Yi Zhong, Anmin Zhou, Lei Zhang, Jing Fan · 5 authors
As the root cause of illegal cyber activities, botnets are evolving continuously over the last two decades. Current researches on botnet command and control mechanism based on blockchain network suffer from high economic cost, single point of failure, and limited scalability. In this paper, we present DUSTBot, a novel P2P botnet model based on Bitcoin transactions to prepare for new cyber threats. Specifically, a covert, duplex, and low-cost command and control (C&C) channel in the Bitcoin network is presented in our work. DUSTBot uses the Bitcoin main network as the downstream channel while using the Bitcoin testnet as the upstream channel. Furthermore, the peer list exchange algorithm based on the Ethereum block hash proposed in this paper is effective against routing table poisoning attack and P2P botnet crawling. The robustness of DUSTBot against node removal is studied through constructing the botnet with a P2P simulator. We deploy the implementation of DUSTBot on cloud platforms to test its feasibility and performance. Moreover, the stealthiness of DUSTBot and the effectiveness of the proposed peer list exchange algorithm are evaluated. The results demonstrate the feasibility, performance, stealthiness, and robustness of DUSTBot. In the end, possible countermeasures are discussed to mitigate similar threats in the future.
J.R. James, Daniel Hawthorne, Katherine Duncan, Aaron St. Leger · 6 authors
Power grids around the world have experienced a growing number of malicious cyber attacks. This paper provides an overview of recent use of the Hyperledger Fabric distributed operating system to prototype use of a permissioned blockchain consensus algorithm to trust shared state estimation and control data and another effort to alter local sensor data to destroy the integrity of the shared data. The paper also provides justification for an experiment to prototype use of Babble, a peer-to-peer network plugin using the hashgraph consensus algorithm, to share the state estimation and control data through transactions recorded in a hashgraph. A key claim of the hashgraph documentation, which is unsubstantiated without a proper academic analysis, is that the algorithm is asynchronous Byzantine fault tolerance (ABFT). Also, while the Hyperledger Fabric implementation supports thousands of transactions per second, the hashgraph algorithm documentation claims orders of magnitude more. Our experiment seeks to measure the hashgraph transaction speed and determine its suitability for improving the resilience of wide area control of the smart grid. The previous resilience research of the Anomaly Detection of Cyber Physical Systems (ADCPS) team includes research into inadvertent cyber and physical failures as well as malicious attacks. We conclude with some speculations concerning the potential impact of fast, fair, and secure sharing of data across a network of blockchains potentially interfaced using hashgraph distributed ledger technology (DLT).
Γεώργιος Σπαθούλας, Nikos Giachoudis, Georgios-Paraskevas Damiris, Georgios Theodoridis
Internet of Things is one of the most significant latest developments in computer science. It is common for modern computing infrastructures to partially consist of numerous low power devices that are characterized by high diversity in both hardware and software. Existing security models, approaches and solutions are not able to sufficiently protect such systems. In this paper we propose the use of lightweight agents installed at multiple internet of things (IoT) installations (e.g., smart-homes), in order to collaboratively detect distributed denial of service (DDoS) attacks conducted by the use of IoT devices botnets. Specifically, agents exchange outbound traffic information in order to identify possible victims of DDoS attacks. This information exchange is governed by a blockchain smart contract, that ensures the integrity of both the procedure and the information. A simulation of the operation of the proposed methodology has been conducted in order to evaluate both its detection efficiency and its resilience against malicious agents that aim to falsify results.
Out-of-gas errors occur when smart contract programs are provided with inputs that cause excessive gas consumption and which will be easily exploited to perform Denial-of-Service attacks. Various approaches have been proposed to estimate the gas limit of a function in smart contracts to avoid such error. However, underestimation often occurs when the contract is complex In this work, we propose V-Gas, which automatically generates inputs that maximize the gas cost and reduce underestimation. V-Gas is designed based on static analysis and feedback-directed mutational fuzz testing. First, V-Gas builds the gas weighted control flow graph of functions in smart contracts. Then, V-Gas develops gas consumption guided selection and mutation strategies to generate the input that maximize the gas consumption. For evaluation, we implement V-Gas based on js-evm, a widely used Ethereum virtual machine written in Javascript, and conduct experiments on 736 real-world transactions recorded on Ethereum. A total of 44.02% of the transactions would have out-of-gas errors based on the estimation results given by solc, meaning that the recorded real gas consumption for those transactions is larger than the gas limit estimated by solc. In comparison, V-Gas could reduce the underestimation ratio to 13.86%. To evaluate the performance of feedback-directed engine in V-Gas, we implemented other directed fuzzing engines and compared their performance with that of V-Gas. The results showed that V-Gas generates the same or higher gas estimation value on 97.8% of the transactions with less time, usually within 5 minutes. Furthermore, V-Gas has exposed 25 previously unknown out-of-gas vulnerabilities in widely used smart contracts, 6 of which have been assigned unique CVE identifiers in the U.S. National Vulnerability Database.
