The increasing complexity of data management systems, coupled with the evolving nature of cybersecurity threats, necessitates innovative approaches to ensure data integrity, confidentiality, and availability. This paper explores recent studies on advanced data management strategies and their intersection with cybersecurity practices. Key insights are drawn from the latest research on topics such as distributed ledger technologies, artificial intelligence-driven threat detection, and privacy-preserving data management frameworks. The analysis highlights how these emerging technologies are reshaping the landscape of data management while addressing cybersecurity challenges. Additionally, this paper examines the role of regulation and policy in fostering secure data ecosystems. The findings offer a comprehensive overview of current trends, challenges, and opportunities in the field, with recommendations for future research directions.
Mingyi Liu, Jun Ho Huh, HyungSeok Han, Jaehyuk Lee · 8 authors
Decentralized Finance (DeFi) offers a whole new investment experience and has quickly emerged as an enticing alternative to Centralized Finance (CeFi). Rapidly growing market size and active users, however, have also made DeFi a lucrative target for scams and hacks, with 1.95 billion USD lost in 2023. Unfortunately, no prior research thoroughly investigates DeFi users' security risk awareness levels and the adequacy of their risk mitigation strategies. Based on a semi-structured interview study (N = 14) and a follow-up survey (N = 493), this paper investigates DeFi users' security perceptions and commonly adopted practices, and how those affected by previous scams or hacks (DeFi victims) respond and try to recover their losses. Our analysis shows that users often prefer DeFi over CeFi due to their decentralized nature and strong profitability. Despite being aware that DeFi, compared to CeFi, is prone to more severe attacks, users are willing to take those risks to explore new investment opportunities. Worryingly, most victims do not learn from previous experiences; unlike victims studied through traditional systems, DeFi victims tend to find new services, without revising their security practices, to recover their losses quickly. The abundance of various DeFi services and opportunities allows victims to continuously explore new financial opportunities, and this reality seems to cloud their security priorities. Indeed, our results indicate that DeFi users' strong financial motivations outweigh their security concerns - much like those who are addicted to gambling. Our observations about victims' post-incident behaviors suggest that stronger control in the form of industry regulations would be necessary to protect DeFi users from future breaches.
BACKGROUND: Telehealth played a critical role during the COVID-19 pandemic and continues to function as an essential component of health care. Existing platforms cannot ensure privacy and prevent cyberattacks. OBJECTIVE: The main objectives of this study are to understand existing cybersecurity issues in identity management and trustworthy communication processes in telehealth platforms and to design a software architecture integrated with blockchain to improve security and trustworthiness with acceptable performance. METHODS: We improved personal information security in existing telehealth platforms by adopting an innovative interdisciplinary approach combining design science, social science, and computer science in the health care domain, with prototype implementation. We used the design science research methodology to implement our overall design. We innovated over existing telehealth platforms with blockchain integration that improves health care delivery services in terms of security, privacy, and efficiency. We adopted a user-centric design approach and started with user requirement collection, followed by system functionality development. Overall system implementation facilitates user requirements, thus promoting user behavior for the adoption of the telehealth platform with decentralized identity management and an access control mechanism. RESULTS: Our investigation identified key challenges to identity management and trustworthy communication processes in telehealth platforms used in the current health care domain. By adopting distributed ledger technology, we proposed a decentralized telehealth platform to support identity management and a trustworthy communication process. Our design and prototype implementation using a smart contract-driven telehealth platform to provide decentralized identity management and trustworthy communication with token-based access control addressed several security challenges. This was substantiated by testing with 10,000 simulated transactions across 5 peers in the Rahasak blockchain network. The proposed design provides resistance to common attacks while maintaining a linear time overhead, demonstrating improved security and efficiency in telehealth services. We evaluated the performance in terms of transaction throughput, smart contract execution time, and block generation time. To create a block with 10,000 transactions, it takes 8 seconds on average, which is an acceptable overhead for blockchain-based applications. CONCLUSIONS: We identified technical limitations in current telehealth platforms. We presented several design innovations using blockchain to prototype a system. We also presented the implementation details of a unique distributed architecture for a trustworthy communication system. We illustrated how this design can overcome privacy, security, and scalability limitations. Moreover, we illustrated how improving these factors sets the stage for improving and standardizing the application and for the wide adoption of blockchain-enabled telehealth platforms.
