A mempool is a security-critical subsystem in a public blockchain. Recent mempool attacks, notably asymmetric DoS, have shown their ability to severely damage the Ethereum network. This paper tackles the open research problem of designing principled and non-intrusive defenses against asymmetric mempool DoSes with provable security. It presents the first mempool economic-security definitions based on mempool-observable conditions. It then presents SAFERAD, a framework of secure mempool designs with provable security against asymmetric DoSes. To defend against dual attacks by evicting and locking a victim mempool, SAFERAD adopts a non-trivial design of enforcing an upper bound of the attack damage under the locking attacks and a lower bound of the attack cost under the eviction attacks. With a prototype implementation on Geth and evaluation under real transaction traces, the results show SAFERAD has low overhead in latency and block revenue, implying non-intrusiveness and practicality.
Anomaly detection in the financial system has been studied for decades. Anomalies refer to irregular items or events that are different from the majority. Therefore, illegal activities are anomalous by nature because it is opposed to the norm. Preventive actions like anomalous detection play an important role in avoiding incidents that damage people's property. In this paper, the Bitcoin network is the subject of the study. We consider the effectiveness of two unsupervised learning algorithms, Histogram-based Outlier Score (HBOS) and Isolation Forest, for detecting anomalous transactions and wallet addresses. Providing insights into the strengths and weaknesses of HBOS and Isolation Forest for anomaly detection. We also analyze which features are the most important for each algorithm in identifying anomalies. The result shows similar detection for both algorithms. While HBOS has higher wallet visualization score at 0.423, Isolation Forest yields better scores on transaction visualization, dual, and known-thieves evaluations with score of 0.713, 0.681, and 0.035, respectively.
Jesús Rosa-Bilbao, Juan Boubeta-Puig, Jesús Lagares-Galán, Mark Vella
Blockchain is a relatively recent technology that provides immutability, traceability and transparency of information, thus building trust in the digital society. Blockchain networks generate a large amount of logs which capture and describe data flowing through the network in the form of transactions, blocks and events. Monitoring these blockchain data from the off-chain world is needed to detect anomalies with the aim of mitigating the risks that may arise as a result of using blockchain technology. However, the real-time monitoring of these logs by off-chain systems has become a challenge from the beginning of 2018 when the blockchain networks reached a high number of daily transactions. In this paper, we propose a portable, maintainable and easily configurable architecture integrating blockchain and complex event processing technologies that allows for both the real-time monitoring of logs generated in Ethereum Virtual Machine (EVM)-compatible blockchain networks and the automatic detection of anomalies in these networks by matching event patterns. This architecture was tested by using vast amounts of blockchain data already publicly registered in Ethereum and Polygon networks. The results demonstrate that the proposed architecture is able to automatically detect anomalies which occur in different blockchain networks, making analytics of blockchain data possible by off-chain systems.
H S Byun, Jueun Kim, Yun-Seok Jeong, Byoungjin Seok · 6 authors
Currently, the monetary value of cryptocurrencies is extremely high, leading to frequent theft attempts. Cyberattacks targeting cryptocurrency wallets and the scale of these attacks are also increasing annually. However, many studies focus on large-scale exchanges, leading to a lack of research on cryptocurrency wallet security. Nevertheless, the threat to individual wallets is real and can lead to severe consequences for individuals. In this paper, we analyze the security of the open-source cryptocurrency wallets Sparrow, Etherwall, and Bither against brute-force attacks, a fundamental threat in password-based systems. As cryptocurrency wallets use passwords to manage users’ private keys, we analyzed the private key management mechanism and implemented a password verification oracle. We used this oracle for brute-force attacks. We identified the private key management mechanism by conducting a code-level investigation and evaluated the three wallets’ security through practical experimentation. The experiment results revealed that the wallets’ security, which depends on passwords, could be diminished due to the password input space and the configuration of password length settings. We propose a general methodology for analyzing the security of desktop cryptocurrency wallets against brute-force attacks and provide practical guidelines for designing secure wallets. By using the analysis methods suggested in this paper, one can evaluate the security of wallets.
