Modern day businesses are largely dependent on digital technologies. People prefer viewing the reviews before making any decisions. It applies to all consumables like buying Electronic items, Clothing, Travel, Guest-House, Restaurant, Rental, Housing, Automobile, Cosmetics, Jewellery, Movies, etc. Online services like Mantra, Yelp, Amazon, Facebook, Google My Business, Trip Advisor offer great services to the customer. However, drawbacks of these systems are fake reviews, negative reviews and sometimes even tampering of the reviews given by the customers, which has a huge impact on the business leading to huge financial losses. Sometimes a competitor in the business might also influence the ratings being provided. The centralized storage of these reviews also leads to problems like tampering or manipulation of the data being stored. In this paper we propose an application in the restaurant industry that solves all these drawbacks by making use of the Ethereum blockchain. The food reviews given by the customers are stored as smart contracts in the blockchain, which can't be altered, thus guaranteeing the authenticity of the reviews. Validity of the reviews is ensured because it is difficult for the restaurants to delete or create new accounts to wipe away the bad reviews given. Blockchain is immutable so we ensure that the reviews are genuine and the system is trustable.
Bandwidth depletion Denial-of-Service (DoS) attack can impact the propagation of a mined block in the Bitcoin blockchain network. On Bitcoin Proof-of-Work (PoW) consensus several machines try to resolve an expensive cryptographic puzzle faster than anyone else and succeed to mine a valid block. Despite a DoS attack impedes one machine to propagate its mined block allowing it to become valid for most peers, there will be several other peers to resolve the puzzle in time, hence the blockchain will continue to grow. However, from the perspective of the owner of the attacked machine, this can be critical because it will not receive a mining reward. This chapter covers such an attack in the Lisk blockchain that utilizes the Delegated Proof of Stake (DPoS) consensus mechanism. A mitigation strategy was created based on two tools that I have created allowing a delegate account to be configured in more than one node, allowing to forge a block even when one of its nodes is under DoS attack. Also, the transaction flood DoS attack is explored, and a mitigation strategy was created for a specific sidechain in the Lisk ecosystem. The mitigation strategy identifies spam transactions and rejects them to be included on the Lisk nodes transaction pool, hence they will not be propagated into the blockchain. Towards the end, I evaluated scenarios and mitigation strategies created for each attack demonstrating solutions for several scenarios.
Xi He, Ketai He, Shenwen Lin, Jinglin Yang · 5 authors
Abstract Single heuristic method and incomplete heuristic conditions were difficult to cluster a large number of addresses comprehensively and accurately. Therefore, this paper analysed the associations between Bitcoin transactions and addresses and used six heuristic conditions to cluster addresses and entities. We proposed an improved change address detection algorithm and compared it with the original change address algorithm to prove the effectiveness of the improved algorithm. By adding conditional constraints, the identified change address was more accurate, and the convergence speed of the algorithm was accelerated. Our work presented the pseudo‐anonymity mechanism of the Bitcoin system, which could be used by the law enforcement agencies to track and crack down illegal transactions.
Blockchain like Bitcoin and Ethereum suffer from scalability issues. Sharding is one of the most promising and leading solutions to scale blockchain. The basic idea behind sharding is to divide the blockchain network into multiple committees, where each processing a separate set of transactions, rather than the entire network processes all transactions. In this paper, we propose a probabilistic approach to analyze the security of sharding-based blockchain protocols. Based on this approach, we investigate the threat of Sybil attacks in these protocols. The key contribution of our paper is a tractable probabilistic approach to accurately compute the failure probability that at least one committee fails and ultimately compute the probability of a successful attack. To show the effectiveness of our approach, we conduct a numerical and comparative analysis of the proposed approach with existing approaches.
