Mohammad Javad Shayegan, Hamid Reza Sabor, Mueen Uddin, Chin‐Ling Chen
The popularity and remarkable attractiveness of cryptocurrencies, especially Bitcoin, absorb countless enthusiasts every day. Although Blockchain technology prevents fraudulent behavior, it cannot detect fraud on its own. There are always unimaginable ways to commit fraud, and the need to use anomaly detection methods to identify abnormal and fraudulent behaviors has become a necessity. The main purpose of this study is to use the Blockchain technology of symmetry and asymmetry in computer and engineering science to present a new method for detecting anomalies in Bitcoin with more appropriate efficiency. In this study, a collective anomaly approach was used. Instead of detecting the anomaly of individual addresses and wallets, the anomaly of users was examined. In addition to using the collective anomaly detection method, the trimmed_Kmeans algorithm was used for clustering. The results of this study show the anomalies are more visible among users who had multiple wallets. The proposed method revealed 14 users who had committed fraud, including 26 addresses in 9 cases, whereas previous works detected a maximum of 7 addresses in 5 cases of fraud. The suggested approach, in addition to reducing the processing overhead for extracting features, detect more abnormal users and anomaly behavior.
Industry 4.0 is all about doing things in a concurrent, secure, and fine-grained manner. Internet of Things edge sensors and their associated data play a predominant role in today’s industry ecosystem. Breaching data or forging source devices after injecting advanced persistent threats (APTs) damages the industry owners’ money and loss of operators’ lives. The existing challenges include APT injection attacks targeting vulnerable edge devices, insecure data transportation, trust inconsistencies among stakeholders, incompliant data storing mechanisms, etc. Edge servers often suffer because of their lightweight computation capacity to stamp out unauthorized data or instructions, which, in essence, makes them exposed to attackers. When attackers target edge servers while transporting data using traditional public-key infrastructure-rendered trusts, consortium blockchain (CBC) offers proven techniques to transfer and maintain those sensitive data securely. With the recent improvement of edge machine learning, edge devices can filter malicious data at their end, which largely motivates us to institute a blockchain and artificial intelligence-aligned APT detection system. The unique contributions of this article include efficient APT detection at the edge and transparent recording of the detection history in an immutable blockchain ledger. In line with that, the certificateless data transfer mechanism boosts trust among collaborators and ensures an economical and sustainable mechanism after eliminating existing certificate authority. Finally, the edge-compliant storage technique facilitates efficient predictive maintenance. The respective experimental outcomes reveal that the proposed technique outperforms the other competing systems and models.
An eclipse attack is a common method used to attack the blockchain network layer; however, detecting eclipse attacks is challenging, and the performance of existing methods is inadequate due to uneven sample distribution, incomplete definition of discriminating features, and weak feature perception. Thus, this paper proposes an eclipse attack traffic detection method based in a custom combination of features and deep learning. To describe the behavior characteristics of attack traffic more accurately, traffic attribute features in there levels are defined in combination with the eclipse attack method. Here, the downstream traffic behavior feature of the eclipse attack is described from the conventional traffic feature, and the frequency distribution characteristics of eclipse attack traffic is by introducing the φ ‐entropy divergence algorithm. In addition, the structural characteristics of eclipse attack traffic are mapped from the rate of changes in traffic communication and load features. Then, the improved synthetic minority oversampling technique (ISMOTE) up‐sampling algorithm is employed to eliminate interference caused by the uneven distribution of eclipse attack traffic samples on the detection results. In addition, the ISMOTE algorithm adjusts the sampling weight of minority class samples, supports automatic clustering and efficient up‐sampling of samples, and improves the detection accuracy performance of eclipse attack samples by calculating the local cluster density. Then, deep feature mining is performed on the eclipse attack traffic from the distribution characteristics of space and time series using a CNN and Bi‐LSTM. Simultaneously, mining features are fully integrated into mixed feature using the multihead attention mechanism such that the relevance and complementarity of the two feature distributions can be utilized to enhance the model’s ability to perceive the spatiotemporal relationship of the eclipse attack traffic. Finally, the generated multihead attention items are detected for binary classification, and the results are output. Experimental results demonstrate that the proposed method can comprehensively enhance detection performance and sufficiently detect and classify eclipse attack traffic in the blockchain network layer.
