Bruno Rodrigues, Eder J. Scheid, Christian Killer, Muriel Figueredo Franco · 5 authors
Abstract Distributed Denial-of-Service (DDoS) attacks are one of the major causes of concerns for communication service providers. When an attack is highly sophisticated and no countermeasures are available directly, sharing hardware and defense capabilities become a compelling alternative. Future network and service management can base its operations on equally distributed systems to neutralize highly distributed DDoS attacks. A cooperative defense allows for the combination of detection and mitigation capabilities, the reduction of overhead at a single point, and the blockage of malicious traffic near its source. Main challenges impairing the widespread deployment of existing cooperative defense are: (a) high complexity of operation and coordination, (b) need for trusted and secure communications, (c) lack of incentives for service providers to cooperate, and (d) determination on how operations of these systems are affected by different legislation, regions, and countries. The cooperative Blockchain Signaling System ( BloSS ) defines an effective and alternative solution for security management, especially cooperative defenses, by exploiting Blockchains (BC) and Software-Defined Networks (SDN) for sharing attack information, an exchange of incentives, and tracking of reputation in a fully distributed and automated fashion. Therefore, BloSS was prototyped and evaluated through a global experiment, without the burden to maintain, design, and develop special registries and gossip protocols.
Lukas Mastilak, Marek Galinski, Pavol Helebrandt, Ivan Kotuliak · 5 authors
Communication on the Internet consisting of a massive number of Autonomous Systems (AS) depends on routing based on Border Gateway Protocol (BGP). Routers generally trust the veracity of information in BGP updates from their neighbors, as with many other routing protocols. However, this trust leaves the whole system vulnerable to multiple attacks, such as BGP hijacking. Several solutions have been proposed to increase the security of BGP routing protocol, most based on centralized Public Key Infrastructure, but their adoption has been relatively slow. Additionally, these solutions are open to attack on this centralized system. Decentralized alternatives utilizing blockchain to validate BGP updates have recently been proposed. The distributed nature of blockchain and its trustless environment increase the overall system security and conform to the distributed character of the BGP. All of the techniques based on blockchain concentrate on inspecting incoming BGP updates only. In this paper, we improve on these by modifying an existing architecture for the management of network devices. The original architecture adopted a private blockchain implementation of HyperLedger. On the other hand, we use the public blockchain Ethereum, more specifically the Ropsten testing environment. Our solution provides a module design for the management of AS border routers. It enables verification of the prefixes even before any router sends BGP updates announcing them. Thus, we eliminate fraudulent BGP origin announcements from the AS deploying our solution. Furthermore, blockchain provides storage options for configurations of edge routers and keeps the irrefutable history of all changes. We can analyze router settings history to detect whether the router advertised incorrect information, when and for how long.
Jeonghun Cha, Sushil Kumar Singh, Yi Pan, Jong Hyuk Park
Nowadays, the designing of cyber-physical systems has a significant role and plays a substantial part in developing a sustainable computing ecosystem for secure and scalable network architecture. The introduction of Cyber Threat Intelligence (CTI) has emerged as a new security system to mitigate existing cyber terrorism for advanced applications. CTI demands a lot of requirements at every step. In particular, data collection is a critical source of information for analysis and sharing; it is highly dependent on the reliability of the data. Although many feeds provide information on threats recently, it is essential to collect reliable data, as the data may be of unknown origin and provide information on unverified threats. Additionally, effective resource management needs to be put in place due to the large volume and diversity of the data. In this paper, we propose a blockchain-based cyber threat intelligence system architecture for sustainable computing in order to address issues such as reliability, privacy, scalability, and sustainability. The proposed system model can cooperate with multiple feeds that collect CTI data, create a reliable dataset, reduce network load, and measure organizations’ contributions to motivate participation. To assess the proposed model’s effectiveness, we perform the experimental analysis, taking into account various measures, including reliability, privacy, scalability, and sustainability. Experimental results of evaluation using the IP of 10 open source intelligence (OSINT) CTI feeds show that the proposed model saves about 15% of storage space compared to total network resources in a limited test environment.