Blockchain like Bitcoin and Ethereum suffer from scalability issues. Sharding\nis one of the most promising and leading solutions to scale blockchain. The\nbasic idea behind sharding is to divide the blockchain network into multiple\ncommittees, where each processing a separate set of transactions, rather than\nthe entire network processes all transactions. In this paper, we propose a\nprobabilistic approach to analyze the security of sharding-based blockchain\nprotocols. Based on this approach, we investigate the threat of Sybil attacks\nin these protocols. The key contribution of our paper is a tractable\nprobabilistic approach to accurately compute the failure probability that at\nleast one committee fails and ultimately compute the probability of a\nsuccessful attack. To show the effectiveness of our approach, we conduct a\nnumerical and comparative analysis of the proposed approach with existing\napproaches.\n
Lampis Alevizos, Vinh‐Thong Ta, Mahmoud Hashem Eiza
Abstract With the purpose of defending against lateral movement in today's borderless networks, zero trust architecture (ZTA) adoption is gaining momentum. With a full‐scale ZTA implementation, it is unlikely that adversaries will be able to spread through the network starting from a compromised endpoint. However, the already authenticated and authorized session of a compromised endpoint can be leveraged to carry out limited, though malicious, activities ultimately rendering the endpoints the Achilles heel of ZTA. To effectively detect such attacks, distributed collaborative intrusion detection systems with an attack scenario‐based approach have been developed. Nonetheless, advanced persistent threats have demonstrated their ability to bypass this approach with a high success ratio. As a result, adversaries can pass undetected or potentially alter the detection logging mechanisms to achieve a stealthy presence. Recently, blockchain technology has demonstrated solid use cases in the cyber security domain. In this paper, motivated by the convergence of ZTA and blockchain‐based intrusion detection and prevention, we examine how ZTA can be augmented onto endpoints. Namely, we perform a state‐of‐the‐art review of ZTA models, real‐world architectures with a focus on endpoints, and blockchain‐based intrusion detection systems. We discuss the potential of blockchain's immutability fortifying the detection process and identify open challenges as well as potential solutions and future directions.
Rahul Pitale, Kapil Tajane, S. S. Khandagale, Vidhya Gadewar · 6 authors
The increase in fake goods is severely affecting the industrial sector and consumers. According to the survey, incidences involving fake products have increased in recent years, which have had a negative impact on sales, profits, and brand recognition. Far from reducing the ability of a company to make money, this counterfeiting also affects the consumer's ability to trust their goods in open market. Without proper tracking and security measures, consumers gradually stop trusting brands to keep their consumers safe from theft. This is happening because the manufacturing and distribution processes are hidden to consumers and this information is easily manipulated or falsified by others. So, users must have a method to determine if a product is genuine or not. This study proposes a blockchain based anti-counterfeiting system for product traceability throughout the supply chain. By using public or permissionless blockchain all the information throughout the supply chain will be recorded in the blockchain network in the form of blocks that are immutable, transparent, secure, tamper-proof, and trusted. This proposed method uses QR code for making the system further secure.
Bin Wang, Han Liu, Chao Liu, Zhiqiang Yang · 7 authors
Decentralized finance, i.e., DeFi, has become the most popular type of application on many public blockchains (e.g., Ethereum) in recent years. Compared to the traditional finance, DeFi allows customers to flexibly participate in diverse blockchain financial services (e.g., lending, borrowing, collateralizing, exchanging etc.) via smart contracts at a relatively low cost of trust. However, the open nature of DeFi inevitably introduces a large attack surface, which is a severe threat to the security of participants funds. In this paper, we proposed BLOCKEYE, a real-time attack detection system for DeFi projects on the Ethereum blockchain. Key capabilities provided by BLOCKEYE are twofold: (1) Potentially vulnerable DeFi projects are identified based on an automatic security analysis process, which performs symbolic reasoning on the data flow of important service states, e.g., asset price, and checks whether they can be externally manipulated. (2) Then, a transaction monitor is installed offchain for a vulnerable DeFi project. Transactions sent not only to that project but other associated projects as well are collected for further security analysis. A potential attack is flagged if a violation is detected on a critical invariant configured in BLOCKEYE, e.g., Benefit is achieved within a very short time and way much bigger than the cost. We applied BLOCKEYE in several popular DeFi projects and managed to discover potential security attacks that are unreported before. A video of BLOCKEYE is available at https://youtu.be/7DjsWBLdlQU.
In this work we propose Dynamit, a monitoring framework to detect reentrancy vulnerabilities in Ethereum smart contracts. The novelty of our framework is that it relies only on transaction metadata and balance data from the blockchain system; our approach requires no domain knowledge, code instrumentation, or special execution environment. Dynamit extracts features from transaction data and uses a machine learning model to classify transactions as benign or harmful. Therefore, not only can we find the contracts that are vulnerable to reentrancy attacks, but we also get an execution trace that reproduces the attack. Using a random forest classifier, our model achieved more than 90 percent accuracy on 105 transactions, showing the potential of our technique.