Chuyi Yan, Xueying Han, Yan Zhu, Dan Du · 6 authors
Abstract Despite the growing attention on blockchain, phishing activities have surged, particularly on newly established chains. Acknowledging the challenge of limited intelligence in the early stages of new chains, we propose ADA-Spear-an automatic phishing detection model utilizing a dversarial d omain a daptive learning which symbolizes the method’s ability to penetrate various heterogeneous blockchains for phishing detection. The model effectively identifies phishing behavior in new chains with limited reliable labels, addressing challenges such as significant distribution drift, low attribute overlap, and limited inter-chain connections. Our approach includes a subgraph construction strategy to align heterogeneous chains, a layered deep learning encoder capturing both temporal and spatial information, and integrated adversarial domain adaptive learning in end-to-end model training. Validation in Ethereum, Bitcoin, and EOSIO environments demonstrates ADA-Spear’s effectiveness, achieving an average F1 score of 77.41 on new chains after knowledge transfer, surpassing existing detection methods.
Federated Learning (FL) was first introduced as an idea by Google in 2016, in which multiple devices jointly train a machine learning model without sharing their data under the supervision of a central server. This offers big opportunities in critical areas like healthcare, industry, and finance, where sharing information with other organizations’ devices is completely prohibited. The combination of Federated Learning with Blockchain technology has led to the so-called Blockchain Federated learning (B.F.L.) which operates in a distributed manner and offers enhanced trust, improved security and privacy, improved traceability and immutability and at the same time enables dataset monetization through tokenization. Unfortunately, vulnerabilities of the blockchain-based solutions have been identified while the implementation of blockchain introduces significant energy consumption issues. There are many solutions that also offer personalized ideas and uses. In the field of security, solutions such as security against model-poisoning backdoor assaults with poles and modified algorithms are proposed. Defense systems that identify hostile devices, Against Phishing and other social engineering attack mechanisms that could threaten current security systems after careful comparison of mutual systems. In a federated learning system built on blockchain, the design of reward mechanisms plays a crucial role in incentivizing active participation. We can use tokens for rewards or other cryptocurrency methods for rewards to a federated learning system. Smart Contracts combined with proof of stake with performance-based rewards or (and) value of data contribution. Some of them use games or game theory-inspired mechanisms with unlimited uses even in other applications like games. All of the above is useless if the energy consumption exceeds the cost of implementing a system. Thus, all of the above is combined with algorithms that make simple or more complex hardware and software adjustments. Heterogeneous data fusion methods, energy consumption models, bandwidth, and controls transmission power try to solve the optimization problems to reduce energy consumption, including communication and compute energy. New technologies such as quantum computing with its advantages such as speed and the ability to solve problems that classical computers cannot solve, their multidimensional nature, analyze large data sets more efficiently than classical artificial intelligence counterparts and the later maturity of a technology that is now expensive will provide solutions in areas such as cryptography, security and why not in energy autonomy. The human brain and an emerging technology can provide solutions to all of the above solutions due to the brain's decentralized nature, built-in reward mechanism, negligible energy use, and really high processing power In this paper we attempt to survey the currently identified threats, attacks and defenses, the rewards and the energy efficiency issues of BFL in order to guide the researchers and the designers of FL based solution to adopt the most appropriate of each application approach.
S. B. Goyal, Anand Singh Rajawat, Ritu Shandilya, Varun Malik
Industrial Internet of Things (IIoT) solutions have transformed industrial productivity and operations. The incorporation of Ethereum blockchain technology into IIoT creates new weaknesses, exposing industrial systems to several cyberattacks. An unique IIoT framework mitigates Ethereum-based attacks in industrial applications to solve these vulnerabilities. This system uses supervised learning and quantum classifiers to detect and fix fraudulent Ethereum transaction patterns in real time. Our methodology has lower false positive rates and higher detection accuracy than conventional methods, according to first trials. This study shows that quantum computing and machine learning (ML) can improve the security of Ethereum-enabled IIoT devices in industry.
