Smart contracts are distributed, self-enforcing programs executing on top of blockchain networks. They have the potential to revolutionize many industries such as financial institutes and supply chains. However, smart contracts are subject to code-based vulnerabilities, which casts a shadow on its applications. As smart contracts are unpatchable (due to the immutability of blockchain), it is essential that smart contracts are guaranteed to be free of vulnerabilities. Unfortunately, smart contract languages such as Solidity are Turing-complete, which implies that verifying them statically is infeasible. Thus, alternative approaches must be developed to provide the guarantee. In this work, we develop an approach which automatically transforms smart contracts so that they are provably free of 4 common kinds of vulnerabilities. The key idea is to apply run-time verification in an efficient and provably correct manner. Experiment results with 5000 smart contracts show that our approach incurs minor run-time overhead in terms of time (i.e., 14.79%) and gas (i.e., 0.79%).
Cyber threat is a major issue that has been terrorizing the computing work. A typical cyber-physical system is crucial in ensuring a safe and secure architecture of a sustainable computing ecosystem. Cyber Threat Intelligence (CTI) is a new methodology that is used to address some of the existing cyber threats and ensure a more secure environment for communication. Data credibility and reliability plays a vital role in increasing the potential of a typical CTI and the data collected for this purpose is said to be highly reliable. In this paper, we have introduced a CTI system using blockchain to tackle the issues of sustainability, scalability, privacy and reliability. This novel approach is capable of measuring organizations contributions, reducing network load, creating a reliable dataset and collecting CTI data with multiple feeds. We have testing various parameters to determine the efficiency of the proposed methodology. Experimental results show that when compared to other methodologies, we can save upto 20% of storage space using the proposed methodology.
The Internet of Things (IoT) is a widely used technology in the last decade in different applications. The Internet of things is wirelessly or wired to communicate, store, compute and track various real-time scenarios. This survey mainly discussed the core problems of Internet of things security and access control to unauthorized users and security requirements for IoT. The Internet of things is a heterogeneous device and has low memory, less processing power because of the small sizes. Nowadays, IoT systems are not sure and powerless to protect themselves against cyber attacks. It is mainly due to inadequate space in IoT gadgets, immature standards, and the lack of protected hardware and software design, development, and deployment. To meet IoT requirements, the authors discussed the limitations of traditional access control. Then the authors examined the potential to spread access control by implementing the safe architecture accommodated by the Blockchain. The authors also addressed how to use the Blockchain to work with and resolve some of the standards relevant to IoT security issues. In the end, an analysis of this survey shows future, open-ended problems, and challenges. It offers how the Blockchain potentially ensures reliable, scalable, and more efficient security solutions for IoT and further research work.
Hyunyoung Oh, Kevin Nam, Seongil Jeon, Yeongpil Cho · 5 authors
Remote computing has emerged as a trendy computing model that enables users to process an immense number of computations efficiently on the remote server where the necessary data and high-performance computing power are provisioned. Unfortunately, despite such an advantage, this computing model suffers from insider threats that are committed by adversarial administrators of remote servers who attempt to steal or corrupt users' private data. These security threats are somewhat innate to remote computing in that there is no means to control administrators' unlimited data access. In this paper, we present our novel hardware-centric solution, called MeetGo, to address the intrinsic threats to remote computing. MeetGo is a field-programmable gate array (FPGA)-based trusted execution environment (TEE) that aims to operate independently of the host system architecture. To exhibit the ability and effectiveness of MeetGo as a TEE ensuring secure remote computing, we have built two concrete applications: cryptocurrency wallet and GPGPU. MeetGo provides a trust anchor for these applications that enable their users to trade cryptocurrency or to run a GPGPU program server on a remote server while staying safe from threats by insiders. Our experimental results clearly demonstrate that MeetGo incurs only a negligible performance overhead to the applications.