Andrea Lisi, Andrea De Salve, Paolo Mori, Laura Ricci · 5 authors
Recommender Systems (RSs) are becoming increasingly popular in the last years. They collect reviews concerning several types of items (e.g., shops, professionals, services, songs or videos) in order to rank them according to a given criterion, and to suggest the most relevant ones to their users. However, most of the currently used RSs exhibit two main drawbacks: they are based on a centralized control model and they do not provide reward mechanisms to encourage the participation of users. To deal with these challenges, the architectures of current RSs could be enhanced through blockchain technology, thus providing novel solutions to decentralize them. As a matter of fact, the blockchain technology could be successfully adopted in this context because smart contracts would allow the decentralization of system control, while cryptocurrency and tokens could be used to implement the reward mechanism. In the light of the above considerations, this manuscript presents a decentralized rating framework aimed to support the users of RSs based on blockchain technology, providing a token-based reward mechanism that remunerates users submitting their reviews to incentivize their participation. Moreover, the proposed system provides a flexible strategy to rank items, allowing users to choose among different functions to combine reviews to obtain item ranking. The performance and the cost of using the proposed system have been evaluated on the Ropsten Ethereum test network. For instance, our experiments have shown that the median time required to store a batch of 35 ratings is about 47 s, while the average time required to obtain the score of an item having 6000 ratings is less than 2.5 s.
Dataset retrieved with an Ethereum client, and used by the code hosted here for this paper published in the Proceedings of the Web Conference 2021 (WWW ’21) Abstract: Cryptoassets such as cryptocurrencies and tokens are increasingly traded on decentralized exchanges. The advantage for users is that the funds are not in custody of a centralized external entity. However, these exchanges are prone to manipulative behavior. In this paper, we illustrate how wash trading activity can be identified on two of the first popular limit order book-based decentralized exchanges on the Ethereum blockchain, IDEX and EtherDelta. We identify a lower bound of accounts and trading structures that meet the legal definitions of wash trading, discovering that they are responsible for a wash trading volume in equivalent of 159 million U.S. Dollars. While self-trades and two-account structures are predominant, complex forms also occur. We quantify these activities, finding that on both exchanges, more than 30% of all traded tokens have been subject to wash trading activity. On EtherDelta, 10% of the tokens have almost exclusively been wash traded. All data is made available for future research. Our findings underpin the need for countermeasures that are applicable in decentralized systems.
Bilgisayar ve internet teknolojilerindeki gelişmeler, hayatımızın her alanında etkisini gösterdiği gibi ekonomi boyutunda da etkileri yadsınamaz. Ekonomi alanındaki yeni ekonomik reform mahiyetinde kabul gören bu yenilikler FinTek (Finans ve Teknoloji) kapsamı içerisinde yer almaktadır. FinTech inovasyonu ile ekonomide ademi merkeziyetçi bir akım başlatan Bitcoin, şu an dünya ekonomisinde önemli bir yere sahiptir. Bitcoin ile hayatımıza giren Blockchain (Blokzincir) teknolojisinin ise yakın gelecekte hayatımızın vazgeçilmez bir parçası haline geleceği öngörülmektedir. Tüm bu gelişmeler ışığında günümüzün popüler teknolojilerinden olan yapay zeka yöntemlerinden yararlanılarak, kitle haberleşme aracı olarak tanımlanan gazetelerde yer alan, insan ve toplumu ilgilendiren ve toplumun en önemli ihtiyaçlarından olan haberlerin, geleceğin para birimi olarak görülen Bitcoin üzerindeki etkileri ortaya konmak istenmiştir. Bu bağlamda 5 ulusal finans gazetesi belirlenip, Bitcoin’in ilk halka arz yılından itibaren yayınlanan haberleri olumlu ve olumsuz yorum içeriklerine göre sayısallaştırarak, Bitcoin altyapı teknolojisi olan blokzinciri verileri ile ikinci en popüler kripto para olan Ethereum’un ABD dolar karşılığı alınarak, yapay sinir ağları teknikleri ile oluşturulan ağ içerisinde ilişkilendirilmiştir. Çalışma sonucunda %99’luk tahminsel başarı içeren yapay sinir ağında, finansal gazetelerin yayınlamış olduğu Bitcoin içerikli haberlerin, Bitcoin fiyat tahminine güçlü bir etkisinin olmadığı sonucuna varılmıştır. Bunulan birlikte seçilen finansal gazetelerden The Wall Street gazetesinin diğer finansal gazetelere oranla Bitcoin fiyat tahminde nispeten etkisinin olduğu saptanmıştır.
