Bitcoin is a decentralized network with pseudo-anonymous and immutable transactions, thus very attractive for cybercrime. For instance, it is abused to receive payments from victims and by malware developers for building their Command and Control (C[and]C) infrastructure. This dissertation presents novel techniques and tools for addressing three problems related to Bitcoin cybercrime: cybercrime attribution, estimating cybercriminal revenue, and automating the identification and classification of cryptocurrency addresses. First, we present back-and-forth exploration, a novel Bitcoin transaction tracing technique to identify cybercrime financial relationships. It provides two key contributions. First, it explores both forward and backward, enabling the discovery of relationships that cannot be found by only exploring forward. Second, it prevents exploration explosion by combining a tag database with a novel machine learning classifier that identifies exchange addresses. We implement back-and-forth exploration in WatchYourBack, an open-source Bitcoin analysis platform. We evaluate WatchYourBack on 30 malware families. We find new attribution points missed by forward-only explorations, uncover a wealth of services used by the malware, and identify previously unknown relationships between cybercriminals. Second, we perform the first systematic comparison of Bitcoin revenue estimation methodologies. We implement 15 estimation methodologies in WatchYourBack and use them to quantify the impact of the methodology steps. We show that some estimation methodologies introduce massive overestimation, and propose two more accurate revenue estimations. We collect 30,424 cybercrime payment addresses and use them to compare the financial impact of 6 abuse types (e.g., ransomware, sextortion) and 141 cybercriminal groups. For the first time, we quantify the impact of address coverage on estimations by proposing two techniques to achieve high coverage on the payment addresses of the DeadBolt ransomware. Our expanded coverage enables us to estimate DeadBolts revenue at $2.47M, an estimation 39 times higher than the one resulting from using two Internet scan engines for discovering DeadBolts addresses. Third, we propose techniques for address identification and classification. For address identification we develop GoodFATR, a platform for collecting threat reports, extracting indicators using multiple tools, and comparing their accuracy using a novel majority voting methodology that needs no ground truth. We use our methodology to evaluate iocsearcher, GoodFATRs IOC extraction tool, against 7 other tools. The evaluation shows that iocsearcher is most accurate for extracting 11 of 13 indicator types. For address classification, we design a novel unsupervised classifier that takes as input an abuse report written by a victim and leverages a large language model (LLM) to interpret the text, filter the report if it is spam, and assign it one of 19 abuse types otherwise. We collect 290K cryptocurrency abuse reports from two popular abuse reporting services, build ground truth for 20K reports, and use them to evaluate different designs for our classifier, achieving a precision of 0.92, a recall of 0.87, and an F1 score of 0.89. We analyze the challenge of pollution in abuse reporting services showing that spam may flood unattended services, that a handful of incorrectly reported benign addresses receive 60% of the deposited funds, and that abuse types reported by users are untrustworthy. Finally, we quantify that revenue estimated from blockchain transactions can be 29 times higher than losses reported by victims. RESUMEN Bitcoin es una red descentralizada con transacciones pseudoanónimas e inmutables, muy atractiva para la ciberdelincuencia. Por ejemplo, los atacantes la usan para recibir pagos de víctimas y para construir infraestructura de Comando y Control (C[and]C). Esta tesis presenta técnicas y herramientas novedosas para abordar tres problemas sobre la ciberdelincuencia en Bitcoin: atribución, estimación de los ingresos de los ciberdelincuentes y automatización de la identificación y clasificación de direcciones. Primero, presentamos la exploración back-and-forth, una novedosa técnica de rastreo de transacciones en Bitcoin que ofrece dos contribuciones clave. Primero, explora hacia delante y hacia atrás, permitiendo descubrir relaciones que no pueden encontrarse explorando sólo hacia delante. Segundo, evita la explosión de la exploración combinando una base de datos de etiquetas con un novedoso clasificador que identifica direcciones de exchanges de criptomonedas. Implementamos la exploración back-and-forth en WatchYourBack, una plataforma para el análisis de Bitcoin y la evaluamos en 30 familias de malware. Encontramos puntos de atribución omitidos por exploraciones