This study investigates the human errors that enable hackers to exploit and carry out social engineering attacks on the non-fungible token (NFT) ecosystem. The aim is to improve the design of decentralized applications that use NFTs to help non-technical users follow security best practices and address remaining user-side vulnerabilities. The study methods included a survey examining participants’ expertise regarding NFTs and cybersecurity, a remote security usability study investigating the pain points and common security best practices and a follow-up interview to examine participants’ experience with a crypto wallet configuration. The results show how human cognitive bias affects users’ decision to be cautious, users’ difficulty with security methods, and improvements to lessen users’ cognitive load. As NFTs expand beyond the cryptocurrency circle, multiple scams and thefts arise due to late adopters not knowing the security best practices. Therefore, increasing the public’s NFT security awareness is key to mitigating potential threats.
With the increasingly widespread application of machine learning, how to strike a balance between protecting the privacy of data and algorithm parameters and ensuring the verifiability of machine learning has always been a challenge. This study explores the intersection of reinforcement learning and data privacy, specifically addressing the Multi-Armed Bandit (MAB) problem with the Upper Confidence Bound (UCB) algorithm. We introduce zkUCB, an innovative algorithm that employs the Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARKs) to enhance UCB. zkUCB is carefully designed to safeguard the confidentiality of training data and algorithmic parameters, ensuring transparent UCB decision-making. Experiments highlight zkUCB's superior performance, attributing its enhanced reward to judicious quantization bit usage that reduces information entropy in the decision-making process. zkUCB's proof size and verification time scale linearly with the execution steps of zkUCB. This showcases zkUCB's adept balance between data security and operational efficiency. This approach contributes significantly to the ongoing discourse on reinforcing data privacy in complex decision-making processes, offering a promising solution for privacy-sensitive applications.
Decentralized Finance (DeFi) enables many novel applications that were impossible in traditional finances. However, it also introduces new types of vulnerabilities. An example of such vulnerabilities is a composability bug between token contracts and Decentralized Exchange (DEX) that follows the Constant Product Market Maker (CPMM) model. This type of bug, which we refer to as CPMM composability bug, originates from issues in token contracts that make them incompatible with CPMMs, thereby endangering other tokens within the CPMM ecosystem. Since 2022, 23 exploits of such kind have resulted in a total loss of 2.2M USD. BlockSec, a smart contract auditing company, reported that 138 exploits of such kind occurred just in February 2023. In this paper, we propose CPMMX , a tool that automatically detects CPMM composability bugs across entire blockchains. To achieve such scalability, we first formalized CPMM composability bugs and found that these bugs can be induced by breaking two safety invariants. Based on this finding, we designed CPMMX equipped with a two-step approach, called shallow-then-deep search. In more detail, it first uses shallow search to find transactions that break the invariants. Then, it uses deep search to refine these transactions, making them profitable for the attacker. We evaluated CPMMX against five baselines on two public datasets and one synthetic dataset. In our evaluation, CPMMX detected 2.5x to 1.5x more vulnerabilities compared to baseline methods. It also analyzed contracts significantly faster, achieving higher F1 scores than the baselines. Additionally, we applied CPMMX to all contracts on the latest blocks of the Ethereum and Binance networks and discovered 26 new exploits that can result in 15.7K USD profit in total.
