We present the design and implementation of a fourth-year undergraduate computer science elective course on cryptocurrency. The course introduces the basics of cryptocurrencies and blockchains using Bitcoin. Programming distributed applications for blockchains is explored using Ethereum via the Solidity programming language. Advanced theoretical concepts are discussed, using different cryptocurrencies to demonstrate how they are implemented in practice. Cryptocurrency applications are presented, along with a responsible examination of present-day cryptocurrency scams. The assignments build upon each other, with the students implementing a web-based blockchain application by the end of the semester. The course was well received, and student feedback was positive. All of the course materials are available online under public copyright licenses.
Bitcoin is a decentralized network with pseudo-anonymous and immutable transactions, thus very attractive for cybercrime. For instance, it is abused to receive payments from victims and by malware developers for building their Command and Control (C[and]C) infrastructure. This dissertation presents novel techniques and tools for addressing three problems related to Bitcoin cybercrime: cybercrime attribution, estimating cybercriminal revenue, and automating the identification and classification of cryptocurrency addresses. First, we present back-and-forth exploration, a novel Bitcoin transaction tracing technique to identify cybercrime financial relationships. It provides two key contributions. First, it explores both forward and backward, enabling the discovery of relationships that cannot be found by only exploring forward. Second, it prevents exploration explosion by combining a tag database with a novel machine learning classifier that identifies exchange addresses. We implement back-and-forth exploration in WatchYourBack, an open-source Bitcoin analysis platform. We evaluate WatchYourBack on 30 malware families. We find new attribution points missed by forward-only explorations, uncover a wealth of services used by the malware, and identify previously unknown relationships between cybercriminals. Second, we perform the first systematic comparison of Bitcoin revenue estimation methodologies. We implement 15 estimation methodologies in WatchYourBack and use them to quantify the impact of the methodology steps. We show that some estimation methodologies introduce massive overestimation, and propose two more accurate revenue estimations. We collect 30,424 cybercrime payment addresses and use them to compare the financial impact of 6 abuse types (e.g., ransomware, sextortion) and 141 cybercriminal groups. For the first time, we quantify the impact of address coverage on estimations by proposing two techniques to achieve high coverage on the payment addresses of the DeadBolt ransomware. Our expanded coverage enables us to estimate DeadBolts revenue at $2.47M, an estimation 39 times higher than the one resulting from using two Internet scan engines for discovering DeadBolts addresses. Third, we propose techniques for address identification and classification. For address identification we develop GoodFATR, a platform for collecting threat reports, extracting indicators using multiple tools, and comparing their accuracy using a novel majority voting methodology that needs no ground truth. We use our methodology to evaluate iocsearcher, GoodFATRs IOC extraction tool, against 7 other tools. The evaluation shows that iocsearcher is most accurate for extracting 11 of 13 indicator types. For address classification, we design a novel unsupervised classifier that takes as input an abuse report written by a victim and leverages a large language model (LLM) to interpret the text, filter the report if it is spam, and assign it one of 19 abuse types otherwise. We collect 290K cryptocurrency abuse reports from two popular abuse reporting services, build ground truth for 20K reports, and use them to evaluate different designs for our classifier, achieving a precision of 0.92, a recall of 0.87, and an F1 score of 0.89. We analyze the challenge of pollution in abuse reporting services showing that spam may flood unattended services, that a handful of incorrectly reported benign addresses receive 60% of the deposited funds, and that abuse types reported by users are untrustworthy. Finally, we quantify that revenue estimated from blockchain transactions can be 29 times higher than losses reported by victims. RESUMEN Bitcoin es una red descentralizada con transacciones pseudoanónimas e inmutables, muy atractiva para la ciberdelincuencia. Por