solo hacia delante, decenas de servicios utilizados por el malware y relaciones entre ciberdelincuentes. Segundo, realizamos la primera comparación sistemática de metodologías de estimación de ingresos en Bitcoin. Implementamos 15 metodologías en WatchYourBack y las utilizamos para cuantificar el impacto de los diversos pasos metodológicos. Demostramos que algunas metodologías introducen una sobreestimación masiva y proponemos dos que producen estimaciones más precisas. Recopilamos 30.424 direcciones cibercriminales y las utilizamos para comparar el impacto financiero de 6 tipos de abusos (e.g., ransomware, sextortion) y 141 grupos criminales. Por primera vez, cuantificamos el impacto de la cobertura de direcciones en la estimación, proponiendo dos técnicas para expandir la cobertura del ransomware DeadBolt. Nuestra cobertura ampliada nos permite estimar los ingresos de DeadBolt en USD $2,47M, 39 veces más que la resultante al utilizar dos servicios de escaneado de Internet para descubrir direcciones de DeadBolt. En tercer lugar, proponemos técnicas de identificación y clasificación de direcciones. Para la tarea de identificación desarrollamos GoodFATR, una plataforma para recopilar informes sobre amenazas, extraer indicadores utilizando múltiples herramientas y comparar su precisión mediante una novedosa metodología de votación por mayoría que no necesita ground truth. Utilizamos nuestra metodología para evaluar iocsearcher, la herramienta de extracción de IOCs de GoodFATR, frente a otras 7 herramientas, mostrando que iocsearcher es la más precisa en 11 de 13 tipos de indicadores. Para la tarea de clasificación, diseñamos un novedoso clasificador no supervisado que, dado una denuncia de abuso escrita por una víctima, usa un modelo de lenguaje de gran tamaño (LLM) para interpretar el texto, filtrar la denuncia si es spam, y asignarla en caso contrario uno de 19 tipos de abuso. Recopilamos 290K informes de abuso de dos servicios, construimos ground truth para 20K informes y los utilizamos para evaluar diferentes diseños para nuestro clasificador basado en LLM, logrando una precisión de 0,92, una recuperación de 0,87 y una puntuación F1 de 0,89. Analizamos la polución en los servicios de denuncia de abusos mostrando que el spam puede inundar servicios desatendidos, que un puñado de direcciones benignas incorrectamente denunciadas reciben 60% de los fondos depositados, y que el tipo de abuso reportado por las víctimas no es confiable. Por último, cuantificamos que las estimaciones a partir de transacciones blockchain pueden ser 29 veces superiores que las pérdidas denunciadas por las víctimas.
This study aims to address the challenges and propose solutions for the Optimization of Blockchain-Based Cybersecurity Systems to Enhance Resilience Against Ransomware Attacks using a Systematic Literature Review (SLR) approach. Blockchain is increasingly recognized as a transformative technology in cybersecurity due to its decentralized structure, transparency, and robustness in securing data. Despite these advantages, its widespread adoption is hindered by several challenges, including scalability, interoperability, high energy consumption, and limited access to representative ransomware datasets. This research highlights that integrating blockchain with advanced technologies such as data analytics, machine learning, and Explainable AI (XAI) can significantly enhance its effectiveness in combating ransomware.The findings reveal that Graph Convolutional Neural Networks (GCN) enable real-time detection of ransomware patterns in network traffic with an accuracy of up to 95%. Furthermore, Layer-2 solutions like the Lightning Network and sharding effectively alleviate the load on main blockchains, thereby increasing transaction throughput. Efficient consensus mechanisms, including Proof of Stake (PoS) and Delegated Proof of Stake (DPoS), address energy consumption issues, making blockchain more adaptable to IoT and resource-constrained environments. These approaches have proven successful in enabling early detection, mitigation, and prevention of ransomware in IoT systems, cloud infrastructures, and smart grid networks. The implications of this study underscore the potential of blockchain as a critical component of proactive and adaptive cybersecurity systems. However, overcoming existing challenges requires further development of hybrid frameworks that integrate blockchain with data analytics and machine learning technologies. In addition, efforts should focus on standardizing global security protocols to enhance interoperability and creating robust, diverse ransomware datasets to support more accurate detection systems. Future research should also explore methods to minimize latency and improve blockchain efficiency in real-time cybersecurity applications.
