Νικόλαος Αλεξόπουλος, Emmanouil Vasilomanolakis, Stéphane Le Roux, Steven Rowe · 5 authors
Sophisticated mass attacks, especially when exploiting zero-day vulnerabilities, have the potential to cause destructive damage to organizations and critical infrastructure. To timely detect and contain such attacks, collaboration among the defenders is critical. By correlating real-time detection information (alerts) from multiple sources (collaborative intrusion detection), defenders can detect attacks and take the appropriate defensive measures in time. However, although the technical tools to facilitate collaboration exist, real-world adoption of such collaborative security mechanisms is still underwhelming. This is largely due to a lack of trust and participation incentives for companies and organizations. This paper proposes TRIDEnT, a novel collaborative platform that aims to enable and incentivize parties to exchange network alert data, thus increasing their overall detection capabilities. TRIDEnT allows parties that may be in a competitive relationship, to selectively advertise, sell and acquire security alerts in the form of (near) real-time peer-to-peer streams. To validate the basic principles behind TRIDEnT, we present an intuitive game-theoretic model of alert sharing, that is of independent interest, and show that collaboration is bound to take place infinitely often. Furthermore, to demonstrate the feasibility of our approach, we instantiate our design in a decentralized manner using Ethereum smart contracts and provide a fully functional prototype.
Christian Killer, Bruno Rodrigues, Burkhard Stiller
A cooperative network defense is one approach to fend off large-scale Distributed Denial-of-Service (DDoS) attacks. In this regard, the Blockchain Signaling System (BloSS) is a multi-domain, blockchain-based, cooperative DDoS defense system, where each Autonomous System (AS) is taking part in the defense alliance. Each AS can exchange attack information about ongoing attacks via the Ethereum blockchain. However, the currently operational implementation of BloSS is not interactive or visualized, but the DDoS mitigation is automated. In realworld defense systems, a human cybersecurity analyst decides whether a DDoS threat should be mitigated or not. Thus, this work presents the design of a security management dashboard for BloSS, designed for interactive use by cyber security analysts.
Bruno Rodrigues, Lukas Eisenring, Eder J. Scheid, Thomas Bocek · 5 authors
The volume of traffic generated by modern Distributed Denial-of-Service (DDoS) attacks suggests that centralized defenses are not the most effective approach to counter these attacks. An alternative to reduce the burden of detection and mitigation is to combine centralized defense systems, creating a global and cooperative protection system. However, existing approaches suffer from the complexity of deployment and operation across different systems. Blockchains appear in this scenario as an alternative to simplify the exchange of information in a cooperative defense. This work evaluates in both local and global experimentations the performance of the blockchain system proposed in [8] concerning the latency to perform the signaling of blacklisted addresses.
We performed the first systematic study of a new attack on Ethereum that steals cryptocurrencies. The attack is due to the unprotected JSON-RPC endpoints existed in Ethereum nodes that could be exploited by attackers to transfer the Ether and ERC20 tokens to attackers-controlled accounts. This study aims to shed light on the attack, including malicious behaviors and profits of attackers. Specifically, we first designed and implemented a honeypot that could capture real attacks in the wild. We then deployed the honeypot and reported results of the collected data in a period of six months. In total, our system captured more than 308 million requests from 1,072 distinct IP addresses. We further grouped attackers into 36 groups with 59 distinct Ethereum accounts. Among them, attackers of 34 groups were stealing the Ether, while other 2 groups were targeting ERC20 tokens. The further behavior analysis showed that attackers were following a three-steps pattern to steal the Ether. Moreover, we observed an interesting type of transaction called zero gas transaction, which has been leveraged by attackers to steal ERC20 tokens. At last, we estimated the overall profits of attackers. To engage the whole community, the dataset of captured attacks is released on https://github.com/zjuicsr/eth-honey.