ejemplo, los atacantes la usan para recibir pagos de víctimas y para construir infraestructura de Comando y Control (C[and]C). Esta tesis presenta técnicas y herramientas novedosas para abordar tres problemas sobre la ciberdelincuencia en Bitcoin: atribución, estimación de los ingresos de los ciberdelincuentes y automatización de la identificación y clasificación de direcciones. Primero, presentamos la exploración back-and-forth, una novedosa técnica de rastreo de transacciones en Bitcoin que ofrece dos contribuciones clave. Primero, explora hacia delante y hacia atrás, permitiendo descubrir relaciones que no pueden encontrarse explorando sólo hacia delante. Segundo, evita la explosión de la exploración combinando una base de datos de etiquetas con un novedoso clasificador que identifica direcciones de exchanges de criptomonedas. Implementamos la exploración back-and-forth en WatchYourBack, una plataforma para el análisis de Bitcoin y la evaluamos en 30 familias de malware. Encontramos puntos de atribución omitidos por exploraciones solo hacia delante, decenas de servicios utilizados por el malware y relaciones entre ciberdelincuentes. Segundo, realizamos la primera comparación sistemática de metodologías de estimación de ingresos en Bitcoin. Implementamos 15 metodologías en WatchYourBack y las utilizamos para cuantificar el impacto de los diversos pasos metodológicos. Demostramos que algunas metodologías introducen una sobreestimación masiva y proponemos dos que producen estimaciones más precisas. Recopilamos 30.424 direcciones cibercriminales y las utilizamos para comparar el impacto financiero de 6 tipos de abusos (e.g., ransomware, sextortion) y 141 grupos criminales. Por primera vez, cuantificamos el impacto de la cobertura de direcciones en la estimación, proponiendo dos técnicas para expandir la cobertura del ransomware DeadBolt. Nuestra cobertura ampliada nos permite estimar los ingresos de DeadBolt en USD $2,47M, 39 veces más que la resultante al utilizar dos servicios de escaneado de Internet para descubrir direcciones de DeadBolt. En tercer lugar, proponemos técnicas de identificación y clasificación de direcciones. Para la tarea de identificación desarrollamos GoodFATR, una plataforma para recopilar informes sobre amenazas, extraer indicadores utilizando múltiples herramientas y comparar su precisión mediante una novedosa metodología de votación por mayoría que no necesita ground truth. Utilizamos nuestra metodología para evaluar iocsearcher, la herramienta de extracción de IOCs de GoodFATR, frente a otras 7 herramientas, mostrando que iocsearcher es la más precisa en 11 de 13 tipos de indicadores. Para la tarea de clasificación, diseñamos un novedoso clasificador no supervisado que, dado una denuncia de abuso escrita por una víctima, usa un modelo de lenguaje de gran tamaño (LLM) para interpretar el texto, filtrar la denuncia si es spam, y asignarla en caso contrario uno de 19 tipos de abuso. Recopilamos 290K informes de abuso de dos servicios, construimos ground truth para 20K informes y los utilizamos para evaluar diferentes diseños para nuestro clasificador basado en LLM, logrando una precisión de 0,92, una recuperación de 0,87 y una puntuación F1 de 0,89. Analizamos la polución en los servicios de denuncia de abusos mostrando que el spam puede inundar servicios desatendidos, que un puñado de direcciones benignas incorrectamente denunciadas reciben 60% de los fondos depositados, y que el tipo de abuso reportado por las víctimas no es confiable. Por último, cuantificamos que las estimaciones a partir de transacciones blockchain pueden ser 29 veces superiores que las pérdidas denunciadas por las víctimas.
Detecting vulnerable smart contracts has a direct effect on blockchain security because it helps users avoid using these contracts. In this study, the problem of vulnerability risk for blockchain smart contracts is introduced. Moreover, an effective criterion for its estimation is devised. With this criterion, to estimate the risk of an unknown smart contract, linear discriminant analysis of smart contracts and distances to their nearest neighbors were exploited. Although deep learning is not used in the proposed criterion and it requires little training data, it provides a realistic risk estimation of smart contracts. The experiments conducted on a real-world dataset of Ethereum blockchain smart contracts, including both vulnerable and safe contracts, show the acceptable performance of the proposed criterion. Moreover, the performance of the proposed criterion is superior to that of existing criteria in other areas of risk estimation.