In light of the escalating complexity of the cyber threat environment, the role of Collaborative Intrusion Detection Systems (CIDSs) in reinforcing contemporary cybersecurity defenses is becoming ever more critical. This paper presents a Blockchain-based Collaborative Intrusion Detection Framework (BCIDF), an innovative methodology aimed at enhancing the efficacy of threat detection and information dissemination. To address the issue of alert collisions during data exchange, an Alternating Random Assignment Selection Mechanism (ARASM) is proposed. This mechanism aims to optimize the selection process of domain leader nodes, thereby partitioning traffic and reducing the size of conflict domains. Unlike conventional CIDS approaches that typically rely on independent node-level detection, our framework incorporates a Weighted Random Forest (WRF) ensemble learning algorithm, enabling collaborative detection among nodes and significantly boosting the system’s overall detection capability. The viability of the BCIDF framework has been rigorously assessed through extensive experimentation utilizing the NSL-KDD dataset. The empirical findings indicate that BCIDF outperforms traditional intrusion detection systems in terms of detection precision, offering a robust and highly effective solution within the realm of cybersecurity.
Muhammad Medhat Kamal, Saad M. Darwish, Adel A. El-Zoghabi
The rapid growth of blockchain-based applications (BoS) has transformed multiple sectors but also brought significant challenges in software testing, particularly for decentralized applications (DApps) and smart contracts. Current development tools primarily support unit testing and do not address the full range of testing needs for blockchain software. Given the complexity of DApps and the immutability of smart contracts, more advanced methods are required to ensure security, performance, and functional accuracy. This study reviews the current state of blockchain software testing, identifying major gaps and limitations in conventional testing frameworks. To address these challenges, we propose an innovative software testing framework that integrates machine learning to offer real-time, customized testing recommendations for blockchain applications. By utilizing key blockchain features, including distributed ledgers, cryptographic hashing, and decentralized consensus, our model enhances testing accuracy by identifying potential vulnerabilities, performance limitations, and functional discrepancies, reducing the risk of undetected defects in the immutable blockchain environment. Experimental assessments show substantial improvements in testing coverage when compared to established tools such as Truffle and Remix, particularly in the validation of smart contracts and identification of security vulnerabilities. Our framework accelerates the testing process and improves the reliability of blockchain applications by providing developers with comprehensive tools to address the unique challenges of decentralized systems. As blockchain continues to advance in sectors like finance, healthcare, and supply chain management, this study highlights the urgent need for sophisticated testing methods and establishes a foundation for future advancements. By combining machine learning with blockchain testing, we introduce a scalable and adaptable approach that can progress alongside developments in blockchain technology. The conclusion explores broader implications and suggests further improvements, including integration into active deployment pipelines and real-time testing in operational settings. This framework marks a significant advancement in ensuring the dependability, security, and scalability of decentralized blockchain applications, supporting the sustainable growth of these systems in the digital ecosystem.
Testing in the software development process is one of the crucial disciplines. The immutability of deployed smart contracts makes tests particularly important in their design and implementation. The objective is to minimize the costs of smart contract testing by reducing the number of test cases. The article presents the test suite reduction method for smart contracts, which exploits the knowledge of their design manner. In particular, the design of a mechanism for evaluating the list of verification rules controlling the execution of transactions was used. The proposed method defines a minimum set of test cases for smart contracts designed according to a specific design pattern. The test case reduction level was shown using analytical formulas enclosed in the paper. Compared to full coverage, the method reduces over 96% of test cases for a smart contract with at least eight verification rules. The performance tests were conducted and the analysis of the results was enclosed as well. Both the smart contract evaluation time and the test suite execution time are less than 0.01 of a millisecond. Besides, the method reduces the number of test data for smart contracts by over 79%. Therefore, the method can be especially useful in continuous software integration and delivery.
Web 3.0 marks the beginning of a new era for the internet, characterized by distributed technology that prioritizes data ownership and value expression. Web 3.0 aims to empower users by providing them with ownership and control of their data and digital assets rather than leaving them in the hands of large corporations. Web 3.0 relies on decentralization, which uses blockchain technology to ensure secure user communication. However, Web 3.0 still faces many security challenges that might affect its deployment and expose users' data and digital assets to cybercriminals. This survey investigates the current evolution of Web 3.0, outlining its background, foundation, and application. This review presents an overview of cybersecurity risks that face a mature Web 3.0 application domain (i.e., decentralized finance (DeFi)) and classifies them into seven categories. Moreover, state-of-the-art methods for addressing these threats are investigated and categorized based on the associated security risks. Insights into the potential future directions of Web 3.0 security are also provided.