Bitcoin is a decentralized digital currency introduced in 2008 and launched in 2009. Bitcoin provides a way to transact without any trusted intermediary, but its privacy guarantees are questionable, and multiple deanonymization attacks have been proposed. Cryptocurrency privacy research has been mostly focused on blockchain analysis, i.e., extracting information from the transaction graph. We focus on another vector for privacy attacks: network analysis. We describe the message propagation mechanics in Bitcoin and propose a novel technique for transaction clustering based on network traffic analysis. We show that timings of transaction messages leak information about their origin, which can be exploited by a well connected adversarial node. We implement and evaluate our method in the Bitcoin testnet with a high level of accuracy, deanonymizing our own transactions issued from a desktop wallet (Bitcoin Core) and from a mobile (Mycelium) wallet. Compared to existing approaches, we leverage the propagation information from multiple peers, which allows us to overcome an anti-deanonymization technique (“diffusion”) used in Bitcoin.
Software Defined Networking (SDN) is being extensively adopted by researchers and enterprise networks due to its feature of decoupling data and control planes from network device which enables them to implement new networking ideas. Communication between data and control planes faces various security issues where many users in data plane approach controller device in control plane to gain networking policies. In this paper, we proposed an efficient Zero-knowledge proof based identification scheme for securing SDN controller during data and control plane communication. This scheme ensures that only users who prove their knowledge about secrecy without revealing actual secret or any other information about it can communicate with controller. The computation cost was calculated to validate efficiency of the proposed work and compared with scheme that works in the basis of Kerberos authentication protocol.
The Ethereum block chain as a decentralized platform is so successful that many applications deployed on it. However, for the inherent transparency properties and the lack of privacy, deploying a financial application on top of it is always a challenge. In this paper, we tackle this challenge and propose an anonymous sealed-bid auction protocol based on time-released encryption atop Consortium Block chain. We adopt a strict digital certificate-based identity mechanism of the consortium block chain to permit legitimate participants, and utilize the blind signature based on elliptic curve technology to allowing anonymous participation. Moreover, a timed release public key encryption algorithm is adopted to encrypt bids and prevent auctioneer from colluding with bidders. This is completely different from the method (zero-knowledge proof) used in other papers to prevent collusion between auctioneer and bidder. We provide a specific analysis of our protocol, which shows that our protocol meets anonymity and applicability.
Radhesh Krishnan Konoth, Rolf van Wegberg, Veelasha Moonsamy, Herbert Bos
In this study, we examine the behavior and profitability of modern malware that mines cryptocurrency. Unlike previous studies, we look at the cryptocurrency market as a whole, rather than just Bitcoin. We not only consider PCs, but also mobile phones, and IoT devices. In the past few years, criminals have attacked all these platforms for the purpose of cryptocurrency mining. The question is: how much money do they make? It is common knowledge that mining Bitcoin is now very difficult, so why do the criminals even target low-end devices for mining purposes? By analyzing the most important families of malicious cryptocurrency miners that were active between 2014 and 2017, we are able to report how they work, which currency they mine, and how profitable it is to do so. We will see that the evolution of the cryptocurrency market with many new cryptocurrencies that are still CPU minable and offer better privacy to criminals and have contributed to making mining malware attractive again -- with attackers generating a continuous stream of profit that in some cases may reach in the millions.
Hany F. Atlam, Robert John Walters, Gary Wills, Joshua Daniel
Abstract The Internet of Things (IoT) is becoming the future of the Internet with a large number of connected devices that are predicted to reach about 50 billion by 2020. With proliferation of IoT devices and need to increase information sharing in IoT applications, risk-based access control model has become the best candidate for both academic and commercial organizations to address access control issues. This model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. This model solves challenges related to flexibility and scalability of the IoT system. Therefore, we propose an adaptive risk-based access control model for the IoT. This model uses real-time contextual information associated with the requesting user to calculate the security risk regarding each access request. It uses user attributes while making the access request, action severity, resource sensitivity and user risk history as inputs to analyze and calculate the risk value to determine the access decision. To detect abnormal and malicious actions, smart contracts are used to track and monitor user activities during the access session to detect and prevent potential security violations. In addition, as the risk estimation process is the essential stage to build a risk-based model, this paper provides a discussion of common risk estimation methods and then proposes the fuzzy inference system with expert judgment as to be the optimal approach to handle risk estimation process of the proposed risk-based model in the IoT system.