Reentrancy, a notorious vulnerability in smart contracts, has led to millions of dollars in financial loss. However, current smart contract vulnerability detection tools suffer from a high false positive rate in identifying contracts with reentrancy vulnerabilities. Moreover, only a small portion of the detected reentrant contracts can actually be exploited by hackers, making these tools less effective in securing the Ethereum ecosystem in practice. In this paper, we propose BlockWatchdog, a tool that focuses on detecting reentrancy vulnerabilities by identifying attacker contracts. These attacker contracts are deployed by hackers to exploit vulnerable contracts automatically. By focusing on attacker contracts, BlockWatchdog effectively detects truly exploitable reentrancy vulnerabilities by identifying reentrant call flow. Additionally, BlockWatchdog is capable of detecting new types of reentrancy vulnerabilities caused by poor designs when using ERC tokens or user-defined interfaces, which cannot be detected by current rule-based tools. We implement BlockWatchdog using cross-contract static dataflow techniques based on attack logic obtained from an empirical study that analyzes attacker contracts from 281 attack incidents. BlockWatchdog is evaluated on 421,889 Ethereum contract bytecodes and identifies 113 attacker contracts that target 159 victim contracts, leading to the theft of Ether and tokens valued at approximately 908.6 million USD. Notably, only 18 of the identified 159 victim contracts can be reported by current reentrancy detection tools.
Kainat Ansar, Mansoor Ahmed, Saif Ur Rehman Malik, Markus Helfert · 5 authors
Context Data breaches caused by insiders are on the rise, both in terms of frequency and financial impact on organizations. Insider threat originates from within the targeted organization and users with authorized access to an organization’s network, applications, or databases commit insider attacks. Motivation Insider attacks are difficult to detect because an attacker with administrator capabilities can change logs and login records to destroy the evidence of the attack. Moreover, when such a harmful insider attack goes undetected for months, it can do a lot of damage. Such data breaches may significantly impact the affected data owner’s life. Developing a system for rapidly detecting data breaches is still critical and challenging. General Data Protection Regulation (GDPR) has defined the procedures and policies to mitigate the problems of data protection. Therefore, under the GDPR implementation, the data controller must notify the data protection authority when a data breach has occurred. Problem Statement Existing data breach detection mechanisms rely on a reliable third party. Because of the presence of a third party, such systems are not trustworthy, transparent, secure, immutable, and GDPR-compliant. Contributions To overcome these issues, this study proposed a GDPR-compliant data breach detection system by leveraging the benefits of blockchain technology. Smart contracts are written in Solidity and deployed on a local Ethereum test network to implement the solution. The proposed system can generate alert notifications against every data breach. Results We tested and deployed our proposed system, and the findings indicate that it can accomplish the insider threat mitigation objective. Furthermore, the GDPR compliance analysis of our system was also evaluated to make sure that it complies with the GDPR principles (such as right to be forgotten, access control, conditions for consent, and breach notifications). The conducted analysis has confirmed that the proposed system offers capabilities to comply with the GDPR from an application standpoint.
This paper investigates the integration of blockchain technology into core systems within institutions of higher education, utilizing the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework as a guiding framework. It supplies definitions of key terminology including blockchain, consensus mechanisms, decentralized identity, and smart contracts, and examines the application of secure blockchain across various educational functions such as enrollment management, degree auditing, and award processing. Each facet of the NIST Framework is utilized to explore the integration of blockchain technology and address persistent security concerns. The paper contributes to the literature by defining blockchain technology applications and opportunities within the education sector.
Stefanos Chaliasos, Jens Ernstberger, David Theodore, David A. Wong · 6 authors
Zero-knowledge proofs (ZKPs) have evolved from being a theoretical concept providing privacy and verifiability to having practical, real-world implementations, with SNARKs (Succinct Non-Interactive Argument of Knowledge) emerging as one of the most significant innovations. Prior work has mainly focused on designing more efficient SNARK systems and providing security proofs for them. Many think of SNARKs as "just math," implying that what is proven to be correct and secure is correct in practice. In contrast, this paper focuses on assessing end-to-end security properties of real-life SNARK implementations. We start by building foundations with a system model and by establishing threat models and defining adversarial roles for systems that use SNARKs. Our study encompasses an extensive analysis of 141 actual vulnerabilities in SNARK implementations, providing a detailed taxonomy to aid developers and security researchers in understanding the security threats in systems employing SNARKs. Finally, we evaluate existing defense mechanisms and offer recommendations for enhancing the security of SNARK-based systems, paving the way for more robust and reliable implementations in the future.