The trading of data is becoming increasingly important as it holds substantial value. A blockchain-based data marketplace can provide a secure and transparent platform for data exchange. To facilitate this, developing a fair data exchange protocol for digital goods has garnered considerable attention in recent decades. The Zero Knowledge Contingent Payment (ZKCP) protocol enables trustless fair exchanges with the aid of blockchain and zero-knowledge proofs. However, applying this protocol in a practical data marketplace is not trivial. In this paper, several potential attacks are identified when applying the ZKCP protocol in a practical public data marketplace. To address these issues, we propose SmartZKCP, an enhanced solution that offers improved security measures and increased performance. The protocol is formalized to ensure fairness and secure against potential attacks. Moreover, SmartZKCP offers efficiency optimizations and minimized communication costs. Evaluation results show that SmartZKCP is both practical and efficient, making it applicable in a data exchange marketplace.
William Villegas-Ch, Jaime Govea, Rommel Gurierrez, Aracely Mera-Navarrete
The exponential growth of the Internet of Things (IoT) has boosted connectivity across various sectors, such as Industry 4.0 and smart cities. However, this expansion has also exposed IoT devices to critical vulnerabilities, including spoofing, DoS attacks, and unauthorized access. Traditional security solutions, based on centralized architectures, are neither scalable nor efficient enough to handle the increasing complexity and number of IoT devices, leading to high latencies, increased energy consumption, and inadequate intrusion detection. In this work, we propose a hybrid solution that combines Blockchain and artificial intelligence (AI) to improve security and operational efficiency in IoT networks. Blockchain ensures device authentication and data integrity through a lightweight consensus protocol, while AI enables real-time intrusion detection using deep learning models. The simulations demonstrate that the proposed system improves the precision of detecting phishing attacks by up to 95.2%. At the same time, the authentication latency is reduced to 15 ms in networks with 1000 connected devices, 66.6% faster than traditional solutions. In addition, the energy consumption of the hybrid system is 31.8% lower than that of conventional approaches, validating its scalability and efficiency in large-scale IoT networks.
Smart contracts are self-executing programs on the blockchain, representing the core of Decentralized Finance (DeFi). They can carry billions of dollars, making their correctness and security essential. However, like any other software application, smart contracts may contain vulnerabilities that can be exploited by malicious adversaries — a concern that is further exacerbated by their immutability and transparent nature. Fuzzing is a widely adopted automated testing approach for assessing and ensuring smart contract quality. Although powerful, its effectiveness heavily depends on the quality of the initial inputs, also referred to as seeds. This thesis identifies a key limitation in traditional smart contract fuzzers, such as Echidna, which often rely on randomly generated seeds. It investigates how these fuzzers can be improved in exploring deep contract states, reaching hard-to-trigger conditional paths, and increasing the number of executed instructions by providing higher-quality initial seeds. This thesis proposes AutumnEchidna, a smart contract pre-processing tool that leverages static analysis to generate optimized initial seeds for fuzzing. The methodology involves generating transaction sequences based on state dependencies and producing arguments through constraint solving, aiming to guide execution toward critical contract states. Experiments are conducted on two datasets: a Motivation Dataset and a Maze Dataset, designed to simulate complex input constraints and deep state transitions. Performance is evaluated based on instruction coverage and execution time under consistent configurations for both baseline Echidna (with random seeds) and AutumnEchidna (with optimized seeds). The experiment results show that AutumnEchidna improves instruction coverage by 1.26% on the aggregated Motivation Dataset and by 4.45% on the aggregated Maze Dataset. Additionally, it also reduces the execution time to achieve comparable or higher coverage. These findings demonstrate that optimized seed generation can enhance both the effectiveness and efficiency of smart contract fuzzing. This thesis concludes that incorporating static analysis to generate high-quality initial seeds is a promising approach for enhancing the performance of fuzzing strategies.