Elie Kfoury, Jose Gomez, Jorge Crichigno, Elias Bou‐Harb · 5 authors
Network Address Translation (NAT) is a method that enables devices with private IP addresses to connect to the Internet by sharing a public IP address. Traversing the NAT device remains a challenge for a wide range of applications such as Voice over IP (VoIP) and Internet of Things (IoT). The Port Control Protocol (PCP) is a relatively new protocol standardized by the Internet Engineering Task Force (IETF) to solve the NAT traversal issues. It allows a NATed device to request and manage a mapping between its private IP address and transport-layer port to a public IP address and port. As PCP requires an application-dependent method for distributing the mappings to remote hosts, several attacks can target the distributing server and render the communication channel vulnerable. In this paper, we propose and implement a decentralized Blockchain-based approach for distributing PCP-mappings, enabling secure end-to-end (e2e) direct communications without any trusted third party server. NATed devices register their PCP mappings and public keys into the Blockchain, and other peers can then learn about these mappings to establish end-to-end secure direct communications. The implementation verifies that the system is feasible in terms of transactions fees, can simplify and secure end-to-end direct communications, and can interwork with conventional security methods.
Leyi Shi, Yang Li, Tianxu Liu, Jia Liu · 6 authors
Honeypot technology can be applied to efficiently attract attackers and exhaust their resources. However, the traditional static honeypot is easy to be recognized by anti-honeypot technology. By contrast, most of the dynamic honeypots can simulate the real system in time, thus interacting with an intruder in disguise. In this paper, we employ the dynamic property of honeypot in four kinds of services of our system. However, this dynamic property shows up in a location and identification, indicating that genuine or fake services (honeypots) are changeable in different hosts. Thus, the dynamic property of our system differs from the dynamic honeypot aforementioned. Besides, we adopt the blockchain platform (Ethereum) to decentralize our system and store the port access data by delivering a private chain. To illustrate the effectiveness of our scheme in theory and practice, security analysis, eavesdropping attack, scanning attack, and DoS attack experiments are conducted. The results show that our scheme is valid in safeguarding against network attack.
Johannes Beck, Roberta Huang, David Lindner, Tian Guo · 7 authors
The ability to track and monitor relevant and important news in real-time is of crucial interest in multiple industrial sectors. In this work, we focus on the set of cryptocurrency news, which recently became of emerging interest to the general and financial audience. In order to track relevant news in real-time, we (i) match news from the web with tweets from social media, (ii) track their intraday tweet activity and (iii) explore different machine learning models for predicting the number of the article mentions on Twitter within the first 24 hours after its publication. We compare several machine learning models, such as linear extrapolation, linear and random forest autoregressive models, and a sequence-to-sequence neural network. We find that the random forest autoregressive model behaves comparably to more complex models in the majority of tasks.
Rewriting-history attacks can erase all valid records of blockchain-based systems, which is extremely devastating. To deter such attacks, we design a new smart contract-based secure model to make such attacks ineffective. Each node who creates a new block is required to register with the smart contract to get a voucher required for the subsequent block validation. We introduce the design idea and the structure of the proposed model in detail. We also present the algorithms of the smart contract and analyze the security performance of the proposed model in different cases. To prove the feasibility of the proposed model, we use the Solidity language to implement the smart contract in this model and simulate it on the Ethereum test network. We also show simulation results in terms of runtime and resource consumption.
Block-chain world is very dynamic and there is need for strong governance and underlying technology architecture to be robust to face challenges. This paper considers Ethereum, a leading block chain. We deep dive into the nature of this block chain, wherein for software upgrades forks are performed. They types of forks and impact is discussed. A specific Ethereum hack led to a hard fork and focus is provided on understanding the hack and overcoming it from a novel approach. The current model has been unable to handle multiple Ethereum attacks. Thus the current approach is compared against a novel approach providing a security and scaling solution. Here the architecture draws upon combining block-chain layers into operating system level. The approach can have tremendous benefits to block chain world and improve the way decentralized application teams perform. The benefits of the novel architecture is discussed. The approach helps safe guard block chain projects, making them safer and chain agnostic.