Cyber diplomacy is critical in dealing with the digital era's evolving cybersecurity dangers and possibilities.This article investigates the impact of Artificial Intelligence (AI), the Internet of Things (IoT), Blockchains, and Quantum Computing on cyber diplomacy.AI holds the potential for proactive threat identification and response, while IoT enables international information sharing.Blockchains enable secure data sharing and document verification, but they also pose new threats, such as AI-driven cyber-attacks, IoT privacy breaches, blockchain vulnerabilities, and the potential for quantum computing to break encryption.This article conducts case study reviews in combination with secondary data analysis and emphasises the value of international cooperation in developing global norms and frameworks to control responsible technology adoption.Cyber diplomacy can promote cybersecurity, protect national interests, and foster mutual trust among nations in the digital sphere by capitalising on possibilities and reducing threats.
Purpose This paper aims to investigate optimal anti-counterfeiting strategies for non-fungible token (NFT) platforms in decentralized digital marketplaces. Using a game-theoretic model, it analyzes how verification policies shape interactions among platforms, genuine creators, counterfeiters and consumers. Addressing a theoretical gap, the study models the incentives and trade-offs platforms face when deciding whether and how much to verify product authenticity. It evaluates the impact of these decisions on consumer surplus and creator welfare, providing insights for platform operators and regulators seeking to balance profitability, authenticity and stakeholder interests. Design/methodology/approach A game-theoretic model examines strategic interactions among NFT platforms, genuine creators, counterfeiters and consumers across varying verification levels. The model incorporates dual sales channels (authentic and dubious), platform commissions and consumer heterogeneity in quality preference. By solving for subgame perfect equilibria, the analysis reveals how verification intensity influences counterfeiter entry, pricing and welfare outcomes. Comparative statics and equilibrium analysis provide managerial implications. The framework highlights the trade-offs platforms face in balancing verification costs with consumer trust and marketplace efficiency. Findings The study reveals counterintuitive results. First, the relationship between verification intensity and counterfeiter entry is non-monotonic – moderate verification can increase counterfeit activity by softening price competition between the dual channels. Second, stronger verification may reduce consumer surplus as price increases outweigh trust benefits. Third, the optimal verification level depends on verification costs and commission structures. Moderate verification often emerges as optimal, while excessive verification can harm both consumers and genuine creators. Research limitations/implications This study contributes to the literature on digital platform governance and anti-counterfeiting by introducing a formal game-theoretic model tailored to decentralized NFT marketplaces. It advances understanding of how verification strategies influence market structure and welfare outcomes in environments with limited enforcement. The findings challenge conventional views that stronger verification always benefits consumers and sellers, revealing nuanced trade-offs in decentralized platforms. These insights provide a foundation for future research on optimal platform design and regulation in blockchain-enabled, trust-sensitive digital ecosystems. Practical implications This paper offers actionable guidance for NFT platform managers in designing effective anti-counterfeiting strategies. It reveals that moderate verification – rather than maximal enforcement – is often optimal, even without cost constraints, as excessive verification can unintentionally reduce consumer surplus and original creator welfare. The findings highlight the importance of aligning verification intensity with platform commission structures. Regulators are also advised to consider incentive-compatible policies that promote trust while preserving market participation. These insights support more balanced and efficient governance in decentralized digital marketplaces. Social implications This study highlights the broader societal impact of anti-counterfeiting strategies in decentralized digital economies. It shows that well-intentioned verification efforts may unintentionally harm consumers by increasing prices and limiting access to authentic digital goods. The findings call for a more nuanced understanding of how policy and platform design affect consumer welfare, creator livelihoods and digital trust. By emphasizing the trade-offs between authenticity and accessibility, the study informs policymakers and platform designers about the importance of inclusive, efficient verification mechanisms that protect stakeholders without stifling innovation or participation in the rapidly evolving NFT and blockchain ecosystems. Originality/value This study fills a theoretical gap by modeling decentralized NFT marketplaces with limited enforcement and uncertainty. It is among the first to analyze anti-counterfeiting strategies in this context, offering practical guidance for platform operators and regulators. The findings enrich digital platform governance literature by highlighting nuanced trade-offs in verification strategies.
