Blockchain Papers

Beltran Fiz, Stefan Hommes, Radu State

No abstract is available for this record.

J.A. Gómez-Hernández, L. Álvarez-González, Pedro García‐Teodoro

No abstract is available for this record.

Ramiro Daniel Camino, Radu State, Leandro Montero, Petko Valtchev

Banks and financial institutions around the world must comply with several policies for the prevention of money laundering and in order to combat the financing of terrorism. Nowadays, there is a raise in the popularity of novel financial technologies such as digital currencies, social trading platforms and distributed ledger payments, but there is a lack of approaches to enforce the aforementioned regulations accordingly. Software tools are developed to detect suspicious transactions usually based on knowledge from experts in the domain, but as new criminal tactics emerge, detection mechanisms must be updated. Suspicious activity examples are scarce or nonexistent, hindering the use of supervised machine learning methods. In this paper, we describe a methodology for analyzing financial information without the use of ground truth. A user suspicion ranking is generated in order to facilitate human expert validation using an ensemble of anomaly detection algorithms. We apply our procedure over two case studies: one related to bank fund movements from a private company and the other concerning Ripple network transactions. We illustrate how both examples share interesting similarities and that the resulting user ranking leads to suspicious findings, showing that anomaly detection is a must in both traditional and modern payment systems.

Bruno Rodrigues, Thomas Bocek, Burkhard Stiller

No abstract is available for this record.

Andrea Pinna, Roberto Tonelli, Matteo Orrù, Michele Marchesi

A Blockchain is a global shared infrastructure where cryptocurrency transactions among addresses are recorded, validated and made publicly available in a peer-to-peer network. To date, the best known and important cryptocurrency is the bitcoin. In this paper, we focus on this cryptocurrency and in particular on the modeling of the Bitcoin Blockchain by using the Petri Nets formalism. The proposed model allows us to quickly collect information about identities owning Bitcoin addresses and to recover measures and statistics on the Bitcoin network. By exploiting algebraic formalism, we reconstructed an Entities network associated to Blockchain transactions gathering together Bitcoin addresses into the single entity holding permits to manage Bitcoins held by those addresses. The model allows also to identify a set of behaviors typical of Bitcoin owners, like that of using an address only once, and to reconstruct chains for this behavior together with the rate of firing. Our model is highly flexible and can easily be adapted to include different features of the Bitcoin cryptocurrency system. By exploiting algebraic formalism, we reconstructed an Entities network associated to Blockchain transactions gathering together Bitcoin addresses into the single entity holding permits to manage Bitcoins held by those addresses. The model allows also to identify a set of behaviors typical of Bitcoin owners, like that of using an address only once, and to reconstruct chains for this behavior together with the rate of firing. Our model is highly flexible and can easily be adapted to include different features of the Bitcoin cryptocurrency system.

Tom Jamsrandorj

To effectively participate in modern collaborations, member organizations should be able to share digital resources with various partners, while ensuring their digital resources are protected from inappropriate access.In the existing literature, a substantial amount of research on centralized access control in the context of a single organization has been carried out.However, research on decentralized access control in a collaborative environment is scarce.To advance research in this area, I implemented a prototype of a decentralized access control system, which supports transparency, auditability, immutability, and equality in a collaboration environment, using the Multichain blockchain platform, RESTful web services, and Java programming language.The prototype was developed to evaluate two primary metrics: average response time and throughput.To achieve this, I carried out a number of experiments to measure both metrics on a Local Area Network (LAN) and on Amazon Web Services (AWS) under 84 different experimental conditions.The LAN setup provides a baseline for system performance under optimal conditions, while the cloud infrastructure represents a real-world use case.With low-system loads (comprising one to thirty concurrent clients and a single server running the system), the LAN setup outperformed the AWS setup by a factor of 2.5 based on throughput.On the other hand, when the system load is significantly increased, with more servers running the system, the AWS and LAN setups showed only a marginal difference in their performance.This demonstrates the potential to horizontally scale the decentralized access control system using blockchain on cloud infrastructure.