Ramiro Daniel Camino, Christof Ferreira Torres, Mathis Baden, Radu State
Ethereum smart contracts have recently drawn a considerable amount of attention from the media, the financial industry and academia. With the increase in popularity, malicious users found new opportunities to profit by deceiving newcomers. Consequently, attackers started luring other attackers into contracts that seem to have exploitable flaws, but that actually contain a complex hidden trap that in the end benefits the contract creator. In the blockchain community, these contracts are known as honeypots. A recent study presented a tool called HONEYBADGER that uses symbolic execution to detect honeypots by analyzing contract bytecode. In this paper, we present a data science detection approach based foremost on the contract transaction behavior. We create a partition of all the possible cases of fund movements between the contract creator, the contract, the transaction sender and other participants. To this end, we add transaction aggregated features, such as the number of transactions and the corresponding mean value and other contract features, for example compilation information and source code length. We find that all aforementioned categories of features contain useful information for the detection of honeypots. Moreover, our approach allows us to detect new, previously undetected honeypots of already known techniques. We furthermore employ our method to test the detection of unknown honeypot techniques by sequentially removing one technique from the training set. We show that our method is capable of discovering the removed honeypot techniques. Finally, we discovered two new techniques that were previously not known.
Mohib Hirani, Malka N. Halgamuge, Pham Duong Thu Hang
This study investigates a range of data security models developed to achieve data security using blockchain technology for different industrial domains. Current industries utilize data-driven mechanisms for decision making with concern focussed on ensuring data security. Blockchain has the potential to secure data by integrating different information systems since data is decentralized, encrypted and validated by the whole network. This study includes an analysis of blockchain security models using data extracted from 30 peer-reviewed scientific publications over two years (2017-2019). This study analyzed three components of the publications, including the process involved in securing data, the stage of development for securing data and in which industry a model is best applied. Results of the research show that the majority of articles (51.11%) cited Blockchain as a key feature of data security for improvising the data sharing process in industries. This study also finds that the stage of implementation most commonly featured is the proposal stage with potential architectures yet to be implemented (30%). Finally, this study shows that models are applied in industrial domains such as enterprises using data analytics, finance, Internet of Things (IoT), healthcare, education, and cloud service providers. This study finds that security models are most often applied to industries and supply chain management models (28.13%). It is recommended that industry professionals conduct further research to customize the data security models in their own domain. This study gives clear guidelines to researchers of suitable frameworks, processes and consensus mechanism to utilize Blockchain in Industries for data security.
Virtual Currencies and cryptocurrency are a trending digital currency method which uses the Blockchain technology. Cryptocurrency is a digital method designed to exchange the asset between the users based on a powerful cryptography which ensures the transaction are safe and controllable. We have various legal areas identified while using the cryptocurrency, as being the virtual currency, the amount of assets used by the users increases rapidly. With the increase in the asset the security breaches are one of the key vulnerable areas to focus. Cryptocurrency mining malware or Cryptojacking remains a trending terminology which identifies the malicious software or malware developed to use the data from the smart phones and computers. The major threat of the Cryptojacking is cryptocurrency mining without user’s approval. This article implemented based on our CCEC Framework method published for Malware detection in SMS’s for the Smartphone users. The article explains about how the Malware detected using the CCEC Framework. Malwares created in various format so identifying the Malware takes time before which user assets remains vulnerable. So, the proposed method ensures we have a reduction in time by using various online data sources to identify the Cryptojacking malware.
Off-chain transaction networks can mitigate the scalability issues of today's trustless electronic cash systems such as Bitcoin. However, these peer-to-peer networks also introduce a new attack surface which is not well-understood today. This paper identifies and analyzes, a novel Denial-of-Service attack which is based on route hijacking, i.e., which exploits the way transactions are routed and executed along the created channels of the network. This attack is conceptually interesting as even a limited attacker that manipulates the topology through the creation of new channels can navigate tradeoffs related to the way it attacks the network. Furthermore, the attack also highlights a fundamental design tradeoff for the defender (who determines its own routes): to become less predictable and hence secure, a rational node has to pay higher fees to nodes that forward its payments. We find that the three most common implementations for payment channels in Bitcoin (lnd, C-lightning, Eclair) approach routing differently. We begin by surveying the current state of the Lightning network and explore the routes chosen by these implementations. We find that in the current network nearly 60\% of all routes pass through only five nodes, while 80\% go through only 10 nodes. Thus, a relatively small number of colluding nodes can deny service to a large fraction of the network. We then turn to study an external attacker who creates links to the network and draws more routes through its nodes by asking for lower fees. We find that just five new links are enough to draw the majority (65\% - 75\%) of the traffic regardless of the implementation being used. The cost of creating these links is very low. We discuss the differences between implementations and eventually derive our own suggested routing policy, which is based on a novel combination of existing approaches.