Non-fungible tokens (NFTs) are unique tokens with various domains, e.g. real estate, metaverse, gaming and public auctions. However, when minted on public blockchains, the underlying blockchain transaction data can be publicly accessible. This instigated transaction data analysis for various purposes, including cryptocurrency price prediction and NFT market analysis. The public data may be considered privacy-sensitive which sets a barrier to the wider adoption of NFTs. In this work, we present that the analysis of the transaction events can describe activities in NFT applications by establishing connections between transactions and thereby, it can identify information that may be privacy-sensitive. This can be useful in developing suitable privacy-enhancing methods for NFTs. We collected transaction data from a blockchain-based game called Planet IX that was built on the Polygon blockchain and used graph visualisation to provide examples for constructed connections.
We explore how cybersecurity should be incorporated into corporate governance and develop a specific framework for implementing it. We consider different types of cybersecurity incidents, such as ransomware and data leaks, and their impacts on companies. We then discuss how cybersecurity situates in the current corporate governance theoretical framework. Based on the Resource Dependency Theory (RDT), we develop a specific governance framework with a focus on the role of chief cybersecurity officer, the audit committee, the regulatory powers, and market enforcement mechanisms. As more companies are becoming digital native and more services provided are digital in the Web3 space, this chapter is policy relevant as it provides a theoretical basis for implementing cybersecurity within companies in the digital space and a specific framework for the implementation.
Daniele Granata, Massimiliano Rak, Paolo Palmiero, Adele Pastena
Despite the growing role of information and communication technology (ICT) in public administration, paper ballots still dominate elections, especially in Italy. Electronic voting has had limited success worldwide, largely due to security and manipulation concerns. The COVID-19 pandemic has reignited interest in remote e-voting for safe participation while social distancing, though security remains a critical issue. Embracing electronic voting is essential to safeguard rights, improve resource efficiency, and promote digital citizenship. Accordingly, to address security concerns in e-voting, this research emphasizes the importance of security and legal measures. The study is based on ISO15408 (Common Criteria) certification process, a framework for independent security evaluations. The paper proposes a methodology that combines legal and technical requirements for e-voting security assessments, focusing on BPMN processes to model scenarios. The methodology has been applied to a common Ethereum smart contract, focusing on the e-voting process. A detailed analysis of a Solidity e-voting smart contract reveals its vulnerabilities and limitations. The research also produces a BPMN representation of an e-voting scenario, aligning logical behaviour with smart contract implementation. The aim is to bridge the gap between legal and technical aspects of e-voting, enhancing security and transparency.
Stephen Kirkman, Steven Fulton, Jeffrey Hemmes, Christopher Garcia · 5 authors
The motivation of this research (and also one of the nation’s cyber goals) is enhancing the resilience of Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA) systems against ransomware attacks. ICS and SCADA systems run some of the most important networks in the country: our critical infrastructure (i.e., water flow, power grids, etc.). Disruption of these systems causes confusion, panic, and in some cases loss of life. We propose a SCADA architecture that uses blockchain to help protect ICS data from ransomware. We focus on the historian. In a SCADA system, the historian collects events from devices in the control network for real-time and future analysis. We choose to use Ethereum and its Proof of Stake (PoS) consensus protocol. The other goal of this research focuses on the resilience of blockchain. There is very little research in protecting the blockchain itself. By performing encryption testing on an Ethereum private network, we explore how vulnerable blockchain is and discuss potential ways to make a blockchain client more resilient.