Davor Maček, Dino Alagić

This paper describes proposed methodology for evaluation of critical systems and prioritization of critical risks and assets identified in highly secured information systems. For different types of information assets or security environments it is necessary to apply different techniques and methods for their prioritization and evaluation. In this article, VECTOR matrix method for prioritization of critical assets and critical risks is explained and integrated into AHP (Analytic Hierarchy Process) technique as a set of fixed criteria for evaluation of defined alternatives. Bitcoin cryptocurrency was compared and evaluated along with other common Internet transaction systems by information security professionals according to defined VECTOR criteria. Also, the newly proposed hybrid AHP model is presented with potential case studies for future research. This article tries to discover security posture of Bitcoin cryptocurrency in the context of information security risks related to the existing most common online payment systems like e-banking, m-banking, and e-commerce

Ahmed Ben Ayed

Blockchain is offering new opportunities to develop new types of digital services. While research on the topic is still emerging, it has mostly focused on the technical and legal issues instead of taking advantage of this novel concept and creating advanced digital services. In this paper, we are going to leverage the open source Blockchain technology to propose a design for a new electronic voting system that could be used in local or national elections. The Blockchain-based system will be secure, reliable, and anonymous, and will help increase the number of voters as well as the trust of people in their governments.

Bruno Rodrigues, Thomas Bocek, Burkhard Stiller

Abstract The exponential increase of the traffic volume makes Distributed Denial-of-Service (DDoS) attacks a top security threat to service providers. Existing DDoS defense mechanisms lack resources and flexibility to cope with attacks by themselves, and by utilizing other’s companies resources, the burden of the mitigation can be shared. Technologies as blockchain and smart contracts allow distributing attack information across multiple domains, while SDN (Software-Defined Networking) and NFV (Network Function Virtualization) enables to scale defense capabilities on demand for a single network domain. This proposal presents the design of a novel architecture combining these elements and introducing novel opportunities for flexible and efficient DDoS mitigation solutions across multiple domains.

Bruno Rodrigues, Thomas Bocek, Andri Lareida, David Hausheer · 6 authors

Abstract The rapid growth in the number of insecure portable and stationary devices and the exponential increase of traffic volume makes Distributed Denial-of-Service (DDoS) attacks a top security threat to services provisioning. Existing defense mechanisms lack resources and flexibility to cope with attacks by themselves, and by utilizing other’s companies resources, the burden of the mitigation can be shared. Emerging technologies such as blockchain and smart contracts allows for the sharing of attack information in a fully distributed and automated fashion. In this paper, the design of a novel architecture is proposed by combining these technologies introducing new opportunities for flexible and efficient DDoS mitigation solutions across multiple domains. Main advantages are the deployment of an already existing public and distributed infrastructure to advertise white or blacklisted IP addresses, and the usage of such infrastructure as an additional security mechanism to existing DDoS defense systems, without the need to build specialized registries or other distribution mechanisms, which enables the enforcement of rules across multiple domains.

Thai Pham, Steven Lee

The problem of anomaly detection has been studied for a long time, and many Network Analysis techniques have been proposed as solutions. Although some results appear to be quite promising, no method is clearly to be superior to the rest. In this paper, we particularly consider anomaly detection in the Bitcoin transaction network. Our goal is to detect which users and transactions are the most suspicious; in this case, anomalous behavior is a proxy for suspicious behavior. To this end, we use the laws of power degree and densification and local outlier factor (LOF) method (which is proceeded by k-means clustering method) on two graphs generated by the Bitcoin transaction network: one graph has users as nodes, and the other has transactions as nodes. We remark that the methods used here can be applied to any type of setting with an inherent graph structure, including, but not limited to, computer networks, telecommunications networks, auction networks, security networks, social networks, Web networks, or any financial networks. We use the Bitcoin transaction network in this paper due to the availability, size, and attractiveness of the data set.