The dissemination of false messages in Internet of Vehicles (IoV) has a negative impact on road safety and traffic efficiency. Therefore, it is critical to quickly detect fake news considering news timeliness in IoV. We propose a network computing framework Quick Fake News Detection (QcFND) in this paper, which exploits the technologies from Software-Defined Networking (SDN), edge computing, blockchain, and Bayesian networks. QcFND consists of two tiers: edge and vehicles. The edge is composed of Software-Defined Road Side Units (SDRSUs), which is extended from traditional Road Side Units (RSUs) and hosts virtual machines such as SDN controllers and blockchain servers. The SDN controllers help to implement the load balancing on IoV. The blockchain servers accommodate the reports submitted by vehicles and calculate the probability of the presence of a traffic event, providing time-sensitive services to the passing vehicles. Specifically, we exploit Bayesian Network to infer whether to trust the received traffic reports. We test the performance of QcFND with three platforms, i.e., Veins, Hyperledger Fabric, and Netica. Extensive simulations and experiments show that QcFND achieves good performance compared with other solutions.
Davy Preuveneers, Wouter Joosen, Jorge Bernal Bernabé, Antonio Skármeta
Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.
This paper describes a simulation study on security attacks over Distributed\nLedger Technologies (DLTs). We specifically focus on attacks at the underlying\npeer-to-peer layer of these systems, that is in charge of disseminating\nmessages containing data and transaction to be spread among all participants.\nIn particular, we consider the Sybil attack, according to which a malicious\nnode creates many Sybils that drop messages coming from a specific attacked\nnode, or even all messages from honest nodes. Our study shows that the\nselection of the specific dissemination protocol, as well as the amount of\nconnections each peer has, have an influence on the resistance to this attack.\n
EOSIO is one typical public blockchain platform. It is scalable in terms of transaction speeds and has a growing ecosystem supporting smart contracts and decentralized applications. However, the vulnerabilities within the EOSIO smart contracts have led to serious attacks, which caused serious financial loss to its end users. In this work, we systematically analyzed three typical EOSIO smart contract vulnerabilities and their related attacks. Then we presented EOSFuzzer, a general black-box fuzzing framework to detect vulnerabilities within EOSIO smart contracts. In particular, EOSFuzzer proposed effective attacking scenarios and test oracles for EOSIO smart contract fuzzing. Our fuzzing experiment on 3963 EOSIO smart contracts shows that EOSFuzzer is both effective and efficient to detect EOSIO smart contract vulnerabilities with high accuracy.
Santiago Figueroa-Lorenzo, Jon Goya, Javier Añorga, Iñigo Adín · 6 authors
The European Union is moving toward the “smart” era having as one of the key topics the smart mobility. What is more, the European union (EU) is moving toward Mobility as a Service (MaaS). The key concept behind MaaS is the capability to offer both the traveler's mobility and goods' transport solutions based on travel needs. For example, unique payment methods, intermodal tickets, passenger services, freight transport services, etc. The introduction of new services implies the integration of many Internet-of-Things (IoT) sensors. At this point, security gains a key role in the railway sector. Considering an environment where sensor data are monitored from sensor events, and alarms are detected and emitted when events contain an anomaly, this document proposes the development of an alarms collection system, which ensures both traceability and privacy of these alarms. This system is based on Ethereum blockchain events-log, as an efficient storage mechanism, which guarantees that any railway entity can participate in the network, ensuring both entity security and information privacy.
With the popularity of Internet of Things (IoT) technology, the security of the IoT network has become an important issue. Traditional intrusion detection systems have their limitations when applied to the IoT network due to resource constraints and the complexity. This research focusses on the design, implementation and testing of an intrusion detection system which uses a hybrid placement strategy based on a multi-agent system, blockchain and deep learning algorithms. The system consists of the following modules: data collection, data management, analysis, and response. The National security lab–knowledge discovery and data mining NSL-KDD dataset is used to test the system. The results demonstrate the efficiency of deep learning algorithms when detecting attacks from the transport layer. The experiment indicates that deep learning algorithms are suitable for intrusion detection in IoT network environment.
EOSIO has become one of the most popular blockchain platforms since its mainnet launch in June 2018. In contrast to the traditional PoW-based systems (e.g., Bitcoin and Ethereum), which are limited by low throughput, EOSIO is the first high throughput Delegated Proof of Stake system that has been widely adopted by many decentralized applications. Although EOSIO has millions of accounts and billions of transactions, little is known about its ecosystem, especially related to security and fraud. In this paper, we perform a large-scale measurement study of the EOSIO blockchain and its associated DApps. We gather a large-scale dataset of EOSIO and characterize activities including money transfers, account creation and contract invocation. Using our insights, we then develop techniques to automatically detect bots and fraudulent activity. We discover thousands of bot accounts (over 30% of the accounts in the platform) and a number of real-world attacks (301 attack accounts). By the time of our study, 80 attack accounts we identified have been confirmed by DApp teams, causing 828,824 EOS tokens losses (roughly \$2.6 million) in total.