Ui-Jun Baek, Se-Hyun Ji, Jee- Tae Park, Min‐Seob Lee · 6 authors
Since the inception of Bitcoin, the first cryptocurrency to implement blockchain technology, the cryptocurrency market has experienced significant growth.However, this growth has also brought about numerous vulnerabilities and attacks that pose a threat to the Bitcoin ecosystem.These attacks are not only focused on the Bitcoin network itself but also extend to the services that utilize it.Recent surveys have indicated the need to analyze and identify Distributed Denial of Service (DDoS) attacks, considering the interconnectedness between network-level data and service-level DDoS attacks within the Bitcoin system.Typically, the Bitcoin network is considered resilient against DDoS attacks due to the decentralized nature of its ledger.Nevertheless, there are potential vulnerabilities that could be exploited, such as message spoofing using the Transmission Control Protocol (TCP).Additionally, DDoS attacks often target services associated with Bitcoin usage rather than directly impacting the network's performance or stealing currency.Although these service-level attacks may not have an immediate impact, they can ultimately undermine the value of Bitcoin, leading to depreciation.The majority of DDoS attacks on Bitcoin-related services occur on exchanges and mining pools.Our approach involves evaluating experimental outcomes based on proposed metrics to establish a correlation between network-level data and service-level DDoS attacks in the Bitcoin system.By doing so, we aim to detect and analyze these attacks, thereby identifying potential associations.Furthermore, we posit that the methodology employed in this study could be applicable to other blockchain systems, extending its usefulness beyond the Bitcoin network.
Driven by the increasing number of stationary and portable devices, Distributed Denial-of-Service (DDoS) attacks pose a major threat to Internet availability. While advantages of cooperative defenses have been widely recognized over traditional on-premise defenses, there is not a widespread deployment of such cooperative defenses. This work demonstrates the Blockchain Signaling System (BloSS), a modular, network-agnostic and cooperative DDoS defense system consisting of independent instances working together to mitigate attacks targeted at any member of this alliance.
Raja Majid Ali Ujjan, Zeeshan Pervez, Keshav Dahal
Due to the rapid increment of the cyber attacks, intrusion detection system (IDS) is shifting towards collaborative approaches. There is a huge demand for securing larger networking environments for providing a safeguard against threats. In order to optimize the feasible detection performance, Collaborative Intrusion Detection Networks (CIDN) approaches have been adopted in practical scenarios, which enables a group of IDS nodes to mutually share and exchange mandatory information with each other, for example, IDS-signatures, attacks alarms. However, CIDN networks are distributed in nature, such networks still face plenty of implementation problems, especially, insider intruder can easily dominate any of security node and leave the entire security system vulnerable. To achieve the trust-based communication between each of IDS node, the recent advancement in blockchain applications is considered as a good fit to create trust-based communication in CIDN networks. This work converges CIDN network and blockchain in SDN context. Firstly, we investigated existing related work and highlighted challenges and research gap towards blockchain in CIDN networks. Secondly, we utilised three collaborated Snort IDS to receive the latest signature update from Ryu and then to securely share such signatures updates to all other Snort nodes within test-bed. Our work is motivated to detect seven types of common attacks with collaborated signature-based IDS, which feasibly processes more packets to achieve satisfactory detection results. Overall the evaluation results show that with the adoption of blockchain protocols, the proposed CIDN network achieves 96% of TP rate detection rate for TCP, UDP and ICMP packets.
Aug 1, 2019·2019 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)
Software defined networking (SDN) is one of the most popular network technologies which provides an adaptive, agile and flexible network management and visibility. Although SDN architecture provides manifold benefits but on the same time its dependence on a logically centralized controller lead to the single point of failure. An attacker can easily capture the any forwarding device and restrict the availability of the controller using different prevalent attacks. Distributed denial of service (DDoS) is one of the most popular attack of this category which is quiet prevalent in SDN. Here, the aim of the attackers is to inject false script in the open flow tables through malicious switches which multiply exponentially. Therefore, in this paper, a blockchain as a service framework has been presented wherein BlockSDSec model is designed to provide security as a separate service for the SDN architecture. This work provides a mechanism to prevent the threats of DDoS at the switch level by embedding an security using blockchain onto the interaction channels of data and control planes. The load balancing at the controller level is achieved using a virtual controller. The proposed scheme is simulated using MiniNet Emulator to analyze the delay originating from usage of blockchain.