Open access
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
The introduction of a review system in e-commerce platforms results in an effective business model. The effects of positive/negative reviews on the success of a product are well studied in the literature. Therefore, for the vendors, it is crucial to obtain positive reviews of their products. This fact opens fraudulent scenarios. Indeed, some vendors can pay an incentive to the buyers to obtain, in exchange, a fake positive review. This fake-review system (FRS) is so widespread that vendors rely on ad-hoc companies that, through intermediaries, find buyers available to release fake reviews. In this paper, we propose a game-theory-based strategy to discourage the above fraudulent business model, and an effective way to implement this strategy leveraging an Ethereum smart contract. Specifically, the contribution of the paper is two-fold. First, we formalize the current business model as a sequential game, and we identify sufficient conditions making FRS advantageous. Second, we propose to introduce in the review system a new mechanism, thanks to which, the corresponding sequential game requires conditions necessary to make advantageous FRS that are strictly less convenient than the previous ones. We implemented the solution and evaluate the cost of the smart contract execution.
The success of Bitcoin since 2009 stimulates the development of other blockchain-based applications, such as Ethereum, a second generation of cryptocurrency which supports the revolutionary idea of smart contracts. An Ethereum smart contract is a computer program written in some domain-specific high-level programming languages, such as Solidity, Vyper, Bamboo, Flint, etc., and stored on the blockchain to achieve certain functionality. Smart contracts benefit from the features of the blockchain in various aspects. For instance, it is not necessary to have an external trusted authority to achieve consensus, and transactions through smart contracts are always traceable and credible. Smart contracts must be verified for multiple reasons. Firstly, due to the decentralized nature of the blockchain, smart contracts are different from programs written in other programming languages (e.g., C/Java). For instance, the storage of each contract instance is located at a permanent address on the blockchain. In this way, each contract instance is a particular execution context and context switches are possible through external calls. Particularly, in Solidity, delegatecall is executed in the context of the caller rather than the recipient, making it possible to modify the state of the caller. Programmers must be aware of the execution context of each statement to guarantee the programming correctness. Therefore, programming smart contracts is error-prone without a proper understanding of the underlying semantic model. Secondly, a smart contract can be deployed on the blockchain by any user in the network. Vulnerabilities in deployed contracts can be exploited to launch attacks that lead to huge financial loss. Verifying smart contracts against such vulnerabilities is crucial for protecting digital assets. One famous attack on smart contracts is the DAO attack in which the attacker exploited the reentrancy vulnerability and managed to take 60 million dollars under his/her control. Finally, it is very difficult, if not impossible, to patch a smart contract once it is deployed due to the very nature of the blockchain. There is a surge of interest in analyzing and verifying smart contracts. To the best of our knowledge, most of the existing approaches either focus on EVM (Ethereum Virtual Machine) bytecode, or translate Solidity smart contracts into programs in intermediate languages that are suitable for verifying smart contracts or detecting potential issues in associated verifiers or checkers. Furthermore, none of the existing works can directly handle smart contracts written in different high-level programming languages without translating them into EVM bytecode or intermediate languages. None of the existing approaches defines security properties with the high-level semantics of smart contracts. A direct executable formal semantics of the high-level smart contract programming language concerned is a must for both understanding and verifying smart contracts. Firstly, programmers write and reason about smart contracts at the level of source code without the semantics of which they are required to understand how Solidity programs are compiled into EVM bytecode in order to understand these contracts, which is far from trivial. In addition, there may be semantic gaps between high-level smart contract programming languages and low-level bytecode which are introduced by compiler bugs. In other words, after compilation the semantics of bytecode may not be equivalent to that of the corresponding high-level programs due to the compiler bugs involved. Therefore, both high-level and low-level semantics definitions are necessary to conduct equivalence checking to guarantee that security properties are preserved at both levels and reason about compiler bugs. Secondly, even though smart contracts can be transformed into programs in intermediate languages to be analyzed and verified in existing model checkers and verifiers, the