Thai Pham, Steven Lee

The problem of anomaly detection has been studied for a long time. In short, anomalies are abnormal or unlikely things. In financial networks, thieves and illegal activities are often anomalous in nature. Members of a network want to detect anomalies as soon as possible to prevent them from harming the network's community and integrity. Many Machine Learning techniques have been proposed to deal with this problem; some results appear to be quite promising but there is no obvious superior method. In this paper, we consider anomaly detection particular to the Bitcoin transaction network. Our goal is to detect which users and transactions are the most suspicious; in this case, anomalous behavior is a proxy for suspicious behavior. To this end, we use three unsupervised learning methods including k-means clustering, Mahalanobis distance, and Unsupervised Support Vector Machine (SVM) on two graphs generated by the Bitcoin transaction network: one graph has users as nodes, and the other has transactions as nodes.

Maria Apostolaki, Aviv Zohar, Laurent Vanbever

As the most successful cryptocurrency to date, Bitcoin constitutes a target of choice for attackers. While many attack vectors have already been uncovered, one important vector has been left out though: attacking the currency via the Internet routing infrastructure itself. Indeed, by manipulating routing advertisements (BGP hijacks) or by naturally intercepting traffic, Autonomous Systems (ASes) can intercept and manipulate a large fraction of Bitcoin traffic. This paper presents the first taxonomy of routing attacks and their impact on Bitcoin, considering both small-scale attacks, targeting individual nodes, and large-scale attacks, targeting the network as a whole. While challenging, we show that two key properties make routing attacks practical: (i) the efficiency of routing manipulation; and (ii) the significant centralization of Bitcoin in terms of mining and routing. Specifically, we find that any network attacker can hijack few (<100) BGP prefixes to isolate ~50% of the mining power---even when considering that mining pools are heavily multi-homed. We also show that on-path network attackers can considerably slow down block propagation by interfering with few key Bitcoin messages. We demonstrate the feasibility of each attack against the deployed Bitcoin software. We also quantify their effectiveness on the current Bitcoin topology using data collected from a Bitcoin supernode combined with BGP routing data. The potential damage to Bitcoin is worrying. By isolating parts of the network or delaying block propagation, attackers can cause a significant amount of mining power to be wasted, leading to revenue losses and enabling a wide range of exploits such as double spending. To prevent such effects in practice, we provide both short and long-term countermeasures, some of which can be deployed immediately.

Ahmad Karim, Rosli Salleh, Muhammad Khurram Khan

Botnet phenomenon in smartphones is evolving with the proliferation in mobile phone technologies after leaving imperative impact on personal computers. It refers to the network of computers, laptops, mobile devices or tablets which is remotely controlled by the cybercriminals to initiate various distributed coordinated attacks including spam emails, ad-click fraud, Bitcoin mining, Distributed Denial of Service (DDoS), disseminating other malwares and much more. Likewise traditional PC based botnet, Mobile botnets have the same operational impact except the target audience is particular to smartphone users. Therefore, it is import to uncover this security issue prior to its widespread adaptation. We propose SMARTbot, a novel dynamic analysis framework augmented with machine learning techniques to automatically detect botnet binaries from malicious corpus. SMARTbot is a component based off-device behavioral analysis framework which can generate mobile botnet learning model by inducing Artificial Neural Networks' back-propagation method. Moreover, this framework can detect mobile botnet binaries with remarkable accuracy even in case of obfuscated program code. The results conclude that, a classifier model based on simple logistic regression outperform other machine learning classifier for botnet apps' detection, i.e 99.49% accuracy is achieved. Further, from manual inspection of botnet dataset we have extracted interesting trends in those applications. As an outcome of this research, a mobile botnet dataset is devised which will become the benchmark for future studies.

Eren Yagdiran

Botnets, in other means zombie computers that await for instructions to execute, are the greatest threat in the internet today. They are one of the leading sources of online crime. Criminals are able to take advantage of using botnets and threaten online businesses, organizations or any entity in the internet. Criminals design and implement botnets in a complex way in order to hide their identities. Most notably the fact that criminals build command-and-control (C&C) infrastructures to manage their botnets. A botnet command-and-control mechanism (C&C) can be designed in various ways. The key principle behind designing a C&C mechanism is anonymity. Hence, criminals can propagate their instructions to botnets without revealing their identities. Since every new C&C mechanism increases the bar of anonymity, it is getting harder to trace and analyze botnets. In this thesis, we designed and implemented a C&C mechanism, btc-botnet, that runs over Bitcoin network. Btcbotnet has significant features over existing C&C mechanisms such as anonymity and resistance by its nature. We built a library that allows to use Bitcoin network as an underlying infrastructure for C&C mechanism. We evaluate our work and show that its feasibility in terms of metrics such as response time, confirmation time and fees.