Cryptocurrency networks that provide a new way of securing financial transactions have gained a surge of interest in recent years. However, recent studies reveal that blockchain networks are rampant with frauds and are prone to several privacy and security issues. The public availability of cryptocurrency transaction records provides an unprecedented opportunity for researchers to analyze cryptocurrency transactions. In particular, anomaly detection techniques are promising avenues for fighting illicit activities such as money laundering, terrorist financing, drug trafficking, scams, frauds, and many more.In this dissertation, we address the challenges of detecting anomalous entities on cryptocurrency networks. Firstly, we introduce effective techniques for generating features for network entities that are directly devised from raw data and highlight the utility of those features in detecting illicit accounts on the Ethereum network. Next, we enrich the proposed method by expanding the feature set through the incorporation of graph-based features that embed the relational information of networks. This also enables us to generalize our methods to instances of cryptocurrency networks with different architectural models. Based on the success of our method in anomaly detection in cryptocurrency networks, we further generalize our model to encompass a generic temporal weighted multidigraph and show the state-of-the-art results for anomaly detection in other common domains including rating and social networks. In doing so, we also investigate the challenges of employing node classification techniques for anomaly detection, which is a common practice. Here, we discuss the importance of performance metrics and evaluation settings when interpreting the efficiency of different methods and tasks, which is often overlooked by the community. Finally, we shift our focus to examining the inherent challenges of learning on dynamic networks, which is an important emerging research field with applications in drug discovery, computational finance, social networks, etc. Here, we propose solutions for providing a more robust evaluation setup for dynamic graph learning methods. The key contributions of this dissertation are twofold: First, we describe efficient techniques for detecting anomalies on cryptocurrency networks and generalize them to other real-world complex networks. Second, we focus on the temporal aspect of these networks and investigate how the dynamism of networks affects the downstream tasks and evaluation settings
The purpose of this study is to explore the co-movement between COVID-19 cases and eight cryptocurrencies. Cryptocurrencies (Bitcoin, Ethereum, Tether, Binance Coin, Dogecoin, Ripple, USD Coin and Bitcoin Cash) are selected based on their market capitalisations. Daily data is considered from 30 January 2020 to 19 May 2021. The continuous wavelet transform (wavelet coherence) is used to determine the time-varying co-movement between COVID-19 instances and cryptocurrencies in this research. COVID-19 and cryptocurrency prices are interlinked, as found using the wavelet method. Similar results were discovered for Tether, Binance Coin, and Ripple. Although this seems to be the case, Dogecoin appears to be an alternative investment during COVID-19. The research is unique and adds to the existing body of knowledge, even though some of the results address the function of cryptocurrencies in times of crisis. The research findings indicate that investors and crypto enthusiasts should keep an eye out in the scenario of COVID-19 scenarios when making investments in cryptocurrency marketplaces.
Blockchain is one of the most anticipated technology revolutions, with immense promise in various applications. It is a distributed and encrypted database that can address a range of challenges connected to online security and trust. While many people identify Blockchain with cryptocurrencies such as Bitcoin, it has a wide range of applications in supply chain management, health, Internet of Things (IoT), education, identity theft prevention, logistics, and the execution of digital smart contracts. Although Blockchain Technology (BT) has numerous advantages for Decentralized Applications (DApps), it is nevertheless vulnerable to abuse, smart contract failures, security, theft, trespassing, and other concerns. As a result, using Machine Learning (ML) models to detect anomalies is an excellent way to detect and safeguard blockchain networks from criminal activity. Adapting ensemble learning methods in ML to create better prediction outcomes is a viable approach for anomaly identification. Ensemble learning, as the name implies, refers to creating a stronger and more accurate classification by combining the prediction results of numerous weak models. As a result, an in-depth evaluation of ensemble learning methodologies for anomaly detection in the blockchain network ecosystem is applied in this paper. It comprises numerous ensemble methods (e.g., averaging, voting, stacking, boosting, bagging). The review collects data from three established databases, which are Scopus, Web of Science (WoS), and Google Scholar. Specific keywords are employed, such as Blockchain, Ethereum, Bitcoin, Anomaly Detection, and Ensemble Learning, employing advanced searching algorithms. The results of the search found 60 primary articles from 2017 to 2022 (30 from Scopus, 20 from the WoS, and 10 from Google Scholar). Based on these findings, we decided to divide our debate into three primary themes: (1) the fundamentals of Blockchain Technology (BT), (2) the overview of ensemble learning, and (3) the integration and analysis of ensemble learning in blockchain networks for anomaly detection. In terms of awareness and knowledge, the results are also discussed in terms of what they mean and where future research should go.