Data is the input for various artificial intelligence (AI) algorithms to mine valuable features, yet data in Internet is scattered everywhere and controlled by different stakeholders who cannot believe in each other, and usage of the data in complex cyberspace is difficult to authorize or to validate. As a result, it is very difficult to enable data sharing in cyberspace for the real big data, as well as a real powerful AI. In this paper, we propose theSecNet, an architecture that can enable secure data storing, computing, and sharing in the large-scale Internet environment, aiming at a more secure cyberspace with real big data and thus enhanced AI with plenty of data source, by integrating three key components: 1) blockchain-based data sharing with ownership guarantee, which enables trusted data sharing in the large-scale environment to form real big data; 2) AI-based secure computing platform to produce more intelligent security rules, which helps to construct a more trusted cyberspace; 3) trusted value-exchange mechanism for purchasing security service, providing a way for participants to gain economic rewards when giving out their data or service, which promotes the data sharing and thus achieves better performance of AI. Moreover, we discuss the typical use scenario of SecNet as well as its potentially alternative way to deploy, as well as analyze its effectiveness from the aspect of network security and economic revenue.
This study attempts to create a cryptocurrency classification metod and tool for reliability assessment from the point of view of investors and traders. The definition of the reliability of cryptocurrency and classification criteria is formulated. The following emphasizes how, using the support vector method, based on the available open data, it is possible to determine the reliability of Ethereum-based cryptocurrencies. As a result of testing, 15 reliable cryptocurrencies were identified and software was developed that allows you to collect and classify cryptocurrencies.
The Internet of Things (IoT) has been widely used because of its high efficiency and real-time collaboration. A wireless sensor network is the core technology to support the operation of the IoT, and the security problem is becoming more and more serious. Aiming at the problem that the existing malicious node detection methods in wireless sensor networks cannot be guaranteed by fairness and traceability of detection process, we present a blockchain trust model (BTM) for malicious node detection in wireless sensor networks. First, it gives the whole framework of the trust model. Then, it constructs the blockchain data structure which is used to detect malicious nodes. Finally, it realizes the detection of malicious nodes in 3D space by using the blockchain smart contract and the WSNs' quadrilateral measurement localization method, and the voting consensus results are recorded in the blockchain distributed. The simulation results show that the model can effectively detect malicious nodes in WSNs, and it can also ensure the traceability of the detection process.
Jan 1, 2019·Proceedings of the VIth International Workshop 'Critical Infrastructures: Contingency Management, Intelligent, Agent-Based, Cloud Computing and Cyber Security' (IWCI 2019)
Konstantin Mironov, Sergey Trishin, Amir Makhmutov, Vadim Kartak · 5 authors
In this article we consider tasks related to ensuring the integrity and availability of information in the Internet of Things (IoT) sphere. Such systems include sensors and similar devices, which are the sources of data, access points, which transmit data from sensors to the Internet and servers, which store received data and grant access to users. When storing data on a server and providing access to it, it is necessary to ensure its integrity and availability to users. To this end, it is proposed to apply a distributed ledger technology (DLT). One of the applications of DLT for data protection is energetics. Here we consider a system for processing and storing data on the production and consumption of electricity in a decentralized power grid. A review of currently existing projects related to the use of distributed ledger technologies in the energy sector is carried out. An important obstacle to the use of DLT in the IoT is the contradiction between, on the one hand, high memory computational requirements of the DLT, and, on the other hand, limited resources of IoT nodes. Further research directions are proposed that are associated with overcoming this obstacle in applying distributed ledger technologies in the energetics.