Philipp Winter, Roya Ensafi, Karsten Loesing, Nick Feamster

Being a volunteer-run, distributed anonymity network, Tor is vulnerable to Sybil attacks. Little is known about real-world Sybils in the Tor network, and we lack practical tools and methods to expose Sybil attacks. In this work, we develop sybilhunter, the first system for detecting Sybil relays based on their appearance, such as configuration; and behavior, such as uptime sequences. We used sybilhunter's diverse analysis techniques to analyze nine years of archived Tor network data, providing us with new insights into the operation of real-world attackers. Our findings include diverse Sybils, ranging from botnets, to academic research, and relays that hijack Bitcoin transactions. Our work shows that existing Sybil defenses do not apply to Tor, it delivers insights into real-world attacks, and provides practical tools to uncover and characterize Sybils, making the network safer for its users.

Torbjørn Langland, Kristian Klomsten Skordal

Recent years have seen the emergence of a new class of currencies, called\ncryptocurrencies. These currencies use cryptography to provide security\nand peer-to-peer networking to provide a decentralized system. Bitcoin is\nthe most popular of these currencies. It uses a two-pass\nSHA-256 hash at its core. Producing new bitcoins is done through a process\nreferred to as "mining", which involves a brute-force search for a hash with\na specific value. This process requires large amounts of computing power.\n\nCurrent-generation hardware for bitcoin mining includes highly-optimized\nASIC chips which provide huge amounts of performance. However, designers of\nsuch chips are having problems with delivering enough power and cooling\nto the chips. To alleviate this problem, this thesis looks at the possibilities\nof using heterogeneous computing to reduce power consumption and produce a more\nenergy-efficient mining solution.\n\nA SHA-256 accelerator and a DMA module is developed and integrated into a tile for\nthe Single-ISA Heterogeneous MAny-core Computer, SHMAC, and a system with\nmultiple cores is used to exploit the thread-level parallelism provided by\nthe platform. The system is tested using a benchmark to find out what performance\nand energy efficiency can be expected when using the system for bitcoin mining.\n\nThe results show a maximum performance of 175,7 kH/s when running the benchmark\napplication on 14 cores using the SHA-256 accelerator and the DMA module. The best\nenergy efficiency was obtained when running on 14 cores without the DMA enabled,\nat 163,2 kH/J. The results does not compare well to specialized FPGA-based\nbitcoin miners, but demonstrates the SHMAC platform's large degree of thread-level parallelism\nwhich can be better exploited in other applications.

Leonard Apeltsin

Off-Chain transactions allow for the immediate transfer of Cryptocurrency between two parties, without delays or unavoidable transaction fees. Such capabilities are critical for mainstream Cryptocurrency adaption. They allow for the "Coffee-Coin Criteria"; under which a customer orders a coffee and pays for that coffee in bitcoins. This is not possible with On-Chain transactions today. Unfortunately, all existing Off-Chain transaction protocols are notoriously unreliable The current generation of third-party facilitators are vulnerable to hacker-based attacks. As Mt. Gox tragically demonstrated, centralized-transaction institutions are easy targets for Cryptocurrency thieves. The slightest security flaw in a third-party system will pounced on by hackers, who will proceed to devour it like ants devouring a crab. Under such circumstances, it no wonder that the Public treats most Cryptocurrency services with a constant shadow of suspicion. For Bitcoin to flourish, its anti-hierarchy principles must be applied to safe Off-Chain transactions. First and foremost, we need a new hacker-proof protocol that can easily be executed by any experienced developer. Preferably, the protocol will be open-sourced for full reliability and transparency. This paper presents one such procedure, which allows for he safe transmission of Bitcoin private key control by way of Cryptocubic transactions.