A Multi-Controller Software-Defined Network (MC-SDN) is a revolutionary concept comprising multiple controllers and switches separated using programmable features, enhancing network availability, management, scalability, and performance. The MC-SDN is a potential choice for managing large, heterogeneous, complex industrial networks. Despite the rich operational flexibility of MC-SDN, it is imperative to protect the network deployment with proper protection against potential vulnerabilities that lead to misuse and malicious activities on the MC-SDN structure. The security holes in the MC-SDN structure significantly impact network survivability and performance efficiency. Hence, detecting MC-SDN security attacks is crucial to improving network performance. Accordingly, this work intended to design blockchain-based controller security (BCS) that exploits the advantages of immutable and distributed ledger technology among multiple controllers and securely manages the controller communications against various attacks. Thereby, it enables the controllers to maintain consistent network view and accurate flow tables among themselves and also neglects the controller failure issues. Finally, the experimental results of the proposed BCS approach demonstrated superior performance under various scenarios, such as attack detection, number of attackers, number of controllers, and number of compromised controllers, by applying different performance metrics.
Against the backdrop of rapidly advancing cloud storage technology, as well as 5G and 6G communication technologies, group key management faces increasingly daunting challenges. Traditional key management encounters difficulties in key distribution, security threats, management complexity, and issues of trustworthiness. Particularly in scenarios with a large number of members or frequent member turnover within groups, this may lead to security vulnerabilities such as permission confusion, exacerbating the security risks and management complexity faced by the system. To address these issues, this paper utilizes blockchain technology to achieve distributed storage and management of group keys. This solution combines key management with the distributed characteristics of blockchain, enhancing scalability, and enabling tracking of malicious members. Simultaneously, by integrating intelligent authentication mechanisms and lightweight data update mechanisms, it effectively enhances the security, trustworthiness, and scalability of the key management system. This provides important technical support for constructing a more secure and reliable network environment.
The integration of secure message authentication systems within the Industrial Internet of Things (IIoT) is paramount for safeguarding sensitive transactions. This paper introduces a Lightweight Blockchain-based Message Authentication System, utilizing k-means clustering and isolation forest machine learning techniques. With a focus on the Bitcoin Transaction Network (BTN) as a reference, this study aims to identify anomalies in IIoT transactions and achieve a high level of accuracy. The feature selection coupled with isolation forest achieved a remarkable accuracy of 92.90%. However, the trade-off between precision and recall highlights the ongoing challenge of minimizing false positives while capturing a broad spectrum of potential threats. The system successfully detected 429,713 anomalies, paving the way for deeper exploration into the characteristics of IIoT security threats. The study concludes with a discussion on the limitations and future directions, emphasizing the need for continuous refinement and adaptation to the dynamic landscape of IIoT transactions. The findings contribute to advancing the understanding of securing IIoT environments and provide a foundation for future research in enhancing anomaly detection mechanisms.
The rapid evolution of ransomware attacks necessitates robust and scalable detection mechanisms to safeguard digital assets. This study leverages the Bitcoin Ransomware Dataset, comprising 2,916,697 transactions, to evaluate the effectiveness of the Random Forest algorithm in classifying ransomware-related activities. Through comprehensive preprocessing, including feature encoding and standardization, and exploratory data analysis (EDA), the dataset is prepared for modeling. The Random Forest model achieves an overall accuracy of 99%, demonstrating exceptional performance in identifying the majority class. However, challenges persist in classifying minority classes, highlighting the impact of class imbalance. Feature importance analysis reveals that attributes such as income, weight, and length play pivotal roles in the classification process. The study underscores the potential of Random Forest for ransomware detection while emphasizing the need for advanced techniques to address class imbalance and improve minority class performance.