Daniel Kwame Amissah, Winfred Yaokumah, Edward Danso Ansong, Justice Kwame Appati
ABSTRACT This study investigates the classification performance of various machine learning algorithms on the Bitcoin Heist ransomware dataset, focusing on the effects of dimensionality reduction techniques. The primary objective was to evaluate the classifiers' effectiveness in distinguishing between malicious and benign transactions under three experimental scenarios: without dimensionality reduction, utilizing Incremental Principal Component Analysis (IPCA), and applying Uniform Manifold Approximation and Projection (UMAP). The methodology involved rigorous experimentation with four classifiers: K‐Nearest Neighbors (KNN), XGBoost, Decision Tree, and Multi‐Layer Perceptron (MLP). The results demonstrated that dimensionality reduction techniques, particularly UMAP, improved the performance of KNN and Decision Tree classifiers while adversely affecting the performance of XGBoost and MLP. Notably, KNN consistently outperformed the other classifiers across different scenarios, indicating its robustness in handling reduced feature spaces. This study concludes that the effectiveness of dimensionality reduction is contingent upon the specific characteristics of the classifiers employed.
This study aims to address the challenges and propose solutions for the Optimization of Blockchain-Based Cybersecurity Systems to Enhance Resilience Against Ransomware Attacks using a Systematic Literature Review (SLR) approach. Blockchain is increasingly recognized as a transformative technology in cybersecurity due to its decentralized structure, transparency, and robustness in securing data. Despite these advantages, its widespread adoption is hindered by several challenges, including scalability, interoperability, high energy consumption, and limited access to representative ransomware datasets. This research highlights that integrating blockchain with advanced technologies such as data analytics, machine learning, and Explainable AI (XAI) can significantly enhance its effectiveness in combating ransomware.The findings reveal that Graph Convolutional Neural Networks (GCN) enable real-time detection of ransomware patterns in network traffic with an accuracy of up to 95%. Furthermore, Layer-2 solutions like the Lightning Network and sharding effectively alleviate the load on main blockchains, thereby increasing transaction throughput. Efficient consensus mechanisms, including Proof of Stake (PoS) and Delegated Proof of Stake (DPoS), address energy consumption issues, making blockchain more adaptable to IoT and resource-constrained environments. These approaches have proven successful in enabling early detection, mitigation, and prevention of ransomware in IoT systems, cloud infrastructures, and smart grid networks. The implications of this study underscore the potential of blockchain as a critical component of proactive and adaptive cybersecurity systems. However, overcoming existing challenges requires further development of hybrid frameworks that integrate blockchain with data analytics and machine learning technologies. In addition, efforts should focus on standardizing global security protocols to enhance interoperability and creating robust, diverse ransomware datasets to support more accurate detection systems. Future research should also explore methods to minimize latency and improve blockchain efficiency in real-time cybersecurity applications.
Preserving the privacy of transactions and ensuring the regulatory compliance of transactions are two important requirements for blockchain-based financial applications. However, these two requirements are somewhat contradictory. Techniques for protecting transaction privacy, such as data encryption and zero-knowledge proof, generally make it difficult to regulate and audit the transactions. In this paper, we propose a system named zkFabLedger which enhances both the privacy and the auditability of the classic permissioned blockchain platform Hyperledger Fabric. The proposed system utilizes commitments and non-interactive zero-knowledge proofs to hide the detailed information of transactions while enabling the endorsing peer nodes to verify the regulatory compliance of transactions. Transactions are recorded on table-structured ledgers, so that the regulator can perform complex auditing of transactions. Moreover, we utilize the ring signature scheme and the secret handshake protocol to ensure the anonymity of the transaction sender while enabling the regulator to trace the sender’s identity. Simulation results demonstrate that the proposed system can balance well between privacy, regulation and efficiency.