Oumaima Fadi, Karim Zkik, El Ghazi Abdellatif, Mohammed Boulmalf
Smart environments consist of a collection of sensors, actuators, and numerous computing units that improve human life. With the booming of smart environments, data generation has been notably increasing in recent years, which must be managed in a smart and optimal manner. The components (i.e., workstations and cloud) used for data processing are not the best to recommend since it is risky and resource costing. For that matter, enterprises, firms and companies are deploying blockchain technologies (BT) as a more suitable alternative. In fact, blockchain is a distributed transaction ledger ensuring the reliability and transparency of data. However, BT faces some inherent security challenges such as DoS, eclipse and double spending attacks as well as Advanced Persistent Threat (APT) and malware. Thus, advanced anomaly detection and mitigation approaches, especially the ones using artificial intelligence (AI) techniques (e. g. Machine Learning, Deep Learning, Federated Learning) are required to address the aforementioned issues. In combination, AI and BT are capable of detecting anomalies within blockchain networks with high accuracy. In this paper, with a focus on cyber security issues, we explore the challenges of blockchain deployment in smart environments. Additionally, we explore the use of anomaly detection AI-based techniques as a ledger of blockchain technologies to address the security issues in smart environments. Thus, we propose a framework that emphasizes the challenges of BT, values and capabilities of BT-AI integration. We also present research trends to highlight potential research paths for improving the security of blockchain networks using artificial intelligence.
S. Kate Devitt, Jason Scholz, Timo Schless, L Lewis
Abstract Artificial intelligences (AI) will increasingly participate digitally and physically in conflicts yet there is a lack of trusted communications with humans for humanitarian purposes. For example, in disasters and conflicts messaging and social media are used to share information, however, international humanitarian relief organisations treat this information as unverifiable and untrustworthy. Furthermore, current AI implementations can be brittle, with a narrow scope of application and wide scope of ethical risks. Meanwhile, human error can cause significant civilian harms even by combatants committed to compliance with international humanitarian law. AI offers an opportunity to help reduce the tragedy of war and better deliver humanitarian aid to those who need it. However, to be successful, these systems must be trusted by humans and their information systems, overcoming flawed information flows in conflict and disaster zones that continue to be marked by intermittent communications, poor situation awareness, mistrust and human errors. In this paper, we consider the integration of a communications protocol (the ‘Whiteflag protocol’), distributed ledger ‘blockchain’ technology, and information fusion with artificial intelligence (AI), to improve conflict communications called “Protected Assurance Understanding Situation & Entities” (PAUSE). Such a trusted human-AI communication network could provide accountable information exchange regarding protected entities, critical infrastructure, humanitarian signals and status updates for humans and machines in conflicts. Trust-based information fusion provides resource-efficient use of diverse data sources to increase the reliability of reports. AI can catch human mistakes and complement human decision making, while human judgment can direct and override AI recommendations. We examine several realistic potential case studies for the integration of these technologies into a trusted human-AI network for humanitarian benefit including mapping a conflict zone with civilians and combatants in real time, preparation to avoid incidents and using the network to manage misinformation. We finish with a real-world example of a PAUSE-like network, the Human Security Information System (HSIS), being developed by USAID, that uses blockchain technology to provide a secure means to better understand the civilian environment.