The openness and transparency of Ethereum transaction data make it easy to be exploited by any entities, executing malicious attacks. The sandwich attack manipulates the Automated Market Maker (AMM) mechanism, profiting from manipulating the market price through front or after-running transactions. To identify and prevent sandwich attacks, we propose a cascade classification framework GasTrace. GasTrace analyzes various transaction features to detect malicious accounts, notably through the analysis and modeling of Gas features. In the initial classification, we utilize the Support Vector Machine (SVM) with the Radial Basis Function (RBF) kernel to generate the predicted probabilities of accounts, further constructing a detailed transaction network. Subsequently, the behavior features are captured by the Graph Attention Network (GAT) technique in the second classification. Through cascade classification, GasTrace can analyze and classify the sandwich attacks. Our experimental results demonstrate that GasTrace achieves a remarkable detection and generation capability, performing an accuracy of 96.73% and an F1 score of 95.71% for identifying sandwich attack accounts.
The rise of cryptocurrencies has created new avenues for criminal money exchanges. Among various techniques, Bitcoin address clustering plays a crucial role in detecting and grouping addresses owned by the same entity. This fundamental step is essential for deanonymizing addresses and analyzing the flow of funds in the blockchain. This advancement contributes to the battle against illicit commerce, money laundering, fraud, scams, and similar activities. In this paper, we introduce two new heuristics, NSS and PEKET. NSS leverages Bitcoin non-standard scripts, while PEKET exploits the re-use of public keys to establish connections controlled by the same entity. Our contributions encompass (i) the detailed explanation of these two novel methods; (ii) the open-source publication of the tools we developed; and, (iii) the assessment of these heuristics using a proprietary extensive dataset of labeled addresses, which achieve precision levels of 1.0 and 0.979 respectively.
The role played by email communication in our lives nowadays has been such a tremendous one especially when it comes to fast exchange of information. Nevertheless, this convenience is marred by the omnipresent threat of email spam that not only disrupts channels of communication but also present serious security and privacy concerns. Traditional models of spam detection which are based on rules or heuristics tend to fail because they do not adapt quickly enough to the new techniques employed by spammers. In response to these challenges, this paper proposes an inventive solution to the problem—integration of blockchain technology into the process of detecting email spams.Email spam is often defined as an unwanted and usually malicious form of correspondence, thus it has continued being a notable cyber security worry. The conventional mechanisms for discovering them are prone to false positives and negatives at times. Additionally, such systems have centralized data which can be interfered with and accessed without permission. Weighing up the limitations inherent in existing methods, this research examines how blockchain may change email spam detection. Keywords— Blockchain technology, ethereum, Spam, email
Abstract: In the ever-evolving landscape of distributed systems, ensuring safety, efficiency, and scalability remains a paramount challenge. BlockEdge emerges as a pioneering framework designed to address these critical issues by leveraging the principles of blockchain technology and advanced consensus mechanisms. This abstract outlines the key features, innovations, and potential impacts of BlockEdge on the realm of distributed computing. BlockEdge integrates blockchain's immutable ledger properties with a novel consensus algorithm tailored for distributed systems. Unlike traditional blockchain applications that prioritize decentralization for financial transactions, BlockEdge focuses on enhancing the performance and reliability of distributed applications. The framework employs a hybrid consensus model that combines Byzantine Fault Tolerance (BFT) with Proof-of-Stake (PoS), optimizing both security and energy efficiency. A standout feature of BlockEdge is its modular architecture, which allows seamless interoperability between different types of distributed networks. This modularity facilitates the integration of various consensus protocols, catering to the specific needs of diverse applications, from IoT networks to large-scale data processing systems. By enabling secure and efficient cross-chain communication, BlockEdge effectively mitigates the silo effect prevalent in current distributed system designs.