The concept of microservices architecture has nowadays become popular in the development of most software systems due to their benefits of application modularity and flexibility. Nevertheless, such architecture poses new security concerns especially on how to handle APIs that act as points of communication between different services. Traditional API protection strategies, based on predetermined patterns and a centralized platform, can be ineffective in guarding microservices because of the loosely connected structure of the latter. These limitations make APIs a sweet spot of highly skilled cyber threats like unauthorized data access, injection assaults, and Distributed Denial of Service (DDoS). This research presents a conceptual framework known as Dynamic Adaptive API Security Framework that uses Artificial Intelligence (AI) and blockchain technology to address these challenges. This first one uses AI to monitor API traffic and detect anomalies in real time with the help of the proposed framework. Through anomaly detection, machine learning models can detect unusual activity such as Suspicious usage patterns, patterns with malicious payloads, and pattern of many API calls. Also, AI offers an analytic feature, which can predict the vulnerability a certain target, based on data from previous attacks, and allow targeted prevention. Alongside AI, blockchain innovation is used to create an unalterable, distributed record of communication between API. Based on consensus mechanisms like Proof of Stake or Practical Byzantine Fault Tolerance, the framework guarantees the provenance of API transaction logs. These logs offer a great resource for the forensic activities in case of a breach of the system’s security. Also, smart contracts support even complex and constantly changing dynamic access control policies, adjusting as soon as AI-driven threat intelligence data is available. This synergy of using AI and blockchain in the framework generates an adaptable, transparent, and resilient security model that interfaces threats. Real-time anomaly detection together with immutable auditability integrated in the proposed framework improves the level of API security in microservices while simultaneously supporting GDPR and HIPAA compliance. This approach fills the gap in existing security solutions which cannot cope with the growing security issues in microservices format, providing a long-term solution for increasing security of complicated, decentralized microservices landscape. Summing up, this work presents a new comprehensive strategy to API security using the advantages of both AI and blockchain technologies. Applying the framework identifies how these technologies can be synchronously balanced and orchestrated to respond to threats, protect data input, and offer clear microservices security and foundation for the advancement of subsequent generation of software.
Dimitri Kamenski, Arash Shaghaghi, Matthew Warren, Salil S. Kanhere
We focus on the problem of botnet orchestration and discuss how attackers can leverage decentralised technologies to dynamically control botnets with the goal of having botnets that are resilient against hostile takeovers. We cover critical elements of the Bitcoin blockchain and its usage for `floating command and control servers'. We further discuss how blockchain-based botnets can be built and include a detailed discussion of our implementation. We also showcase how specific Bitcoin APIs can be used in order to write extraneous data to the blockchain. Finally, while in this paper, we use Bitcoin to build our resilient botnet proof of concept, the threat is not limited to Bitcoin blockchain and can be generalized.
Background/Objectives: Tremendous growth of information and communication technologies (ICTs) have positively affected the field of E-Learning (EL). However, recently the education mode is shifted from the traditional classroom towards EL due to widespread COVID-19. The selection of suitable EL tool and security of EL data and environment are still the key challenges that need to be addressed. The objective of this paper is to guide the EL Practitioners in the selection of suitable EL tool and to provide a detailed framework for maintaining privacy and security of EL data and environment. Purpose: This study aims to help EL practitioners in the selection of suitable EL tool and to provide a secure framework for the security of EL data and environment. Method: Realtime statistics are gathered and analyzed to visualize the impact of COVID-19 on education around the world. The increasing demand for EL during COVID-19 is analyzed, and a detailed taxonomy is provided to make the EL practitioners aware of existing distance learning solutions. A comparison of commonly used EL tools is provided that will help in the selection of EL tools according to institutional requirements. A Blockchain-based EL framework is proposed that will help EL designer in managing the security of EL data and environment. Conclusion: The proposed framework is expected to provide a promising solution for developing a fair and open learning online education environment and will overcome the deficiencies caused by school closures during COVID-19. Keywords: COVID-19; Blockchain; Security; Privacy; E-Learning; Digital Curriculum
With the rise of cloud computing, data centers, and big data, the current rigid network architecture has been found to be inadequate. The modern technological demands require a flexible and easily reconfigurable network architecture. Software Defined Networking is a revolutionary concept that separates the control plane of network devices from their data plane and centralizes the control plane of all devices, facilitating the controlling of the entire network through a single portal. This helps us create flexible network architectures that can be reconfigured quickly to fit different needs. However, centralizing control leads to a Single Point of Failure and makes the network vulnerable to Denial of Service attacks, which is one of the major reasons why industries are reluctant to adopt this technology. Blockchain provides us a with a distributed ledger and a decentralized state, allowing us to create decentralized applications that run over multiple computers. This research aims to distribute the control plane of Software Defined Networks across multiple devices using blockchain. This addresses the existing security vulnerabilities of the Software Defined Network architecture such as Single Point of Failure while continuing to keep the control plane logically centralized, thereby allowing the network to be configured through a single portal. The resulting architecture has a physically distributed control plane whose logic is centralized.