Xiong Yang, Yuling Chen, Xiaobin Qian, Tao Li · 5 authors
The distributed deployment of wireless sensor networks (WSNs) makes the network more convenient, but it also causes more hidden security hazards that are difficult to be solved. For example, the unprotected deployment of sensors makes distributed anomaly detection systems for WSNs more vulnerable to internal attacks, and the limited computing resources of WSNs hinder the construction of a trusted environment. In recent years, the widely observed blockchain technology has shown the potential to strengthen the security of the Internet of Things. Therefore, we propose a blockchain-based ensemble anomaly detection (BCEAD), which stores the model of a typical anomaly detection algorithm (isolated forest) in the blockchain for distributed anomaly detection in WSNs. By constructing a suitable block structure and consensus mechanism, the global model for detection can iteratively update to enhance detection performance. Moreover, the blockchain guarantees the trust environment of the network, making the detection algorithm resistant to internal attacks. Finally, compared with similar schemes, in terms of performance, cost, etc., the results prove that BCEAD performs better.
Detection of unknown malware and its variants remains both an operational and a research challenge in the Internet of Things (IoT). The Internet of Medical Things (IoMT) is a particular type of IoT network which deals with communication through smart healthcare (medical) devices. One of the prevailing problems currently facing IoMT solutions is security and privacy vulnerability. Previous malware detection methods have failed to provide security and privacy. In order to overcome this issue, the current study introduces a novel technique called biserial correlative Miyaguchi-Preneel blockchain-based Ruzicka-index deep multilayer perceptive learning (BCMPB-RIDMPL). The present research aims to improve the accuracy of malware detection and minimizes time consumption. The current study combines the advantages of machine-learning techniques and blockchain technology. The BCMPB-RIDMPL technique consists of one input layer, three hidden layers, and one output layer to detect the malware. The input layer receives the number of applications and malware features as input. After that, the malware features are sent to the hidden layer 1, in which feature selection is carried out using point biserial correlation, which reduces the time required to detect the malware. Then, the selected features and applications are sent to the hidden layer 2. In that layer, Miyaguchi-Preneel cryptographic hash-based blockchain is applied to generate the hash value for each selected feature. The generated hash values are stored in the blockchain, after which the classification is performed in the third hidden layer. The BCMPB-RIDMPL technique uses the Ruzicka index to verify the hash values of the training and testing malware features. If the hash is valid, then the application is classified as malware, otherwise it is classified as benign. This method improves the accuracy of malware detection. Experiments have been carried out on factors such as malware detection accuracy, Matthews's correlation coefficient, and malware detection time with respect to a number of applications. The observed quantitative results show that our proposed BCMPB-RIDMPL method provides superior performance compared with state-of-the-art methods.
With the integration of the Internet of Things (IoT) in the field of transportation, the Internet of Vehicles (IoV) turned to be a vital method for designing Smart Transportation Systems (STS). STS consist of various interconnected vehicles and transportation infrastructure exposed to cyber intrusion due to the broad usage of software and the initiation of wireless interfaces. This study proposes a federated deep learning-based intrusion detection framework (FED-IDS) to efficiently detect attacks by offloading the learning process from servers to distributed vehicular edge nodes. FED-IDS introduces a context-aware transformer network to learn spatial-temporal representations of vehicular traffic flows necessary for classifying different categories of attacks. Blockchain-managed federated training is presented to enable multiple edge nodes to offer secure, distributed, and reliable training without the need for centralized authority. In the blockchain, miners confirm the distributed local updates from participating vehicles to stop unreliable updates from being deposited on the blockchain. The experiments on two public datasets (i.e., Car-Hacking, TON_IoT) demonstrated the efficiency of FED-IDS against state-of-the-art approaches. It reveals the credibility of securing networks of intelligent transportation systems against cyber-attacks.
Blockchain and Data Mining are not simply buzzwords, but rather concepts that are playing an important role in the modern Information Technology (IT) revolution. Blockchain has recently been popularized by the rise of cryptocurrencies, while data mining has already been present in IT for many decades. Data stored in a blockchain can also be considered to be big data, whereas data mining methods can be applied to extract knowledge hidden in the blockchain. In a nutshell, this paper presents the interplay of these two research areas. In this paper, we surveyed approaches for the data mining of blockchain data, yet show several real-world applications. Special attention was paid to anomaly detection and fraud detection, which were identified as the most prolific applications of applying data mining methods on blockchain data. The paper concludes with challenges for future investigations of this research area.