In light of the escalating complexity of the cyber threat environment, the role of Collaborative Intrusion Detection Systems (CIDSs) in reinforcing contemporary cybersecurity defenses is becoming ever more critical. This paper presents a Blockchain-based Collaborative Intrusion Detection Framework (BCIDF), an innovative methodology aimed at enhancing the efficacy of threat detection and information dissemination. To address the issue of alert collisions during data exchange, an Alternating Random Assignment Selection Mechanism (ARASM) is proposed. This mechanism aims to optimize the selection process of domain leader nodes, thereby partitioning traffic and reducing the size of conflict domains. Unlike conventional CIDS approaches that typically rely on independent node-level detection, our framework incorporates a Weighted Random Forest (WRF) ensemble learning algorithm, enabling collaborative detection among nodes and significantly boosting the system’s overall detection capability. The viability of the BCIDF framework has been rigorously assessed through extensive experimentation utilizing the NSL-KDD dataset. The empirical findings indicate that BCIDF outperforms traditional intrusion detection systems in terms of detection precision, offering a robust and highly effective solution within the realm of cybersecurity.
Muhammad Medhat Kamal, Saad M. Darwish, Adel A. El-Zoghabi
The rapid growth of blockchain-based applications (BoS) has transformed multiple sectors but also brought significant challenges in software testing, particularly for decentralized applications (DApps) and smart contracts. Current development tools primarily support unit testing and do not address the full range of testing needs for blockchain software. Given the complexity of DApps and the immutability of smart contracts, more advanced methods are required to ensure security, performance, and functional accuracy. This study reviews the current state of blockchain software testing, identifying major gaps and limitations in conventional testing frameworks. To address these challenges, we propose an innovative software testing framework that integrates machine learning to offer real-time, customized testing recommendations for blockchain applications. By utilizing key blockchain features, including distributed ledgers, cryptographic hashing, and decentralized consensus, our model enhances testing accuracy by identifying potential vulnerabilities, performance limitations, and functional discrepancies, reducing the risk of undetected defects in the immutable blockchain environment. Experimental assessments show substantial improvements in testing coverage when compared to established tools such as Truffle and Remix, particularly in the validation of smart contracts and identification of security vulnerabilities. Our framework accelerates the testing process and improves the reliability of blockchain applications by providing developers with comprehensive tools to address the unique challenges of decentralized systems. As blockchain continues to advance in sectors like finance, healthcare, and supply chain management, this study highlights the urgent need for sophisticated testing methods and establishes a foundation for future advancements. By combining machine learning with blockchain testing, we introduce a scalable and adaptable approach that can progress alongside developments in blockchain technology. The conclusion explores broader implications and suggests further improvements, including integration into active deployment pipelines and real-time testing in operational settings. This framework marks a significant advancement in ensuring the dependability, security, and scalability of decentralized blockchain applications, supporting the sustainable growth of these systems in the digital ecosystem.
Testing in the software development process is one of the crucial disciplines. The immutability of deployed smart contracts makes tests particularly important in their design and implementation. The objective is to minimize the costs of smart contract testing by reducing the number of test cases. The article presents the test suite reduction method for smart contracts, which exploits the knowledge of their design manner. In particular, the design of a mechanism for evaluating the list of verification rules controlling the execution of transactions was used. The proposed method defines a minimum set of test cases for smart contracts designed according to a specific design pattern. The test case reduction level was shown using analytical formulas enclosed in the paper. Compared to full coverage, the method reduces over 96% of test cases for a smart contract with at least eight verification rules. The performance tests were conducted and the analysis of the results was enclosed as well. Both the smart contract evaluation time and the test suite execution time are less than 0.01 of a millisecond. Besides, the method reduces the number of test data for smart contracts by over 79%. Therefore, the method can be especially useful in continuous software integration and delivery.