Zakaria Abou El Houda, Abdelhakim Hafid, Lyes Khoukhi
With the exponential growth in the number of insecure devices, the impact of Distributed Denial-of-Service (DDoS) attacks is growing rapidly. Existing DDoS mitigation schemes are facing obstacles due to low flexibility, lack of resources, and high cost. The new emerging technologies, such as blockchain, introduce new opportunities for low-cost, efficient and flexible DDoS attacks mitigation across multiple domains. In this paper, we propose a blockchain-based approach, called Cochain-SC, which combines two levels of mitigation, intra-domain and inter-domain DDoS mitigation. For intra-domain, we propose an effective DDoS mitigation method in the context of software defined networks (SDN); it consists of three schemes: (1) Intra Entropy-based scheme (I-ES) to measure, using sFlow, the randomness of data inside the domain; (2) Intra Bayes-based scheme (I-BS) to classify, based on entropy values, illegitimate flows; and (3) Intra-domain Mitigation (I-DM) scheme to effectively mitigate illegitimate flows inside the domain. For inter-domain, we propose a collaborative DDoS mitigation scheme based on blockchain; it uses the concept of smart contracts (i.e., Ethereum's smart contracts) to facilitate the collaboration among SDN-based domains (i.e., Autonomous System: AS) to mitigate DDoS attacks. For this aim, we design a novel and secure scheme that allows multiple SDN-based domains to securely collaborate and transfer attack information in a decentralized manner. Combining intra- and inter-domain DDoS mitigation, Cochain-SC allows an efficient mitigation along the path of an ongoing attack and an effective mitigation near the origin of the attack. This allows reducing the enormous cost of forwarding packets, across multiple domains, which consist mostly of useless amplified attack traffic. To the best of our knowledge, Cochain-SC is the first scheme that proposes to deal with both intra-domain and inter-domain DDoS attacks mitigation combining SDN, blockchain and smart contract. The implementation of Cochain-SC is deployed on Ethereum official test network Ropsten. Moreover, we conducted extensive experiments to evaluate our proposed approach; the experimental results show that Cochain-SC achieves flexibility, efficiency, security, cost effectiveness, and high accuracy in detecting illegitimate flows, making it a promising approach to mitigate DDoS attacks.
Davy Preuveneers, Vera Rimmer, Ilias Tsingenopoulos, Jan Spooren · 6 authors
The adoption of machine learning and deep learning is on the rise in the cybersecurity domain where these AI methods help strengthen traditional system monitoring and threat detection solutions. However, adversaries too are becoming more effective in concealing malicious behavior amongst large amounts of benign behavior data. To address the increasing time-to-detection of these stealthy attacks, interconnected and federated learning systems can improve the detection of malicious behavior by joining forces and pooling together monitoring data. The major challenge that we address in this work is that in a federated learning setup, an adversary has many more opportunities to poison one of the local machine learning models with malicious training samples, thereby influencing the outcome of the federated learning and evading detection. We present a solution where contributing parties in federated learning can be held accountable and have their model updates audited. We describe a permissioned blockchain-based federated learning method where incremental updates to an anomaly detection machine learning model are chained together on the distributed ledger. By integrating federated learning with blockchain technology, our solution supports the auditing of machine learning models without the necessity to centralize the training data. Experiments with a realistic intrusion detection use case and an autoencoder for anomaly detection illustrate that the increased complexity caused by blockchain technology has a limited performance impact on the federated learning, varying between 5 and 15%, while providing full transparency over the distributed training process of the neural network. Furthermore, our blockchain-based federated learning solution can be generalized and applied to more sophisticated neural network architectures and other use cases.
Wesley Joon-Wie Tann, Xing Han, Sourav Sen Gupta, Yew-Soon Ong
Symbolic analysis of security exploits in smart contracts has demonstrated to be valuable for analyzing predefined vulnerability properties. While some symbolic tools perform complex analysis steps, they require a predetermined invocation depth to search vulnerable execution paths, and the search time increases with depth. The number of contracts on blockchains like Ethereum has increased 176 fold since December 2015. If these symbolic tools fail to analyze the increasingly large number of contracts in time, entire classes of exploits could cause irrevocable damage. In this paper, we aim to have safer smart contracts against emerging threats. We propose the approach of sequential learning of smart contract weaknesses using machine learning---long-short term memory (LSTM)---that allows us to be able to detect new attack trends relatively quickly, leading to safer smart contracts. Our experimental studies on 620,000 smart contracts prove that our model can easily scale to analyze a massive amount of contracts; that is, the LSTM maintains near constant analysis time as contracts increase in complexity. In addition, our approach achieves $99\%$ test accuracy and correctly analyzes contracts that were false positive (FP) errors made by a symbolic tool.