Philip Dotemoto

This project attempts to implement an open source FPGA based Bitcoin miner on an Altera DE2-115 development board. Bitcoin is an experimental peer-to-peer digital currency based on public key cryptography. The advantages of Bitcoins are that they can be transferred between any two people anywhere in the world, and they do not have the same fees and lack of control associated with traditional methods of currency transfers. The first part of this project focuses on detailing how the Bitcoin network and open source miner work. The second part of the project attempts to improve the performance of the open source miner, but a lack of resources on the Cyclone IV EP4CE115F29C7 ultimately prevented implementing a dual pipelined design.

Pablo Andrés García, Igor Santos

As the use of Internet grows beyond all boundaries, the number of menaces rises to become subject of concern and increasing research. Against this, Network Intrusion Detection Systems (NIDS) monitor local networks to separate legitimate from dangerous behaviours. According to their capabilities and goals, NIDS are divided into misuse detection systems (which aim to detect well-known attacks) and anomaly detection systems (which aim to detect zero-day attacks). So far, no system to our knowledge combines advantages of both without any of their disadvantages. Moreover, the use of historical data for analysis or sequential adaptation is usually ignored, missing in this way the possibility of anticipating the behaviour of the target system. ESIDE-Depian, a Bayesian-networks-based misuse and anomaly detection system. In another work, we detailed the composition of the Bayesian network, its training methodology and showed general performance results. Here we have focused on evaluating the integration of misuse and anomaly detection. To this end, we have adopted Snort (a well-known misuse detector) as misuse detector trainer so the Bayesian Network of five experts is able to react against both misuse and anomalies. The Bayesian experts are devoted to the analysis of different network protocol aspects and obtain the common knowledge model by means of separated Snort-driven automated learning process Since ESIDE-Depian has passed the experiments brilliantly, it is possible to conclude that ESIDE-Depian using of Bayesian Networking concepts allows to confirm an excellent basis for paradigm unifying Network Intrusion Detection, providing not only stable Misuse Detection but also effective Anomaly Detection capabilities, with one only flexible knowledge representation model and a well-proofed inference and adaptation bunch of methods. On the other hand, the Bayesian approach also enables to implement powerful features over it, such as Dynamic-Bayesian-Network-based full representation of time, in order to accomplish totally-characterised connection tracking and low level chronological event correlation, or explanation tracking of the inferred cause-effect reasoning processes. Furthermore, contrary to other approaches such as Neural Networks, Bayesian networks allow administrative managing of inner information structures, so specific relationships among packet detection parameters and final conclusion can be explained, in a white-box manner. Moreover, it is not only possible to recover reasoning information, but also to act on both Bayesian network

Atsuko Miyaji, Mohammad Shahriar Rahman

No abstract is available for this record.

Mehmet Tahir Sandıkkaya, Bülent Örencik

Many electronic voting systems, classified mainly as homomorphic cryptography based, mix-net based and blind signature based, appear after the eighties when zero knowledge proofs were introduced. The common ground for all these three systems is that none of them works without real time cryptologic calculations that should be held on a server. As far as known, the agent-based approach has not been used in a secure electronic voting system. In this study, an agent-based electronic voting schema, which does not contain real time calculations on the server side, is proposed. Conventional cryptologic methods are used in the proposed schema and some of the requirements of an electronic voting system are constructed within the schema. The schema seems quite secure if the used cryptologic methods and agents are secure. In this paper, proposed schema will be explained and compared with already known electronic voting systems.

Aneta Zwierko, Zbigniew Kotulski

The recent developments in the mobile technology (mobile phones, middleware) created a need for new methods of protecting the code transmitted through the network. The proposed mechanisms not only secure the compiled program, but also the data, that can be gathered during its "journey". The oldest and the simplest methods are more concentrated on integrity of the code itself and on the detection of unauthorized manipulation. Other, more advanced proposals protect not only the code but also the execution state and the collected data. The paper is divided into two parts. The first one is mostly devoted to different methods of securing the code and protecting its integrity; starting from watermarking and fingerprinting, up to methods designed specially for mobile agent systems: encrypted function, cryptographic traces, time limited black-box security, chained-MAC protocol, publicly-verifiable chained digital signatures The second part presents new concept for providing mobile agents with integrity protection, based on a zero-knowledge proof system.