Rachit Agarwal, Tanmay Thapliyal, Sandeep K. Shukla
Different types of malicious activities have been flagged in multiple\npermissionless blockchains such as bitcoin, Ethereum etc. While some malicious\nactivities exploit vulnerabilities in the infrastructure of the blockchain,\nsome target its users through social engineering techniques. To address these\nproblems, we aim at automatically flagging blockchain accounts that originate\nsuch malicious exploitation of accounts of other participants. To that end, we\nidentify a robust supervised machine learning (ML) algorithm that is resistant\nto any bias induced by an over representation of certain malicious activity in\nthe available dataset, as well as is robust against adversarial attacks. We\nfind that most of the malicious activities reported thus far, for example, in\nEthereum blockchain ecosystem, behaves statistically similar. Further, the\npreviously used ML algorithms for identifying malicious accounts show bias\ntowards a particular malicious activity which is over-represented. In the\nsequel, we identify that Neural Networks (NN) holds up the best in the face of\nsuch bias inducing dataset at the same time being robust against certain\nadversarial attacks.\n
Christof Ferreira Torres, Antonio Ken Iannillo, Arthur Gervais, Radu State
In recent years, Ethereum gained tremendously in popularity, growing from a\ndaily transaction average of 10K in January 2016 to an average of 500K in\nJanuary 2020. Similarly, smart contracts began to carry more value, making them\nappealing targets for attackers. As a result, they started to become victims of\nattacks, costing millions of dollars. In response to these attacks, both\nacademia and industry proposed a plethora of tools to scan smart contracts for\nvulnerabilities before deploying them on the blockchain. However, most of these\ntools solely focus on detecting vulnerabilities and not attacks, let alone\nquantifying or tracing the number of stolen assets. In this paper, we present\nHorus, a framework that empowers the automated detection and investigation of\nsmart contract attacks based on logic-driven and graph-driven analysis of\ntransactions. Horus provides quick means to quantify and trace the flow of\nstolen assets across the Ethereum blockchain. We perform a large-scale analysis\nof all the smart contracts deployed on Ethereum until May 2020. We identified\n1,888 attacked smart contracts and 8,095 adversarial transactions in the wild.\nOur investigation shows that the number of attacks did not necessarily decrease\nover the past few years, but for some vulnerabilities remained constant.\nFinally, we also demonstrate the practicality of our framework via an in-depth\nanalysis on the recent Uniswap and Lendf.me attacks.\n
The rapid development of blockchain technology has provided new ideas for network security research. Blockchain-based network security enhancement solutions are attracting widespread attention. This paper proposes an Internet... | Find, read and cite all the research you need on Tech Science Press
The introduction of a review system in e-commerce platforms results in an effective business model. The effects of positive/negative reviews on the success of a product are well studied in the literature. Therefore, for the vendors, it is crucial to obtain positive reviews of their products. This fact opens fraudulent scenarios. Indeed, some vendors can pay an incentive to the buyers to obtain, in exchange, a fake positive review. This fake-review system (FRS) is so widespread that vendors rely on ad-hoc companies that, through intermediaries, find buyers available to release fake reviews. In this paper, we propose a game-theory-based strategy to discourage the above fraudulent business model, and an effective way to implement this strategy leveraging an Ethereum smart contract. Specifically, the contribution of the paper is two-fold. First, we formalize the current business model as a sequential game, and we identify sufficient conditions making FRS advantageous. Second, we propose to introduce in the review system a new mechanism, thanks to which, the corresponding sequential game requires conditions necessary to make advantageous FRS that are strictly less convenient than the previous ones. We implemented the solution and evaluate the cost of the smart contract execution.
Sending bulk e-mail is commercially cheap and technically easy, making it profitable for spammers, even if a tiny percentage of recipients falls for the attacks or turn into customers. Some researchers have proposed making e-mail paid so that sending bulk e-mail becomes expensive, making spamming unprofitable and a futile exercise unless many victims respond to spam. On the other hand, the small sending fee is negligible for legitimate e-mail users. Making e-mail paid is a challenging task if implemented using a conventional payment system or developing new cryptocurrencies. Traditional payment systems are challenging to integrate with e-mail systems, and new cryptocurrencies will have challenges in adoption by users on the required scale. This work proposes using cryptocurrency payments to make e-mail senders pay for sending an e-mail without creating a new cryptocurrency or a new blockchain. In the proposed system, the recipients of the e-mail can collect the payments and use the collected revenues to send e-mail messages or even sell them on an exchange. The proposed solution has been implemented using Ropsten, an Ethereum Test Network and tested using enhanced E-mail Client and Server software.