Abstract This paper introduces a novel integrated hybrid malware attack detection algorithm, focusing on enhancing cybersecurity within blockchain systems by addressing the prevalent challenges of Byzantine fault tolerance, Reentrancy, and DDOS attacks. The significance of this research lies in its contribution to safeguarding blockchain technology, a cornerstone for secure, decentralized digital transactions, against sophisticated malware threats. Current cybersecurity solutions frequently fall short of offering a complete defense mechanism, making it difficult to effectively combat a variety of dynamic malware attacks at the same time. Thus, the main objective of this research is to provide a hybrid framework that combines DDOS attack prevention, reentrancy attack detection, and Byzantine fault tolerance detection into a single, cohesive architecture. The proposed hybrid framework encompasses a detailed algorithmic approach integrating SHA-256 and DSA to analyze the aforementioned three malware attacks. A hybrid model combining these algorithms, implemented in one block, has been developed to mitigate malicious activity. These measures aim to improve computational complexity and expedite execution within the network of nodes. To test the efficacy of the proposed framework, the approach is tested on the NSL-KDD dataset to analyze the malicious activities. The performance analysis of the proposed frameworks presents a recall and F1 score of 73 and .68 respectively. Furthermore, for efficient mitigation, the time and space complexity analysis is performed on proposed algorithms for attack analysis, which resulted in a combination of constant and linear time complexity operations. The findings reveal that the proposed algorithm successfully identifies and mitigates the targeted malware attacks and maintains optimal performance in terms of time and space complexity. Specifically, the algorithm showcases linear and constant time complexities across different attack vectors, ensuring swift and scalable defense capabilities. This research’s contribution to the cybersecurity field is significant, offering a robust, scalable solution that enhances the resilience of blockchain networks against a broad spectrum of malware attacks.
Ethereum has become one of the primary global platforms for cryptocurrency, playing an important role in promoting the diversification of the financial ecosystem. However, the relative lag in regulation has led to a proliferation of malicious activities in Ethereum, posing a serious threat to fund security. Existing regulatory methods usually detect malicious accounts through feature engineering or large-scale transaction graph mining. However, due to the immense scale of transaction data and malicious attacks, these methods suffer from inefficiency and low robustness during data processing and anomaly detection. In this regard, we propose an Ethereum Transaction Graph Compression method named TGC4Eth, which assists malicious account detection by lightweighting both features and topology of the transaction graph. At the feature level, we select transaction features based on their low importance to improve the robustness of the subsequent detection models against feature evasion attacks; at the topology level, we employ focusing and coarsening processes to compress the structure of the transaction graph, thereby improving both data processing and inference efficiency of detection models. Extensive experiments demonstrate that TGC4Eth significantly improves the computational efficiency of existing detection models while preserving the connectivity of the transaction graph. Furthermore, TGC4Eth enables existing detection models to maintain stable performance and exhibit high robustness against feature evasion attacks.
(Distributed) Denial-of-Service (DoS/DDoS) attacks are among the most dangerous cybersecurity threats to computer networks. Lately, blockchain and artificial intelligence (AI) cyberdefense applications have successfully been implemented to identify attack patterns. This paper proposes a novel collaborative, blockchain-based multi-agent reinforcement learning (RL) cyberdefense method using smart contracts. Initial numerical experiments have shown that the agents quickly learn to predict attacks, which can lead to mitigating network-wide service disruptions.
Aulia Arif Wardana, Grzegorz Kołaczek, Parman Sukarno
This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.
Kithmini Godewatte Arachchige, Philip Branch, Jason But
The Internet of Things (IoT) and blockchain are emerging technologies that have attracted attention in many industries, including healthcare, automotive, and supply chain. IoT networks and devices are typically low-powered and susceptible to cyber intrusions. However, blockchains hold considerable potential for securing low-power IoT networks. Blockchain networks provide security features such as encryption, decentralisation, time stamps, and ledger functions. The integration of blockchain and IoT technologies may address many of the security concerns. However, integrating blockchain with IoT raises several issues, including the security vulnerabilities and anomalies of blockchain-based IoT networks. In this paper, we report on our experiments using our blockchain test bed to demonstrate that blockchains on IoT platforms are vulnerable to DDoS attacks, which can also potentially lead to device hardware failures. We show that a number of anomalies are visible during either a DDoS attack or IoT device failure. In particular, the temperature of IoT hardware devices can exceed 90 °C during a DDoS attack, which could lead to hardware failure and potential fire hazards. We also found that the Block Transaction Rate (BTR) and network block loss percentage can increase due to corrupted hardware, with the BTR dropping to nearly zero blocks/sec and a block loss percentage of over 50 percent for all evaluated blockchains, and as high as 81.3 percent in one case. Our experiments demonstrate that anomalous temperature, latency, bandwidth, BTR, and network block loss percentage can potentially be used to identify DDoS attacks.