Web 3.0 marks the beginning of a new era for the internet, characterized by distributed technology that prioritizes data ownership and value expression. Web 3.0 aims to empower users by providing them with ownership and control of their data and digital assets rather than leaving them in the hands of large corporations. Web 3.0 relies on decentralization, which uses blockchain technology to ensure secure user communication. However, Web 3.0 still faces many security challenges that might affect its deployment and expose users' data and digital assets to cybercriminals. This survey investigates the current evolution of Web 3.0, outlining its background, foundation, and application. This review presents an overview of cybersecurity risks that face a mature Web 3.0 application domain (i.e., decentralized finance (DeFi)) and classifies them into seven categories. Moreover, state-of-the-art methods for addressing these threats are investigated and categorized based on the associated security risks. Insights into the potential future directions of Web 3.0 security are also provided.
The trading of data is becoming increasingly important as it holds substantial value. A blockchain-based data marketplace can provide a secure and transparent platform for data exchange. To facilitate this, developing a fair data exchange protocol for digital goods has garnered considerable attention in recent decades. The Zero Knowledge Contingent Payment (ZKCP) protocol enables trustless fair exchanges with the aid of blockchain and zero-knowledge proofs. However, applying this protocol in a practical data marketplace is not trivial. In this paper, several potential attacks are identified when applying the ZKCP protocol in a practical public data marketplace. To address these issues, we propose SmartZKCP, an enhanced solution that offers improved security measures and increased performance. The protocol is formalized to ensure fairness and secure against potential attacks. Moreover, SmartZKCP offers efficiency optimizations and minimized communication costs. Evaluation results show that SmartZKCP is both practical and efficient, making it applicable in a data exchange marketplace.
William Villegas-Ch, Jaime Govea, Rommel Gurierrez, Aracely Mera-Navarrete
The exponential growth of the Internet of Things (IoT) has boosted connectivity across various sectors, such as Industry 4.0 and smart cities. However, this expansion has also exposed IoT devices to critical vulnerabilities, including spoofing, DoS attacks, and unauthorized access. Traditional security solutions, based on centralized architectures, are neither scalable nor efficient enough to handle the increasing complexity and number of IoT devices, leading to high latencies, increased energy consumption, and inadequate intrusion detection. In this work, we propose a hybrid solution that combines Blockchain and artificial intelligence (AI) to improve security and operational efficiency in IoT networks. Blockchain ensures device authentication and data integrity through a lightweight consensus protocol, while AI enables real-time intrusion detection using deep learning models. The simulations demonstrate that the proposed system improves the precision of detecting phishing attacks by up to 95.2%. At the same time, the authentication latency is reduced to 15 ms in networks with 1000 connected devices, 66.6% faster than traditional solutions. In addition, the energy consumption of the hybrid system is 31.8% lower than that of conventional approaches, validating its scalability and efficiency in large-scale IoT networks.
Smart contracts are self-executing programs on the blockchain, representing the core of Decentralized Finance (DeFi). They can carry billions of dollars, making their correctness and security essential. However, like any other software application, smart contracts may contain vulnerabilities that can be exploited by malicious adversaries — a concern that is further exacerbated by their immutability and transparent nature. Fuzzing is a widely adopted automated testing approach for assessing and ensuring smart contract quality. Although powerful, its effectiveness heavily depends on the quality of the initial inputs, also referred to as seeds. This thesis identifies a key limitation in traditional smart contract fuzzers, such as Echidna, which often rely on randomly generated seeds. It investigates how these fuzzers can be improved in exploring deep contract states, reaching hard-to-trigger conditional paths, and increasing the number of executed instructions by providing higher-quality initial seeds. This thesis proposes AutumnEchidna, a smart contract pre-processing tool that leverages static analysis to generate optimized initial seeds for fuzzing. The methodology involves generating transaction sequences based on state dependencies and producing arguments through constraint solving, aiming to guide execution toward critical contract states. Experiments are conducted on two datasets: a Motivation Dataset and a Maze Dataset, designed to simulate complex input constraints and deep state transitions. Performance is evaluated based on instruction coverage and execution time under consistent configurations for both baseline Echidna (with random seeds) and AutumnEchidna (with optimized seeds). The experiment results show that AutumnEchidna improves instruction coverage by 1.26% on the aggregated Motivation Dataset and by 4.45% on the aggregated Maze Dataset. Additionally, it also reduces the execution time to achieve comparable or higher coverage. These findings demonstrate that optimized seed generation can enhance both the effectiveness and efficiency of smart contract fuzzing. This thesis concludes that incorporating static analysis to generate high-quality initial seeds is a promising approach for enhancing the performance of fuzzing strategies.