Increasingly growing Cryptocurrency markets have become a hive for scammers to run pump and dump schemes which is considered as an anomalous activity in exchange markets. Anomaly detection in time series is challenging since existing methods are not sufficient to detect the anomalies in all contexts. In this paper, we propose a novel hybrid pump and dump detection method based on distance and density metrics. First, we propose a novel automatic thresh-old setting method for distance-based anomaly detection. Second, we propose a novel metric called density score for density-based anomaly detection. Finally, we exploit the combination of density and distance metrics successfully as a hybrid approach. Our experiments show that, the proposed hybrid approach is reliable to detect the majority of alleged P & D activities in top ranked exchange pairs by outperforming both density-based and distance-based methods.
Bo Zhao, Yifan Liu, Xiang Li, Jiayue Li · 5 authors
The data layer devices in the Software Defined Network (SDN) play an important role in packet forwarding. However, whether the forwarding task can be efficiently completed by the node has not attracted enough attention. A method called TrustBlock is proposed in this paper, which introduces trust as a security attribute in SDN routing planning. Besides, in order to enhance the integrity and controllability of trust evaluation, the double-layer blockchain architecture is established. In the first layer, the behavior data of the node is recorded, and then the trust calculation is performed in the second layer. In the evaluation model, nodes' trust is calculated from three aspects: direct trust, indirect trust and historical trust. Firstly, from the perspective of security, blockchain is used to achieve identity authentication of nodes, after that, from the perspective of reliability, the forwarding status is used to calculate the trust value. Secondly, consensus algorithm is used to filter malicious recommendation trust value and prevent colluding attacks. Finally, the adaptive historical trust weight is designed to prevent the periodic attack. In this paper, the entropy method is used to determine the weight of each evaluation attribute, which can avoid the problem that the subjective judgment method is not adaptable to the weight setting. Simulation results show that the detection rate of the TrustBlock is up to 98.89%, which means this model can effectively identify the abnormal nodes in SDN. Moreover, it is attractive in terms of integrity and controllability.
The block chain is attaining popularity day to day as it is acting as distributed ledger for Cryptocurrency such as Bitcoin and ripple. This research paper has focused on the Blockchain and its working pattern with technical implementation of block creation. This technical paper is considering the prevention of DNS Cache poisoning attack in Blockchain which is known as larger class of name-based attacks. DNS Packet interceptions may be made using various attacks like Cache poisoning attack, man-in-the-middle attacks etc. As there are numerous security mechanisms to secure the Blockchain but in order to make Blockchain immune from cache poisoning attack, there is need to update the block creation module. Therefore, this research work is proposed to make reduction in probability of data corruption that can be created from different attacks. It resolves the issue of cache poisoning attacks using user defined port instead of predefined port. However, the initialization of transmission is performed here using predefined port number. In second step, the encrypted port number is decrypted to initiate communication using user defined port number. The use of port with IP address would restrict attacks during data transmission. The paper has presented the comparative analysis of existing DNS attacking prevention mechanism to proposed work.
Wilfridus Bambang Triadi Handaya, Mohd Najwadi Yusoff, Aman Jantan
Abstract Cybercrime is the highest threat to every private company and government agency in the world. Using synergistic threats to attack provides many success alternatives that lead to the same goal, which is to take over the network and carry out illegal mining activities using CPU resources from the victim’s computer. One of the main motives for the success of this criminal business is its relatively low cost and high return of investment. Using the infection chain method in carrying out cryptocurrency mining malware attacks with fileless techniques involves loading malicious code into system memory. Monero (XMR) is by far the highest popular cryptocurrency among threat actor installing mining malware because it comes with full anonymity and resistance to an application-specific circuit mining (ASIC). This work proposes a better method for classifying conventional malware and cryptocurrency mining malware. On the other hand, grouping specific of suitable features extracted from the sources of EMBER dataset shown as malware and need to categorize as a cryptocurrency mining malware. The proposed approach is defining a better algorithm for enhancing accuracy and efficiency for cryptocurrency mining malware detection.
