 214 countries. We scrutinize observable abuse trends, which are closely related to real-world incidents, to understand the causality of the abuses. Furthermore, we investigate the semantics of various cryptocurrency abuse types to show that several abuse types overlap in meaning and to provide valuable insight into the public dataset. In addition, we delve into abuse channels to identify which widely-known platforms can be maliciously deployed by abusers following the COVID-19 pandemic outbreak. Consequently, we demonstrate the polarization property of Bitcoin addresses practically utilized on transactions, and confirm the possible usage of public report data for providing clues to track cyber threats. We expect that this research on Bitcoin abuse can empirically reach victims more effectively than cybercrime, which is subject to professional investigation.
This study looks into the current, and potential uses of Blockchain technology in business, specifically in security system of enterprise. The goal of this study is to use modern blockchain technology to address the problem of enhancing the degree of cybersecurity in huge corporations. Enterprises that have seen examples of cyber fraud perpetrated not only by hackers but also by business personnel have evaluated the urgency of the matter. The authors have developed a blockchain-based system dynamic model of the company's cybersecurity system. The use of this modeling tool enables the creation of a computer model of a complicated cybersecurity system, which can then be used to design the suggested update more effectively. We show how Blockchain affects auditing in a variety of ways that will fundamentally alter the profession. We also believe that blockchain technology should be integrated into other parts of cybersecurity, including auditing and general accounting operations. The findings have allowed researchers to draw conclusions about the increased system response in cases of employee fraud in the context of a company's automated information system that uses blockchain technology.
Social media has transformed the mode of communication globally by providing an extensive system for exchanging ideas, initiating business contracts, and proposing new professional ideas. However, there are many limitations to the use of social media, such as misinformation, lack of effective content moderation, digital piracy, data breaches, identity fraud, and fake news. In order to address these limitations, several studies have introduced the application of Blockchain technology in social media. Blockchains can provides transparency, traceability, tamper-proofing, confidentiality, security, information control, and supervision. This paper is a systematic literature review of papers covering the application of Blockchain technology in social media. To the best of our knowledge, this is the first systematic literature review that elucidates the combination of Blockchain and social media. Using several electronic databases, 42 related papers were reviewed. Our findings show that previous studies on the applications of Blockchain in social media are focused mainly on blocking fake news and enhancing data privacy. Research in this domain began in 2017. This review additionally discusses several challenges in applying Blockchain technologies in social media contexts, and proposes alternative ideas for future implementation and research.