Iori Suzuki, Yin Minn Pa Pa, Anh Thi Van Nguyen, Katsunari Yoshioka
Decentralized Finance (DeFi) token scams have become one of the most prevalent forms of fraud in Web-3 technology, generating approximately $241.6 million in illicit revenue in 2023 [1].Detecting these scams requires analyzing both on-chain data, such as transaction records on the blockchain, and off-chain data, such as websites related to the DeFi token project and associated social media accounts.Relying solely on one type of data may fail to capture the full context of fraudulent activities.While on-chain data is publicly accessible due to the transparency inherent in blockchain technology, off-chain data often disappears alongside DeFi scam campaigns, making it difficult for the security community to study these scams.To address this challenge, we propose a dataset comprising more than 550 thousand archived web and social media data as offchain data, in addition to on-chain data related to 32,144 DeFi tokens deployed on Ethereum blockchain from September 24, 2024 to January 14, 2025.This dataset aims to support the security community in studying and detecting DeFi token scams.To illustrate its utility, our case studies demonstrated the potential of the dataset in identifying patterns and behaviors associated with scam tokens.These findings highlight the dataset's capability to provide insights into fraudulent activities and support further research in developing effective detection mechanisms.
In recent years, blockchain technology, as an innovative information technology, has received widespread attention in academia and industry. However, its limitations in mechanism design and the completeness of supporting infrastructure, combined with the immaturity of security concepts, have exposed blockchain systems to severe security threats and challenges. This study aims to address critical security issues in blockchain technology by proposing a blockchain security architecture based on Web attack principles. The architecture adopts a negotiated consensus mechanism and integrates real-time protection techniques from the field of cybersecurity, designing an innovative framework capable of identifying and restricting malicious nodes. With dynamic isolation as its core strategy, the architecture detects abnormal behaviors and temporarily isolates malicious nodes, preventing further damage to the blockchain network. The results demonstrate that this architecture successfully addresses the bottlenecks of inadequate targeted defense in existing blockchain systems and significantly improves operational efficiency and security. Experimental validation indicates that the architecture exhibits substantial practical value in scenarios such as decentralized finance (DeFi) and supply chain management, laying a solid foundation for the widespread application of blockchain technology in real-world settings.
现有区块链交易通常使用加密货币作为抵押物并进行链上交易，但由于加密货币的波动性，面临清算风险。本文旨在区块链与链下资产的融合，降低区块链交易风险，并提出一种基于零知识证明的密码学方案，将链下资产绑定到链上交易作为抵押物。该方案在支持区块链交易的同时，确保数据隐私性、数据源认证和低Gas消耗。在性能方面，我们对所提方案进行了功能分析和实验评估，研究了不同实体在各个阶段产生的计算成本。实验结果表明，该方案在功能上可行，并且计算效率较高。综上，该方案为区块链交易提供了一种安全且高效的基于零知识证明的解决方案。Existing blockchain transactions typically use cryptocurrencies as collateral for on-chain trading. However, the volatility of cryptocurrencies exposes these transactions to significant liquidation risks. This paper aims to integrate blockchain with off-chain assets to mitigate such risks and proposes a cryptographic scheme based on zero-knowledge proofs that links off-chain assets to on-chain transactions as collateral. The proposed scheme enables secure blockchain transactions while ensuring data privacy, authentication of data sources, and low gas cost. From a performance perspective, this paper conducts a functional analysis and experimental evaluation, assessing the computational costs incurred by different entities at various stages. Experimental results demonstrate that the scheme is both functionally viable and computationally efficient. In conclusion, this work presents a secure and efficient zero-knowledge-proof-based solution for blockchain transactions.
The Industrial Internet of Things (IIoT) generates a vast volume of sensitive data that demands not only confidentiality but also authenticity and integrity—especially in large-scale deployments. Ensuring that data originates from trusted devices is critical; however, existing authentication mechanisms often lack scalability and effective revocation support. To address these challenges, we proposeLightPUF-IIoT, a secure and lightweight authentication scheme designed for fog-assisted IIoT data sharing. The scheme leveragesPhysical Unclonable Functions (PUFs)andNon-Interactive Zero-Knowledge Proofs (NIZKPs)to enable scalable, group-based authentication for devices and fog nodes. By binding authenticated identities to cryptographic tokens used during data transmission, LightPUF-IIoT ensures data authenticity and supports real-time rogue device detection. The scheme also includes efficient mechanisms for device revocation and secure token regeneration. Experimental results show that LightPUF-IIoT provides strong security guarantees with minimal resource overhead and significantly outperforms existing approaches in terms of computational cost, scalability, and authentication throughput.