equivalence checking of the high-level smart contract programming language concerned and the intermediate language applied to interpret it is crucial to the validity of the verification. We develop an executable operational semantics for the Solidity programming language to formally reason about smart contracts written in Solidity. The contributions of this work lie in four aspects. Firstly, our work is the first approach, to the best of our knowledge, to a complete executable formal semantics of Solidity constructed directly on the language itself other than Solidity compilers. The proposed executable semantics completely covers the supported high-level core features specified by the official Solidity documentation and is validated with the official compiler Remix. In addition, a new and general way of semantics formalization is applied in the semantics design, making the proposed semantics robust in the language evolution of smart contracts. Secondly, the proposed semantics provides a formal specification of smart contracts which solves the specification issues in the existing verification and analysis tools. Thirdly, the proposed semantics allows us to formally define semantic-level security properties for verifying smart contracts to exclude the false positives and negatives introduced by the existing approaches. Finally, the proposed semantics defines correct and secure high-level execution behaviours of smart contracts to reason about compiler bugs and assist developers in writing secure smart contracts. Furthermore, we develop a generalized formal semantic framework for smart contracts. The contributions of this work lie in three aspects. Firstly, our work is the first approach, to the best of our knowledge, to a generalized formal semantic framework for smart contracts which can directly handle contracts written in different high-level programming languages. Secondly, a general semantic model of smart contracts is constructed with rewriting logic in the K-framework. With the general semantic model, a direct executable formal semantics of a particular high-level smart contract programming language can be constructed as long as its core features fall into the ones defined in this model. The general semantic model is validated with its interpretation in Solidity using the Solidity compiler test set and evaluation results show that it is complete and correct. Lastly, the generated semantics facilitates the formal verification of smart contracts written in a particular high-level programming language as a formal specification of the corresponding language. Together with low-level specifications, it allows us to conduct equivalence checking on high-level contracts and low-level bytecode to reason about compiler bugs and guarantee that security properties are preserved at both levels. We define some security properties based on the formal semantics of the high-level smart contract programming languages. These security properties are defined from a general point of view and can be applied to detect a variety of vulnerabilities in smart contracts, such as the reentrancy vulnerability, exception disorders, integer underflows and overflows, etc. In addition, verification algorithms for these properties are constructed with the proposed semantic framework. We compare our approaches to the security analysis of smart contracts with the existing ones and highlight the importance of precise semantic foundations for the verification of smart contracts. Lastly, we systematize the existing approaches to the security analysis of smart contracts from the perspectives of domain-specific research and applications of general ideas to study the connection between the domain-specific issues in smart contracts and general analysis techniques. To conclude, this thesis studies the formal specification and verification of smart contracts, and combines domain-specific analysis and applications of general techniques. It also motivates other research directions related to the security analysis of smart contracts, such as the equivalence checking of high-level contracts and low-level bytecode, formal reasoning of high-level smart contract programming languages, the fairness analysis of smart contracts, etc.
Alex Hoffman, Phillipe Austria, Chol Hyun Park, Yoohwan Kim
A C TBug Bounty Programs (BBPs) play an important role in providing and maintaining security in software applications.These programs allow testers to discover and resolve bugs before the general public is aware of them, preventing incidents of widespread abuse.However, they have shown problems such as organizations providing accountability of reporting bugs and nonrecognition of testers.In this paper, we discuss Bountychain, a decentralized application using Ethereum-based Smart Contracts (SCs) and the Interplanetary File System (IPFS), a distributed file storage system.Blockchain and SCs provide a safe, secure and transparent platform for a BBP.Testers can submit bug reports and organizations can accept or reject the defect via the SCs.Transactions on the blockchain serve as a persistent and transparent record of software bugs, while IPFS serves as a long-term storage system for bug details.Thus, Bountychain ensures organization accountability and allows testers to gain irrefutable recognition.