Applying watermarking protocols can effectively support the copyright protection to identify illegal distributors over the World Wide Web. Several schemes have been developed for copyright protection of the web based digital contents distributed over the internet. However, these protocols are often needs more complex security actions to be performed by the web based content providers for preserving the integrity of their content. In this paper, we propose a new secure web-based watermarking scheme based on the combination of the security of the public key cryptosystem (PKI) and the watermarking based on threshold cryptography. The proposed watermarking protocol solve the collude problem for the trusted certificate authority (CA) and applies the idea of the zero knowledge proof for verification purposes. Implementation and analysis of the proposed scheme has been conducted.
Shakkeera L, Hem Pransanth K C, Sabareesh, Sumaiya Begum · 5 authors
In today’s era, the cloud database security is one of the main concerns for any of the real time data accessing web/mobile applications. The cloud database protection involves accessibility and vulnerability of data, data protection, storage space, integrity and confidentiality on sensitive data. Building an electronic voting system that tries to completely fulfill the needs of the people has always been a challenge to achieve. The existing E-Voting System (E-VS) is not that much compatible with that of the current trends and does not assure to provide more security A lot of distributed ledger technologies which has been an exciting approach during existing election voting process. If we take a look on the ways of implying E-VS in a distribute ledger then Blockchain would be the right choice. As we all know that nowadays, Blockchain is one of the emerging technologies in the field of Information Technology. It normally stores information in batches called blocks which are linked together in a chronological way or method to form chain of blocks using cryptography techniques. During online voting process, many fraudulent activities happens which corrupt the entire election process. One of the major problems faced are fake voting which is obviously done by unauthorized people, inconvenient to reach to the respective places, average security level which may lead to the chances of an electoral fraud or any other malpractices.. Our proposed E-Voting System is mainly to protect the cloud database for real time data and to reduce the time consumption in voting and vote counting processes. Instead of standing in the queue for casting the vote, people can cast their votes from anywhere they want through online. The E-VS gives complete privacy and security for the online voting and makes it an ease for every individual to access it and cast their votes from anywhere possible with full pronounced security. In our proposed E-VS, Blockchain security concept called Consensus algorithm is implemented which makes it impossible for any unwanted activities to occur during election process. The E-VS system also achieves a higher level of security. Hence, the proposed system achieves data integrity, data confidentiality, eliminates storage overhead, and reduces time consumption for overall electronic voting system.
Christopher Klinkmüller, Ingo Weber, Alexander Ponomarev, An Binh Tran · 5 authors
Second generation blockchain platforms, like Ethereum, can store arbitrary data and execute user-defined smart contracts. Due to the shared nature of blockchains, understanding the usage of blockchain-based applications and the underlying network is crucial. Although log analysis is a well-established means, data extraction from blockchain platforms can be highly inconvenient and slow, not least due to the absence of logging libraries. To close the gap, we here introduce the Ethereum Logging Framework (ELF) which is highly configurable and available as open source. ELF supports users (i) in generating cost-efficient logging code readily embeddable into smart contracts and (ii) in extracting log analysis data into common formats regardless of whether the code generation has been used during development. We provide an overview of and rationale for the framework's features, outline implementation details, and demonstrate ELF's versatility based on three case studies from the public Ethereum blockchain.
Abstract Port Knocking is a method for authenticating clients through a closed stance firewall, and authorising their requested actions, enabling severs to offer services to authenticated clients, without opening ports on the firewall. Advances in port knocking have resulted in an increase in complexity in design, preventing port knocking solutions from realising their potential. This paper proposes a novel port knocking solution, named Crucible, which is a secure method of authentication, with high usability and features of stealth, allowing servers and services to remain hidden and protected. Crucible is a stateless solution, only requiring the client memorise a command, the server’s IP and a chosen password. The solution is forwarded as a method for protecting servers against attacks ranging from port scans, to zero-day exploitation. To act as a random oracle for both client and server, cryptographic hashes were generated through chaotic systems.