Blockchain is really trendy these days. A distributed ledger on a peer-to-peer network that is completely open to everyone was the block chain. It is composed of blocks that include hash values and data. Before a new transaction can be added to the block chain, researchers must validate it; this process is called mining. Mining is expensive and requires a lot of processing power. Since the block chain is a peer-to-peer network, the data is maintained in every node. The block chain network has increased to 190GB thanks to the increasing number of transactions that are processed through it. It is a problem because a cheap laptop can only hold so much data. This study developed a revolutionary, less expensive system than the block chain method. We choose web applications as our use case since they are increasingly overtaking all other methods of accessing internet services in popularity. The immutability, data security, and data dissemination features of the block chain were all taken into account. The Merle tree concept provides immutability, hashing was used to achieve security, and an open source data distribution tool is used to spread the data. This paper provides innovative methods for preventing malicious data upload using MIME, cross-site programming, and cross-site request manipulation.
Social media network is one of the important parts of human life based on the recent technologies and developments in terms of computer science area. This environment has become a famous platform for sharing information and news on any topics and daily reports, which is the main era for collecting data and data transmission. There are various advantages of this environment, but in another point of view there are lots of fake news and information that mislead the reader and user for the information needed. Lack of trust-able information and real news of social media information is one of the huge problems of this system. To overcome this problem, we have proposed an integrated system for various aspects of blockchain and natural language processing (NLP) to apply machine learning techniques to detect fake news and better predict fake user accounts and posts. The Reinforcement Learning technique is applied for this process. To improve this platform in terms of security, the decentralized blockchain framework applied, which provides the outline of digital contents authority proof. More specifically, the concept of this system is developing a secure platform to predict and identify fake news in social media networks.
With the popularity of blockchain technology, the financial security issues of blockchain transaction networks have become increasingly serious. Phishing scam detection methods will protect possible victims and build a healthier blockchain ecosystem. Usually, the existing works define phishing scam detection as a node classification task by learning the potential features of users through graph embedding methods such as random walk or graph neural network (GNN). However, these detection methods are suffered from high complexity due to the large scale of the blockchain transaction network, ignoring temporal information of the transaction. Addressing this problem, we defined the transaction pattern graphs for users and transformed the phishing scam detection into a graph classification task. To extract richer information from the input graph, we proposed a multi-channel graph classification model (MCGC) with multiple feature extraction channels for GNN. The transaction pattern graphs and MCGC are more able to detect potential phishing scammers by extracting the transaction pattern features of the target users. Extensive experiments on seven benchmark and Ethereum datasets demonstrate that the proposed MCGC can not only achieve state-of-the-art performance in the graph classification task but also achieve effective phishing scam detection based on the target users' transaction pattern graphs.
The developers of Ethereum smart contracts often implement administrating patterns, such as censoring certain users, creating or destroying balances on demand, destroying smart contracts, or injecting arbitrary code. These routines turn an ERC20 token into an administrated token - the type of Ethereum smart contract that we scrutinize in this research. We discover that many smart contracts are administrated, and the owners of these tokens carry lesser social and legal responsibilities compared to the traditional centralized actors that those tokens intend to disrupt. This entails two major problems: a) the owners of the tokens have the ability to quickly steal all the funds and disappear from the market; and b) if the private key of the owner's account is stolen, all the assets might immediately turn into the property of the attacker. We develop a pattern recognition framework based on 9 syntactic features characterizing administrated ERC20 tokens, which we use to analyze existing smart contracts deployed on Ethereum Mainnet. Our analysis of 84,062 unique Ethereum smart contracts reveals that nearly 58% of them are administrated ERC20 tokens, which accounts for almost 90% of all ERC20 tokens deployed on Ethereum. To protect users from the frivolousness of unregulated token owners without depriving the ability of these owners to properly manage their tokens, we introduce SafelyAdministrated - a library that enforces a responsible ownership and management of ERC20 tokens. The library introduces three mechanisms: deferred maintenance, board of trustees and safe pause. We implement and test SafelyAdministrated in the form of Solidity abstract contract, which is ready to be used by the next generation of safely administrated ERC20 tokens.