Jannik Lucas Sommer, Magnus Mølgaard Lund, Nicola Cibin, Michele Albano
The frequency of software supply chain attacks has reached unprecedented levels, primarily due to the increasing reliance on huge numbers of software and hardware dependencies, and the inherent vulnerabilities they harbor. Currently, vendors providing these software and hardware components share security advisories to centralized databases or post them on proprietary websites, which security engineers have to search manually to find vulnerabilities relevant for their systems. Furthermore, the security advisories often do not follow a standard machine-readable format, which results in the engineers having to manually analyze the documents. In this paper, SENTINEL, a novel solution for automating dissemination and discovery of security advisories leveraging Web3 technologies, is presented. In particular, the Ethereum blockchain is used by vendors to notify asset owners of novel vulnerabilities in their systems in a reliable and accountable manner. Evaluation tests conducted on the Ethereum Sepolia Testnet confirm that our proposal is a functional and functioning solution for securely disseminating and discovering security advisories utilizing a fully decentralized infrastructure. SENTINEL’s source code is released as open source software on GitHub.
Cyber threats and vulnerabilities present an increasing risk to the safe and frictionless execution of business operations. Bad actors ("hackers"), including state actors, are increasingly targeting the operational technologies (OTs) and industrial control systems (ICSs) used to protect critical national infrastructure (CNI). Minimisations of cyber risk, attack surfaces, data immutability, and interoperability of IoT are some of the main challenges of today's CNI. Cyber security risk assessment is one of the basic and most important activities to identify and quantify cyber security threats and vulnerabilities. This research presents a novel i-TRACE security-by-design CNI methodology that encompasses CNI key performance indicators (KPIs) and metrics to combat the growing vicarious nature of remote, well-planned, and well-executed cyber-attacks against CNI, as recently exemplified in the current Ukraine conflict (2014-present) on both sides. The proposed methodology offers a hybrid method that specifically identifies the steps required (typically undertaken by those responsible for detecting, deterring, and disrupting cyber attacks on CNI). Furthermore, we present a novel, advanced, and resilient approach that leverages digital twins and distributed ledger technologies for our chosen i-TRACE use cases of energy management and connected sites. The key steps required to achieve the desired level of interoperability and immutability of data are identified, thereby reducing the risk of CNI-specific cyber attacks and minimising the attack vectors and surfaces. Hence, this research aims to provide an extra level of safety for CNI and OT human operatives, i.e., those tasked with and responsible for detecting, deterring, disrupting, and mitigating these cyber-attacks. Our evaluations and comparisons clearly demonstrate that i-TRACE has significant intrinsic advantages compared to existing "state-of-the-art" mechanisms.
Open access
Smart Grid Security and Resilience
Information and Cyber Security
Infrastructure Resilience and Vulnerability Analysis
Qianrui Zhao, Yinan Wang, Bo Yang, Ke Shang · 8 authors
Cross-chain bridges are crucial mechanisms for facilitating interoperation between different blockchains, allowing the flow of assets and information across various chains. Their pivotal role and the vast value of assets they handle make them highly attractive to attackers. Major security incidents involving cross-chain bridge projects have been occurring frequently, resulting in losses of several billion due to cyber attacks. The diversity of vulnerability exploitation methods by hackers is vast, but not entirely untraceable. There are scarce research outcomes studying cross-chain bridge cyber incidents, and we have conducted a study based on the most recent cross-chain bridge security incidents. We introduce the working principles, components, and architecture of cross-chain bridges, explain the categorization mechanisms of the trust layer in cross-chain bridges, summarize four categories of hacker vulnerability exploitation techniques from real cases, and propose preventative measures for cross-chain bridge security.