The industrial control systems are facing an increasing number of sophisticated cyber attacks that can have very dangerous consequences on humans and their environments. In order to deal with these issues, novel technologies and approaches should be adopted. In this paper, we focus on the security of commands in industrial IoT against forged commands and misrouting of commands. To this end, we propose a security architecture that integrates the Blockchain and the Software-defined network (SDN) technologies. The proposed security architecture is composed of: (a) an intrusion detection system, namely RSL-KNN, which combines the Random Subspace Learning (RSL) and K-Nearest Neighbor (KNN) to defend against the forged commands, which target the industrial control process, and (b) a Blockchain-based Integrity Checking System (BICS), which can prevent the misrouting attack, which tampers with the OpenFlow rules of the SDN-enabled industrial IoT systems. We test the proposed security solution on an Industrial Control System Cyber attack Dataset and on an experimental platform combining software-defined networking and blockchain technologies. The evaluation results demonstrate the effectiveness and efficiency of the proposed security solution.
In this paper, we propose a novel deep learning and blockchain-based energy framework for smart grids, entitled DeepCoin. The DeepCoin framework uses two schemes, a blockchain-based scheme and a deep learning-based scheme. The blockchain-based scheme consists of five phases: setup phase, agreement phase, creating a block phase and consensus-making phase, and view change phase. It incorporates a novel reliable peer-to-peer energy system that is based on the practical Byzantine fault tolerance algorithm and it achieves high throughput. In order to prevent smart grid attacks, the proposed framework makes the generation of blocks using short signatures and hash functions. The proposed deep learning-based scheme is an intrusion detection system (IDS), which employs recurrent neural networks for detecting network attacks and fraudulent transactions in the blockchain-based energy network. We study the performance of the proposed IDS on three different sources the CICIDS2017 dataset, a power system dataset, and a web robot (Bot)-Internet of Things (IoT) dataset.
Determining the trust of an individual Bitcoin wallet is a difficult problem. There are no ratings, that offer vendors or exchanges meaningful information about the level of the taint of Bitcoins they are receiving. Lack of such information places exchanges liable in an event when the received Bitcoins are stolen or ill-gotten. In this paper, we try to solve this problem by introducing a Bitcoin address taint score called TaintRank. It provides insight into a specific wallet by taking the addresses it interacted with throughout history into consideration. This ranking method provides such Bitcoin exchange companies insight with whom they are trading.
Gohar Sargsyan, Nicolas Castellon, Raymond Binnendijk, Peter Cozijnsen
With the recent advances of IoT (Internet of Things) new and more robust security frameworks are needed to detect and mitigate new forms of cyber-attacks, which exploit complex and heterogeneity IoT networks, as well as, the existence of many vulnerabilities in IoT devices. With the rise of block chain technologies service providers pay considerable attention to better understand and adopt blockchain technologies in order to have better secure and trusted systems for own organisations and their customers. The present paper introduces a high level guide for the senior officials and decision makers in the organisations and technology managers for blockchain security framework by design principle for trust and adoption in IoT environments. The paper discusses Cyber-Trust project's blockchain technology development as a representative case study for offered security framework. Security and privacy by design approach is introduced as an important consideration in setting up the framework.
This paper considers the use of novel technologies for mitigating attacks that aim at compromising intrusion detection systems (IDSs). Solutions based on collaborative intrusion detection networks (CIDNs) could increase the resilience against such attacks as they allow IDS nodes to gain knowledge from each other by sharing information. However, despite the vast research in this area, trust management issues still pose significant challenges and recent works investigate whether these could be addressed by relying on blockchain and related distributed ledger technologies. Towards that direction, the paper proposes the use of a trust-based blockchain in CIDNs, referred to as trust-chain, to protect the integrity of the information shared among the CIDN peers, enhance their accountability, and secure their collaboration by thwarting insider attacks. A consensus protocol is proposed for CIDNs, which is a combination of a proof-of-stake and proof-of-work protocols, to enable collaborative IDS nodes to maintain a reliable and tampered-resistant trust-chain.