<p><strong>This paper contributes to the literature by</strong> presenting a reproducible framework for designing and testing fair on-chain governance systems. It introduces <em>CryptoKen</em>, an Ethereum-based token using quadratic voting to reduce plutocracy and enhance participation in decentralized organizations, achieving high usability (SUS 82.5) and 92% verified test coverage.</p>
The rise of blockchain and Digital Ledger Technology (DLT) has gained wide traction. Instead of relying on a traditional centralized data authority, a blockchain system consists of digitally entangled block data shared across a distributed network. The specially designed chain data structure and its consensus mechanism protect blockchain data from being tampered by unauthorized adversaries. However, implementing a full-fledged blockchain system to protect a database can be technically cumbersome. In this work, we introduce an in-database design, named chain table, to protect data integrity without the need for a blockchain system. It features a succinct design without significant technology barriers or storage overhead. To realize rigorous data security, we also propose a set of data writing principles for the chain table. We prove that the chain table, together with the data writing principles, will guarantee flexible data integrity, named table-level data integrity (TDI).
Decentralized finance (DeFi) protocols are crypto projects developed on the blockchain to manage digital assets. Attacks on DeFi have been frequent and have resulted in losses exceeding $80 billion. Current tools detect and locate possible vulnerabilities in contracts by analyzing the state changes that may occur during malicious events. However, this victim-only approaches seldom possess the capability to cover the attacker’s interaction intention logic. Furthermore, only a minuscule percentage of DeFi protocols experience attacks in real-world scenarios, which poses a significant challenge for these detection tools to demonstrate practical effectiveness. In this paper, we propose DeFiTail, thefirstframework that utilizes deep learning technology for access control and flash loan exploit detection. Through feeding the cross-contract static data flow, DeFiTail automatically learns the attack logic in real-world malicious events that occur on DeFi protocols, capturing the threat patterns between attacker and victim contracts. Since the DeFi protocol events involve interactions with multi-account transactions, the execution path with external and internal transactions requires to be unified. Moreover, to mitigate the impact of mistakes in Control Flow Graph (CFG) connections, DeFiTail validates the data path by employing the symbolic execution stack. Furthermore, we feed the data paths through our model to achieve the inspection of DeFi protocols. Comparative experiment results indicate that DeFiTail achieves the highest accuracy, with 98.39% in access control and 97.43% in flash loan exploits. DeFiTail also demonstrates an enhanced capability to detect malicious contracts, identifying 86.67% accuracy from the CVE dataset. By monitoring existing contracts, we identified five distinct categories of vulnerabilities: repetition abuse, unsafe unintended exploitation, signature violated exploitation, insecure interfaces exploitation, and unrestricted token transfer.
The rapid expansion of cryptocurrencies has revolutionized the digital economy, offering decentralized and secure transaction mechanisms through blockchain technology. However, this growth has concurrently attracted cybercriminal activities, exploiting the inherent anonymity and security features of cryptocurrencies for illicit purposes such as money laundering, ransomware, exchange hacking, tax evasion, Initial Coin Offering (ICO) frauds, Ponzi schemes, and phishing attacks. This paper provides a comprehensive analysis of cryptocurrency-related cybercrimes, identifying prevalent patterns and underlying vulnerabilities within blockchain systems and cryptocurrency exchanges. Utilizing a multifaceted research methodology that includes qualitative and quantitative analyses, case studies, and theoretical frameworks like the Martial Arts Matrix (MAM), the study elucidates the motivations and sophisticated tactics employed by cybercriminals. Key findings highlight the critical need for enhanced security measures, robust regulatory frameworks, and collaborative efforts among stakeholders to mitigate these risks effectively. Additionally, the paper explores emerging trends and technologies in blockchain security, such as decentralized identity management and quantum-resistant cryptographic algorithms, which hold promise for strengthening defenses against evolving cyber threats. The study concludes by offering actionable recommendations for law enforcement agencies, cryptocurrency providers, and policymakers to address the dynamic landscape of cryptocurrency-related cybercrimes, ensuring the sustained growth and trustworthiness of the cryptocurrency ecosystem.