The popularity and amazing attractiveness of cryptocurrencies, and especially Bitcoin, absorb countless enthusiasts daily. Although Blockchain technology prevents fraudulent behavior, it cannot detect fraud on its own. There are always unimaginable ways to commit fraud, and the need to use anomaly detection methods to identify abnormal and fraudulent behaviors has become a necessity. The main purpose of this study is to present a new method for detecting anomalies in Bitcoin with more appropriate efficiency. For this purpose, in this study, the diagnosis of the collective anomaly was used, and instead of diagnosing the anomaly of individual addresses and wallets, the anomaly of users was examined, and the anomaly was more visible among users who had multiple wallets. In addition to using the collective anomaly detection method in this study, the Trimmed_Kmeans algorithm was used for clustering and the proposed method succeeded in identifying 14 users who had committed theft, fraud, and hack with 26 addresses in 9 cases. Compared to previous works, which detected a maximum of 7 addresses in 5 cases of fraud, the proposed method has performed well. Therefore, the proposed method, by presenting a new approach, in addition to reducing the processing power to extract features, succeeded in detecting abnormal users and also was able to find more transactions and addresses committed a scam.
In blockchain, approved transactions, including illegal ones, cannot be modified unlike existing bank transactions. To prevent the damage caused by illegal transactions, rapid anomaly detection of transactions is required because transactions can be modified before approval. However, existing anomaly detection methods must process all transactions in blockchain, and the processing time is longer than the interval of each approval. In this paper, we propose a subgraph-based anomaly detection method to perform the detection using a part of the blockchain data. The proposed structure of the subgraph is suitable for graphics processing units (GPUs) to accelerate detection by using parallel processing. In an evaluation using real Bitcoin transaction data, when the number of targeted transactions was one hundred, the proposed method was 11.1x faster than an existing GPU-based method without lowering the detection accuracy.
Bitcoin is the most popular digital currency. It is not controlled by any sort of central bank or government institution and is the preferred payment method requested by cyber criminals through ransomware. This type of malware encrypts a victim's files and forces them to pay a ransom in order to regain access. In this short paper, Bitcoin transaction data of tenyears is analyzed by generating a K-Means clustering model, using it to predict each sample's cluster, and then creating a confusion matrix and evaluating the results (Rand Score).
Low-rate Distributed DoS (LDDoS) attack is a complex large-scale attack behavior with strong time-domain characteristics in blockchain-based wireless network. Blockchain with Machine learning-based models, as promising ways, are taken to detect them and secure wireless network. However, researchers focused on how to improve models' detection performance and work out new blockchain-based protection technologies during the past decades. Due to lack of evolving data, these models and technologies may have poor stability in the face of confrontational samples. To cope with the problem, this paper proposes a novel LSTM-CGAN method to generate high-quality LDDoS adversarial samples for blockchain-based wireless network detection models. In this method, we give a brief feature analysis about LDDoS attack in blockchain-based wireless network and work out its corresponding time series model firstly. And then, we take use of Long Short-Term Memory Networks (LSTM) to learn relationships among sequenced network packages in the same flow. At last, we establish a Condition Generative Adversarial Networks (CGAN) model to use above relationships as specific conditions for generating mimicking behaviors of LDDoS attacks in blockchain-based wireless network. The experimental results show that these generated adversarial samples based on both public and private datasets can cheat the machine learning detection models, and have the similar attack characteristics with the real samples. Consequently, they can be used as blockchain-based wireless network dataset of machine learning classifiers for training to enhance models' stability.
Kamyar Sabri‐Laghaie, Saeid Jafarzadeh Ghoushchi, Fatemeh Elhambakhsh, Abbas Mardani
A completely new economic system is required for the era of Industry 4.0. Blockchain technology and blockchain cryptocurrencies are the best means to confront this new trustless economy. Millions of smart devices are able to complete transparent financial transactions via blockchain technology and its related cryptocurrencies. However, via blockchain technology, internet-connected devices may be hacked to mine cryptocurrencies. In this regard, monitoring the network of these blockchain-based transactions can be very useful to detect the abnormal behavior of users of these cryptocurrencies. Therefore, the trustworthiness of the transactions can be assured. In this paper, a novel procedure is proposed to monitor the network of blockchain cryptocurrency transactions. To do so, a hidden Markov multi-linear tensor model (HMTM) is utilized to model the transactions among nodes of the blockchain network. Then, a multivariate exponentially weighted moving average (MEWMA) control chart is applied to the monitoring of the latent effects. Average run length (ARL) is used to evaluate the performance of the MEWMA control chart in detecting blockchain network anomalies. The proposed procedure is applied to a real dataset of Bitcoin transactions.