Jordi Zayuelas i Munoz, José Suárez‐Varela, Pere Barlet‐Ros
In the last few years, cryptocurrency mining has become more and more important on the Internet activity and nowadays is even having a noticeable impact on the global economy. This has motivated the emergence of a new malicious activity called cryptojacking, which consists of compromising other machines connected to the Internet and leverage their resources to mine cryptocurrencies. In this context, it is of particular interest for network administrators to detect possible cryptocurrency miners using network resources without permission. Currently, it is possible to detect them using IP address lists from known mining pools, processing information from DNS traffic, or directly performing Deep Packet Inspection (DPI) over all the traffic. However, all these methods are still ineffective to detect miners using unknown mining servers or result too expensive to be deployed in real-world networks with large traffic volume. In this paper, we present a machine learning-based method able to detect cryptocurrency miners using NetFlow/IPFIX network measurements. Our method does not require to inspect the packets' payload; as a result, it achieves cost-efficient miner detection with similar accuracy than DPI-based techniques.
Ransomware represents a class of malicious applications that encrypts the files of infected system and demands from victims a payment in cryptocurrency in order to receive the decryption key. The mainstream adoption of cryptocurrencies increased the number of ransomware attack. The outbreaks had risen in complexity and received mass-media attention in 2017 when two destructive campaigns crippled companies and institutions around the world. These outbreaks continue at an accelerated pace even though efforts are made to improve the detection and mitigation of ransomware. The purpose of this research is to assess the efficiency of current malware analysis methods and technologies in the detection of ransomware. The experiments presented here were performed using antivirus engines and dynamic malware analysis against live obfuscated ransomware samples.
Networks (Autonomous Systems-AS) allocate or revoke IP prefixes with the intervention of official Internet resource number authorities, and select and advertise policy-compliant paths towards these prefixes using the inter-domain routing system and its primary enabler, the Border Gateway Protocol (BGP). Securing BGP has been a long-term objective of several research and industrial efforts during the last decades, that have culminated in the Resource Public Key Infrastructure (RPKI) for the cryptographic verification of prefix-to-AS assignments. However, there is still no widely adopted solution for securing IP prefixes and the (AS-)paths leading to them; approaches such as BGPsec have seen minuscule deployment. In this work, we design and implement a Blockchain-based system that (i) can be used to validate both of these resource types, (ii) can work passively and does not require any changes in the inter-domain routing system (BGP, RPKI), and (iii) can be combined with currently available systems for the detection and mitigation of routing attacks. We present early results and insights w.r.t. scalability.
Software Defined Networking (SDN) technology increases the evolution of Internet and network development. SDN, with its logical centralization of controllers and global network overview changes the network's characteristics, on term of flexibility, availability and programmability. However, this development increased the network communication security challenges. To enhance the SDN security, we propose the BCFR solution to avoid false flow rules injection in SDN data layer devices. In this solution, we use the blockchain technology to provide the controller authentication and the integrity of the traffic flow circulated between the controller and the other network elements. This work is implemented using OpenStack platform and Onos controller. The evaluation results show the effectiveness of our proposal.
Following the birth of cryptocurrencies back in 2008, internet investment platforms called exchanges were created to constellate these cryptocurrencies. Allowing investors to sell and buy assets equitable and agile over a single interface. Exchanges now have become popular and carry out over 99% of all daily transactions, totaling hundreds of millions of dollars. Despite that exchanges handling enormous quantities of money, the industry remains mostly unregulated.\n\nAs long as these exchanges remain unregulated, they are and will continue to be susceptible to price manipulation schemes since they are legal to perform by law. Over the years, exchanges have grown into an attractive field where scammers execute various frauds that aims to leech assets from ordinary investors. One particular scheme has risen in popularity over the years and often observed at exchanges, and that is pump-and-dump. This scheme has a history from all the way back in 1700 and is still active and troublesome for investors today.\n\nIn this thesis, we present Limelight, a system that seeks to detect pump-and-dump in real-time using deep learning. Throughout this thesis, we retrieved, prepared, labeled, and processed a dataset to train a model that identifies pump-and-dumps. With high accuracy, the model surpasses previously proposed models in the detection of pump-and-dumps.
Electronic transactions with cryptocurrency systems based on blockchain in our days have become very popular due to the good reputation of this technology. However, that good reputation cannot deny the serious anomalies and the risks that can cause these cryptocurrencies. In this work, we propose a new model for anomaly detection over bitcoin electronic transactions. We used in our proposal two machine learning algorithms, namely the One Class Support Vector Machines (OCSVM) algorithm to detect outliers and the K-Means algorithm in order to group the similar outliers with the same type of anomalies. We evaluated our work by generating detection results and we obtained high performance results on accuracy.