Developers and users are drawn to Ethereum due to its rapidly growing asset count. However, potential vulnerabilities and malicious behaviors during the execution of smart contracts have led to an increasing demand for security detection technology. Conventional static and dynamic analysis methods are less useful in the case of complex opcode sequences and multiple execution paths. To tackle this problem, this paper proposes an Ethereum intrusion detection method based on Bidirectional Long Short-Term Memory (Bi-LSTM) network with multi-head attention. It examines the opcode execution paths generated from the intra-and-inter-function Control Flow Graphs (CFGs) using the EPP algorithm and captures the rich feature representations and long dependencies. This combination increases the precision and efficacy of detecting malicious activity and smart contract vulnerabilities while simultaneously enhancing the model’s robustness and interpretability and handling variable-length sequences. For the five selected vulnerabilities, the precision, recall and F1-score of this model are above 89.9%, 87.3%, and 88%, respectively.
Airdrops represent a pivotal strategic instrument for Web3 projects, serving to distribute free tokens and motivate early adoption. However, the popularity of these tokens has fueled the emergence of airdrop hunters—individuals who exploit multiple transactions to acquire disproportionate amounts of tokens unfairly. This phenomenon threatens the integrity and fairness of the Web3 community. Current detection methods struggle with high false-positive rates, harming legitimate users, and require significant computational resources for training. Furthermore, these methods face challenges in adapting to the evolving tactics of airdrop hunters, leading to diminished detection accuracy and efficiency. We introduce ARTEMIX, a community-boosting-based framework that integrates custom-engineered features and community detection techniques to identify airdrop hunters in NFT transactions. Using data from the Blur NFT market, ARTEMIX demonstrates superior accuracy and efficiency, outperforming existing graph-based inference models, achieving an F1 score of 0.898. This approach provides a scalable and effective solution to anomaly detection in the Web3 ecosystem, promoting a more secure and equitable environment for token distributions.
The proliferation of Internet of Things (IoT) devices has facilitated the exchange of information among individuals and devices. This development has introduced several challenges, including increased vulnerability to potential cyberattacks and digital forensics. IoT forensic investigations need to be managed in a forensically sound manner using a standard framework. However, adopting traditional digital forensics tools introduces various challenges, such as identifying all IoT devices and users at the crime scene. Therefore, collecting evidence from these devices is a major problem. This paper proposes a permissioned blockchain integration solution for IoT forensics (PBCIS-IoTF) that aims to observe data transactions within the blockchain. The PBCIS-IoTF framework designs and tests Hyperledger blockchains simulated with a Raspberry Pi device and chaincode to address the challenges of IoT forensics. This blockchain is deployed using multiple nodes within the network to avoid a single point of failure. The authenticity and integrity of the acquired evidence are analysed by comparing the SHA-256 hash metadata in the blockchain of all peers within the network. We further integrate webpage access with the blockchain to capture the forensics data from the user’s IoT devices. This allows law enforcement and a court of law to access forensic evidence directly and ensures its authenticity and integrity. PBCIS-IoTF shows high authenticity and integrity across all peers within the network.
Oqeili Saleh, Abu-alzanat Thamer, Alkaraimah Qutaibah, al smadi Takialddin
CAPTCHA, which stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart, is a commonly employed security measure to distinguish between humans and computers. The Turing Test, designed to guarantee network security, is the foundation of this security technique. Usability is a crucial concern that can prevent human users from engaging in laborious and time-consuming tasks. When designing CAPTCHA, security and usability must be addressed simultaneously. When designing CAPTCHA, it is crucial to address security and usability simultaneously. A concerted effort is required to protect online data and guarantee privacy and security. The personal information of Internet users remains susceptible to theft. This study uses an information extraction technique called CAPTCHA to investigate the hazards associated with violating user privacy. It is a highly harmful process due to hacking, theft, unauthorized reuse, and the breach of user information. This study proposes a privacy preservation system employing concurrent encryption techniques, multilateral security computing, and zero-knowledge proof. The objective is to create a system that allows for uncomplicated and secure puzzle-solving using dice gas. CAPTCHA limits access to users' information. In the overview and application of evidentiary measurable methods, we can draw significant conclusions about the more extensive client group's discernments and encounters with CAPTCHA as a privacy-preserving component.