Due to businesses’ growing use of IoT services in their day-to-day operations and the increased use of smart devices, digital forensic investigations involving such systems will need increasingly sophisticated digital evidence collection and processing. The majority of IoT systems are composed of disparate software and hardware components, which may pose security and privacy concerns. Recently, blockchain technology was presented as one of the options for achieving IoT security via the use of an immutable ledger, a decentralized architecture, and strong cryptographic primitives. Integrating blockchain platforms with IoT-based applications, on the other hand, poses a number of difficulties owing to the trustworthiness, integrity, and real-time responsiveness of IoT data. However, certain IoT devices may be incompatible with existing blockchain-based IoT forensic methods for additional digital evidence processing owing to their usage of conventional hash. A critical feature of cryptographic hash functions is that even if just one bit of the input is altered, the output acts pseudo-randomly, making it impossible to identify identical files. However, in the field of computer forensics, it is essential to locate comparable files (e.g., various versions of a file); therefore, we need a hash function that preserves similarity. It is getting more difficult to establish how forensic investigators might utilize traces from such devices. To effectively deal with IoT digital forensics applications, this article presents an improved blockchain-based IoT digital forensics architecture that use fuzzy hash to construct the Blockchain’s Merkle tree in addition to the conventional hash for authentication. Fuzzy hashing enables the identification of potentially damning documents that might otherwise remain undiscovered using conventional hashing techniques. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, the digital forensics investigator will be able to verify their authenticity. To support the proof of concept, we simulated the suggested model.
Open access
Digital and Cyber Forensics
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
Aleksandr Ometov, Krystof Zeman, Pavel Mašek, Lukas Balazevic · 5 authors
With technology evolving rapidly and proliferating, it is imperative to pay attention to mobile devices’ security being currently responsible for various sensitive data processing. This phase is essential as an intermediate before the cloud or distributed ledger storage delivery and should be considered additional care due to its inevitability. This paper analyzes the security mechanisms applied for internal use in the Android OS and the communication between the Android OS and the remote server. Presented work aims to examine these mechanisms and evaluate which cryptographic methods and procedures are most advantageous in terms of energy efficiency derived from execution time. Nonetheless, the dataset with the measurements collected from 17 mobile devices and the code for reproducibility is also provided. After analyzing the collected data, specific cryptographic algorithms are recommended to implement an application that utilizes native cryptographic operations on modern Android devices. In particular, selected algorithms for symmetric encryption are AES256 / GCM / No Padding; for digital signature – SHA512 with RSA2048 / PSS, and for asymmetric encryption – RSA3072 / OAEP with SHA512 and MGF1 Padding.
Lingyu Bian, Linlin Zhang, Kai Zhao, Hao Wang · 5 authors
In recent years, the rapid development of blockchain technology has attracted much attention from people around the world. Scammers take advantage of the pseudo-anonymity of blockchain to implement financial fraud. The Ponzi scheme, one of the main scam methods, has defrauded investors of large amounts of money, thereby harming their interests and hindering the application of blockchain. Unfortunately, the current detection technology typically largely relies on the source code of the contract or uses a single feature which does not fully represent the contract characteristics. In such a case, the detection of Ponzi schemes with high efficiency becomes urgent. In this paper, we propose an image-based scam detection method using an attention capsule network (SE-CapsNet) focused on Ethereum. The sequence of bytecode, the opcode frequency, and the application binary interface (ABI) call are extracted as features from the contract bytecode and ABI, further converted into grayscale images, and then mapped into three color channels to generate RGB images, which are used as the input of the model for detecting the Ponzi scheme contract. In addition, we employ fancy PCA for data augmentation to reduce the impact of imbalanced data on the detection results. Experimental results show that the image-based detection method using deep learning models can effectively detect contracts before transactions occur. Among them, our proposed SE-CapsNet obtains great detection results, with an F1 score of 98.38%.