Financial services must monitor their transactions to prevent being used for money laundering and combat the financing of terrorism. Initially, organizations in charge of fraud regulation were only concerned about financial institutions such as banks. However, nowadays, the Fintech industry, online businesses, or platforms involving virtual assets can also be affected by similar criminal schemes. Regardless of the differences between the entities mentioned above, malicious activities affecting them share many common patterns. This dissertation's first goal is to compile and compare existing studies involving machine learning to detect and analyze suspicious transactions. The second goal is to synthesize methodologies from the last goal for tackling different use cases in an organized manner. Finally, the third goal is to assess the applicability of deep generative models for enhancing existing solutions. In the first part of the thesis, we propose an unsupervised methodology for detecting suspicious transactions applied to two case studies. One is related to transactions from a money remittance network, and the other is related to a novel payment network based on distributed ledger technologies. Anomaly detection algorithms are applied to rank user accounts based on recency, frequency, and monetary features. The results are manually validated by domain experts, confirming known scenarios and finding unexpected new cases. In the second part, we carry out an analogous analysis employing supervised methods, along with a case study where we classify Ethereum smart contracts into honeypots and non-honeypots. We take features from the source code, the transaction data, and the funds' flow characterization. The proposed classification models proved to generalize well to unseen honeypot instances and techniques and allowed us to characterize previously unknown techniques. In the third part, we analyze the challenges that tabular data brings into the domain of deep generative models, a particular type of data used to represent financial transactions in the previous two parts. We propose a new model architecture by adapting state-of-the-art methods to output multiple variables from mixed types distributions. Additionally, we extend the evaluation metrics used in the literature to the multi-output setting, and we show empirically that our approach outperforms the existing methods. Finally, in the last part, we extend the work from the third part by applying the presented models to enhance classification tasks from the second part, commonly containing a severe class imbalance. We introduce the multi-input architecture to expand models alongside our previously proposed multi-output architecture. We compare three techniques to sample from deep generative models defining a transparent and fair large-scale experimental protocol and interesting visual analysis tools. We showed that general machine learning detection and visualization techniques could help address the fraud detection domain's many challenges. In particular, deep generative models can add value to the classification task given the imbalanced nature of the fraudulent class, in exchange for implementation and time complexity. Future and promising applications for deep generative models include missing data imputation and sharing synthetic data or data generators preserving privacy constraints.
Cüneyt Gürcan Akçora, Yitao Li, Yulia R. Gel, Murat Kantarcıoğlu
Recent proliferation of cryptocurrencies that allow for pseudo-anonymous transactions has resulted in a spike of various e-crime activities and, particularly, cryptocurrency payments in hacking attacks demanding ransom by encrypting sensitive user data. Currently, most hackers use Bitcoin for payments, and existing ransomware detection tools depend only on a couple of heuristics and/or tedious data gathering steps. By capitalizing on the recent advances in Topological Data Analysis, we propose a novel efficient and tractable framework to automatically predict new ransomware transactions in a ransomware family, given only limited records of past transactions. Moreover, our new methodology exhibits high utility to detect emergence of new ransomware families, that is, detecting ransomware with no past records of transactions.
Joana Lorenz, Maria Inês Silva, David Aparício, João Tiago Ascensão · 5 authors
Every year, criminals launder billions of dollars acquired from serious felonies (e.g., terrorism, drug smuggling, or human trafficking), harming countless people and economies. Cryptocurrencies, in particular, have developed as a haven for money laundering activity. Machine Learning can be used to detect these illicit patterns. However, labels are so scarce that traditional supervised algorithms are inapplicable. Here, we address money laundering detection assuming minimal access to labels. First, we show that existing state-of-the-art solutions using unsupervised anomaly detection methods are inadequate to detect the illicit patterns in a real Bitcoin transaction dataset. Then, we show that our proposed active learning solution is capable of matching the performance of a fully supervised baseline by using just 5% of the labels. This solution mimics a typical real-life situation in which a limited number of labels can be acquired through manual annotation by experts.