Chelsea Medina, Lily Shaw, Dissy Vargas, Sundar Krishnan
This paper discusses the mechanisms of cryptocurrency, the idea of using security in the system, and the popularity of it. To begin, the authors provide a background on cryptocurrency and how it works. The authors understand that while most people may be familiar with the concept, they may not know how it works. Next, the authors discuss the security of cryptocurrency in-depth within the paper. The authors also provide examples of attacks on cryptocurrency systems to show the vulnerabilities within the system. Lastly, the authors discuss the popularity of the system to further express the need for security in cryptocurrency.
With the rapid development of information technologies, industrial Internet has become more open, and security issues have become more challenging. The endogenous security mechanism can achieve the autonomous immune mechanism without prior knowledge. However, endogenous security lacks a scientific and formal definition in industrial Internet. Therefore, firstly we give a formal definition of endogenous security in industrial Internet and propose a new industrial Internet endogenous security architecture with cost analysis. Secondly, the endogenous security innovation mechanism is clearly defined. Thirdly, an improved clone selection algorithm based on federated learning is proposed. Then, we analyze the threat model of the industrial Internet identity authentication scenario, and propose cross-domain authentication mechanism based on endogenous key and zero-knowledge proof. We conduct identity authentication experiments based on two types of blockchains and compare their experimental results. Based on the experimental analysis, Ethereum alliance blockchain can be used to provide the identity resolution services on the industrial Internet. Internet of Things Application (IOTA) public blockchain can be used for data aggregation analysis of Internet of Things (IoT) edge nodes. Finally, we propose three core challenges and solutions of endogenous security in industrial Internet and give future development directions.
Dhiah el Diehn I. Abou-Tair, Raad Haddad, Ala’ Khalifeh, Sahel Alouneh · 5 authors
Security and privacy are among the main challenges in the systems of systems. The distributed ledger technology and self-sovereign identity pave the way to empower systems and users' security and privacy. By utilizing both technologies, this paper proposes a distributed and self-sovereign-based framework for systems of systems to increase the security of such a system and maintain users' privacy. We conducted an extensive security analysis of the proposed framework using a threat model based on the STRIDE framework, highlighting the mitigation provided by the proposed framework compared to the traditional SoS security. The analysis shows the feasibility of the proposed framework, affirming its capability to establish a secure and privacy-preserving identity management system for systems of systems.
Context:Smart contracts are prone to numerous security threats due to undisclosed vulnerabilities and code weaknesses. In Ethereum smart contracts, the challenges of timely addressing these code weaknesses highlight the critical need for automated early prediction and prioritization during the code review process. Efficient prioritization is crucial for smart contract security. Objective:Toward this end, our research aims to provide an automated approach, PrAIoritize, for prioritizing and predicting critical code weaknesses in Ethereum smart contracts during the code review process. Method: To do so, we collected smart contract code reviews sourced from Open Source Software (OSS) on GitHub and the Common Vulnerabilities and Exposures (CVE) database. Subsequently, we developed PrAIoritize, an innovative automated prioritization approach. PrAIoritize integrates advanced Large Language Models (LLMs) with sophisticated natural language processing (NLP) techniques. PrAIoritize automates code review labeling by employing a domain-specific lexicon of smart contract weaknesses and their impacts. Following this, feature engineering is conducted for code reviews, and a pre-trained DistilBERT model is utilized for priority classification. Finally, the model is trained and evaluated using code reviews of smart contracts. Results: Our evaluation demonstrates significant improvement over state-of-the-art baselines and commonly used pre-trained models (e.g. T5) for similar classification tasks, with 4.82\%-27.94\% increase in F-measure, precision, and recall. Conclusion: By leveraging PrAIoritize, practitioners can efficiently prioritize smart contract code weaknesses, addressing critical code weaknesses promptly and reducing the time and effort required for manual triage.