Open access
Advanced Malware Detection Techniques
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
With the mass expansion of Internet of Things (IoT) in industry and consumer life, IoT security has become a focal point of research and development. New technologies are enabling unprecedented methods of developing and securing IoT devices. This thesis focuses on studying and applying Web 3.0 technologies in an IoT device and service context while addressing IoT security vulnerabilities through the use of good security design practices. Through the application of Web 3.0 technologies this thesis illustrates the advantages and disadvantages that these technologies offer. The practi- cal implementation utilizes a custom Ethereum based security protocol that enables an IoT device to use a decentralized data network as its dedicated backend infrastructure. The results of the implementation will be analyzed through the lens of security and practicality.
Gabriel de Sousa Matsumura, Luciana Brasil Rebelo dos Santos, Arlindo Flávio da Conceição, Nandamudi L. Vijaykumar
Smart Contracts (SCs) are programs stored in a Blockchain to ensure agreements between two or more parties. Due to the unchangeable essence of Blockchain, failures or errors in SCs become perpetual once published. The reliability of SCs is essential to avoid financial losses. So, SCs must be checked to ensure the absence of errors. Hence, many studies addressed new methods and tools for zero-bug software in SCs. This paper conducted a systematic literature mapping identifying initiatives and tools to analyze SCs and how to deal with the identified vulnerabilities. Besides, this work identifies gaps that may lead to research topics for future work.
Our contributions with this paper are twofold. First, we elucidate the methodological requirements for a risk framework of custodial operations and argue for the value of this type of risk model as complementary with cryptographic and blockchain security models. Second, we present a risk model in the form of a library of attack-trees for Revault -- an open-source custody protocol. The model can be used by organisations as a risk quantification framework for a thorough security analysis in their specific deployment context. Our work exemplifies an approach that can be used independent of which custody protocol is being considered, including complex protocols with multiple stakeholders and active defence infrastructure.
Vu Trung Duong Le, Thi Hong Tran, Hoai Luan Pham, Duc Khai Lam · 5 authors
The development of low-energy, high-performance hardware for cryptocurrency mining is gaining widespread attention. The mining process for proof-of-work (PoW) in conventional cryptocurrencies’ blockchains is increasingly being replaced by application-specific integrated circuits (ASICs). This leads to many security threats for the blockchain network because it decreases security and increases power consumption for mining. Therefore, Scrypt, the most representative ASIC-resistant algorithm, was developed to solve this problem. However, there are still some problems and challenges with the current Scrypt hardware. This article presents a new hardware architecture for the Scrypt algorithm intended for a PoW-based cryptocurrency mining system. The proposed Multi ROMix Scrypt Accelerator (MRSA) hardware architecture applies several optimization techniques: configuration, local-memory computing with high-performance pipelined Multi ROMix and rescheduling resources to significantly increase processing speed, flexibility, and energy efficiency. For evaluation, the MRSA is implemented on field-programmable gate arrays (FPGAs) to examine its actual performance, consumption, and correctness. Evaluation results on a Xilinx system-on-chip (SoC) with the ALVEO U280 Data Center Accelerator Card FPGA show that the MRSA is much more power-efficient than some of the most powerful commercial CPUs, GPUs, and other FPGA implementations. On the ALVEO U280, the MRSA achieves a maximum hash rate of 296.76 kHash/s, a throughput of 304.9 Mbps when reaching a maximum frequency of 259.94 MHz, and a power consumption of 18.12W. The energy efficiency of the MRSA on the ALVEO U280 SoC is 52.83 and 867.88 times higher than those on an RTX 3090 GPU and an i9-10940X CPU, respectively.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Yuichiro Chinen, Naoto Yanai, Jason Paul Cruz, Shingo Okamura
Ethereum smart contracts are programs that are deployed and executed in a consensus-based blockchain managed by a peer-to-peer network. Several re-entrancy attacks that aim to steal Ether, the cryptocurrency used in Ethereum, stored in deployed smart contracts have been found in the recent years. A countermeasure to such attacks is based on dynamic analysis that executes the smart contracts themselves, but it requires the spending of Ether and knowledge of attack patterns for analysis in advance. In this paper, we present a static analysis tool named RA (Re-entrancy Analyzer), a combination of symbolic execution and equivalence checking by a satisfiability modulo theories solver to analyze vulnerability of smart contracts to re-entrancy attacks. In contrast to existing tools, RA supports analysis of inter-contract behaviors by using only the Ethereum Virtual Machine bytecodes of target smart contracts, i.e., even without prior knowledge of attack patterns and without spending Ether. Furthermore, RA can verify existence of vulnerability to re-entrancy attacks without execution of smart contracts and it does not provide false positives and false negatives. We also present an implementation of RA to evaluate its performance in analyzing the vulnerability of deployed smart contracts to re-entrancy attacks and show that RA can precisely determine which smart contracts are vulnerable.