The Internet of Things (IoT) refers to a complex network comprising interconnected devices that transmit their data via the Internet. Due to their open environment, limited computation power, and absence of built-in security, IoT environments are susceptible to various cyberattacks. Denial of service (DDoS) attacks are among the most destructive types of threats. The Multi-vector DDoS attack is a contemporary and formidable form of DDoS wherein the attacker employs a collection of compromised IoT devices as zombies to initiate numerous DDoS attacks against a target server. A Blockchain-based Operational Threat Intelligence framework, OTI-IoT, is proposed in this article to counter multi-vector DDoS attacks in IoT networks. A “Prevent-then-Detect” methodology was utilized to deploy the OTI-IoT framework in two distinct stages. During Phase 1, the consortium Blockchain network validators employ the IPS module, composed of a smart contract for attack prevention and access control, and Proof of Voting consensus, to thwart attacks. Validators are outfitted with deep learning-based IDS instances to detect multi-vector DDoS attacks during Phase 2. Alert messages are generated by the IDS module’s alert generation and propagation smart contract in response to identifying malicious IoT sources. The feedback loop from the IDS module to the IPS module prevents incoming traffic from malicious sources. The proposed OTI framework capabilities are realized as an outcome of combining and storing the outcomes of the IDS and IPS modules on the consortium Blockchain. Each validator maintains a shared ledger containing information regarding threat sources to ensure robust security, transparency, and integrity. The operational execution of OTI-IoT occurs on an individual Ethereum Blockchain. The empirical findings indicate that our proposed framework is most suitable for real-time applications due to its ability to lower attack detection time, decreased block validation time, and higher attack prevention rate.
Cooperation among telecom carriers and datacenter (DC) providers (DCPs) is essential to ensure resiliency of network-cloud ecosystems. To enable efficient cooperative recovery in case of resource crunch, e.g., due to traffic congestion or network failures, we previously studied several frameworks for cooperative recovery among different stakeholders (e.g., telecom carriers and DCPs). Now, we introduce a novel Multi-entity Cooperation Platform (MCP) for implementing cooperative recovery planning, to achieve efficient use of carriers' valuable optical-network resources during recovery. We adopt a Distributed Ledger Technology (DLT) that ensures decentralized and tamper-proof information exchange among stakeholders to achieve open and fair cooperation. To support diverse types of cooperation, we develop a state machine representing the MCP operation and define state transitions associated to stakeholders' cooperation within the state machine. Moreover, we propose a signaling system in MCP to ensure simple and reliable state transitions for stakeholders during the cooperative recovery planning in large ecosystems. We experimentally demonstrate a proof-of-concept DLT-based MCP on a testbed. We showcase a DCP-carrier cooperative planning process, showing the flexibility of the proposed MCP to support diverse types of cooperation.
In recent years, smart contracts have risen rapidly in the blockchain field, but security issues have also become increasingly prominent. Due to the lack of unified evaluation standards, the security analysis of smart contracts mainly relies on complex and not easily scalable expert rules. To address these issues, we employ slicing techniques to reduce the interference of extraneous code on the detection process, apply normalisation techniques to eliminate the differences between different compiler versions and use particle swarm optimisation algorithms to determine the similarity between contracts, thus improving the accuracy and efficiency of detection. In addition, we combine a variety of features such as static analysis, dynamic analysis and symbolic execution to gain a more comprehensive understanding of contract characteristics and behaviours for more accurate vulnerability identification. Experimental results show that the scheme significantly improves the detection capability and provides a new solution for the security detection of smart contracts.