In the context of the COVID-19 pandemic, the rapid roll-out of a vaccine and the implementation of a worldwide immunization campaign is critical, but its success will depend on the availability of an operational and transparent distribution chain that can be audited by all relevant stakeholders. In this paper, we discuss how blockchain technology can be used for assuring the transparent tracing of COVID-19 vaccine registration, storage and delivery, and side effects self-reporting. We present such system implementation in which blockchain technology is used for assuring data integrity and immutability in case of beneficiary registration for vaccination, eliminating identity thefts and impersonations. Smart contracts are defined to monitor and track the proper vaccine distribution conditions against the safe handling rules defined by vaccine producers enabling the awareness of all network peers. For vaccine administration, a transparent and tamper-proof side effects self-reporting solution is provided considering person identification and administrated vaccine association. A prototype was implemented using the Ethereum test network, Ropsten, considering the COVID-19 vaccine distribution tracking conditions. The results obtained for each on-chain operation can be checked and validated on the Etherscan, demonstrating various aspects of the proposed system such as immunization actors and safe rules registration, vaccine tracking, and administration. In terms of throughput and scalability, the proposed blockchain system shows promising results.
Smart Contracts are software programs that are deployed and executed within a blockchain infrastructure. Due to their immutable nature, directly resulting from the specific characteristics of the deploying infrastructure, smart contracts must be thoroughly tested before their release. Testing is one of the main activities that can help to improve the reliability of a smart contract, so as to possibly prevent considerable loss of valuable assets. It is therefore important to provide the testers with tools that permit them to assess the activity they performed. Mutation testing is a powerful approach for assessing the fault-detection capability of a test suite. In this paper, we propose SuMo, a novel mutation testing tool for Ethereum Smart Contracts. SuMo implements a set of 44 mutation operators that were designed starting from the latest Solidity documentation, and from well-known mutation testing tools. These allow to simulate a wide variety of faults that can be made by smart contract developers. The set of operators was designed to limit the generation of stillborn mutants, which slow down the mutation testing process and limit the usability of the tool. We report a first evaluation of SuMo on open-source projects for which test suites were available. The results we got are encouraging, and they suggest that SuMo can effectively help developers to deliver more reliable smart contracts.
Blockchain technology, which provides digital security in a distributed manner, has evolved into a key technology that can build efficient and reliable decentralized applications (called DApps) beyond the function of cryptocurrency. The characteristics of blockchain such as immutability and openness, however, have made DApps more vulnerable to various security risks, and thus it has become of great significance to validate the integrity of DApps before they actually operate upon blockchain. Recently, research on vulnerability in smart contracts (a building block of DApps) has been actively conducted, and various vulnerabilities and their countermeasures were reported. However, the effectiveness of such countermeasures has not been studied well, and no appropriate methods have been proposed to evaluate them. In this paper, we propose a software tool that can easily perform comparative studies by adding existing/new countermeasures and labeled smart contract codes. The proposed tool demonstrates verification performance using various statistical indicators, which helps to identify the most effective countermeasures for each type of vulnerability. Using the proposed tool, we evaluated state-of-the-art countermeasures with 237 labeled benchmark codes. The results indicate that for certain types of vulnerabilities, some countermeasures show evenly good performance scores on various metrics. However, it is also observed that countermeasures that detect the largest number of vulnerable codes typically generate much more false positives, resulting in very low precision and accuracy. Consequently, under given constraints, different countermeasures may be recommended for detecting vulnerabilities of interest. We believe that the proposed tool could effectively be utilized for a future verification study of smart contract applications and contribute to the development of practical and secure smart contract applications.
Jesús Correas, Pablo Gordillo, Guillermo Román‐Díez
Profiling tools have been widely used for studying the behavior of the programs with the objective of reducing the amount of resources consumed by them. Most profilers collect the information with dynamic techniques, i.e., execute an instrumented version of the program with some specific input arguments to profile the measures of interest. This article presents a novel static profiling technique for Ethereum smart contracts that, using static resource analysis, is able to generate upper-bound expressions that can be used to produce profiling information about the measure of interest. Unlike traditional profiling tools, we get upper-bounds on the measures of interest expressed in terms of the input arguments or the state variables of the smart contracts. The information that can be obtained by the upper-bounds allows us to detect gas-expensive fragments of a Solidity program or to spot resource-related vulnerabilities at specific program points of the program. Moreover, in this article we propose an automatic optimization of Solidity programs which reduces their gas consumption replacing the accesses to state variables by gas-efficient accesses to local variables. We have experimentally evaluated our technique and we have detected that 6.81% of the public functions analyzed can be optimized and 1.43% are vulnerable to execute arbitrary code.
Luca Caviglione, Michał Choraś, Igino Corona, Artur Janicki · 7 authors
Cyber attacks are currently blooming, as the attackers reap significant profits from them and face a limited risk when compared to committing the “classical” crimes. One of the major components that leads to the successful compromising of the targeted system is malicious software. It allows using the victim’s machine for various nefarious purposes, e.g., making it a part of the botnet, mining cryptocurrencies, or holding hostage the data stored there. At present, the complexity, proliferation, and variety of malware pose a real challenge for the existing countermeasures and require their constant improvements. That is why, in this paper we first perform a detailed meta-review of the existing surveys related to malware and its detection techniques, showing an arms race between these two sides of a barricade. On this basis, we review the evolution of modern threats in the communication networks, with a particular focus on the techniques employing information hiding. Next, we present the bird’s eye view portraying the main development trends in detection methods with a special emphasis on the machine learning techniques. The survey is concluded with the description of potential future research directions in the field of malware detection.
With the development of information technology, the Internet of Things (IoT) has gradually become the third wave of the worldwide information industry revolution after the computer and the Internet. The application of the IoT has brought great convenience to people’s production and life. However, the potential information security problems in various IoT applications are gradually exposed and people pay more attention to them. The traditional centralized data storage and management model of the IoT is easy to cause transmission delay, single point of failure, privacy disclosure and other problems, and eventually leads to unpredictable behavior of the system. Blockchain technology can effectively improve the operation and data security status of the IoT. Referring to the storage model of the Fabric blockchain project, this paper designs a data security storage model suitable for the IoT system. The simulation results show that the model is not only effective and extensible, but also can better protect the data security of the Internet of Things.
Smart contract (SC) is an extension of BlockChain technology. Ethereum BlockChain was the first to incorporate SC and thus started a new era of crypto-currencies and electronic transactions. Solidity helps to program the SCs. Still, soon after Solidity's emergence in 2014, Solidity-based SCs suffered many attacks that deprived the SC account holders of their precious funds. The main reason for these attacks was the presence of vulnerabilities in SC. This paper discusses SC vulnerabilities and classifies them according to the domain knowledge of the faulty operations. This classification is a source of reminding developers and software engineers that for SC's safety, each SC requires proper testing with effective tools to catch those classes' vulnerabilities.