Iori Suzuki, Yin Minn Pa Pa, Anh Thi Van Nguyen, Katsunari Yoshioka
Decentralized Finance (DeFi) token scams have become one of the most prevalent forms of fraud in Web-3 technology, generating approximately $241.6 million in illicit revenue in 2023 [1].Detecting these scams requires analyzing both on-chain data, such as transaction records on the blockchain, and off-chain data, such as websites related to the DeFi token project and associated social media accounts.Relying solely on one type of data may fail to capture the full context of fraudulent activities.While on-chain data is publicly accessible due to the transparency inherent in blockchain technology, off-chain data often disappears alongside DeFi scam campaigns, making it difficult for the security community to study these scams.To address this challenge, we propose a dataset comprising more than 550 thousand archived web and social media data as offchain data, in addition to on-chain data related to 32,144 DeFi tokens deployed on Ethereum blockchain from September 24, 2024 to January 14, 2025.This dataset aims to support the security community in studying and detecting DeFi token scams.To illustrate its utility, our case studies demonstrated the potential of the dataset in identifying patterns and behaviors associated with scam tokens.These findings highlight the dataset's capability to provide insights into fraudulent activities and support further research in developing effective detection mechanisms.
In recent years, blockchain technology, as an innovative information technology, has received widespread attention in academia and industry. However, its limitations in mechanism design and the completeness of supporting infrastructure, combined with the immaturity of security concepts, have exposed blockchain systems to severe security threats and challenges. This study aims to address critical security issues in blockchain technology by proposing a blockchain security architecture based on Web attack principles. The architecture adopts a negotiated consensus mechanism and integrates real-time protection techniques from the field of cybersecurity, designing an innovative framework capable of identifying and restricting malicious nodes. With dynamic isolation as its core strategy, the architecture detects abnormal behaviors and temporarily isolates malicious nodes, preventing further damage to the blockchain network. The results demonstrate that this architecture successfully addresses the bottlenecks of inadequate targeted defense in existing blockchain systems and significantly improves operational efficiency and security. Experimental validation indicates that the architecture exhibits substantial practical value in scenarios such as decentralized finance (DeFi) and supply chain management, laying a solid foundation for the widespread application of blockchain technology in real-world settings.
现有区块链交易通常使用加密货币作为抵押物并进行链上交易，但由于加密货币的波动性，面临清算风险。本文旨在区块链与链下资产的融合，降低区块链交易风险，并提出一种基于零知识证明的密码学方案，将链下资产绑定到链上交易作为抵押物。该方案在支持区块链交易的同时，确保数据隐私性、数据源认证和低Gas消耗。在性能方面，我们对所提方案进行了功能分析和实验评估，研究了不同实体在各个阶段产生的计算成本。实验结果表明，该方案在功能上可行，并且计算效率较高。综上，该方案为区块链交易提供了一种安全且高效的基于零知识证明的解决方案。Existing blockchain transactions typically use cryptocurrencies as collateral for on-chain trading. However, the volatility of cryptocurrencies exposes these transactions to significant liquidation risks. This paper aims to integrate blockchain with off-chain assets to mitigate such risks and proposes a cryptographic scheme based on zero-knowledge proofs that links off-chain assets to on-chain transactions as collateral. The proposed scheme enables secure blockchain transactions while ensuring data privacy, authentication of data sources, and low gas cost. From a performance perspective, this paper conducts a functional analysis and experimental evaluation, assessing the computational costs incurred by different entities at various stages. Experimental results demonstrate that the scheme is both functionally viable and computationally efficient. In conclusion, this work presents a secure and efficient zero-knowledge-proof-based solution for blockchain transactions.
Chachar B., Cavazza M., Bracciali A., Ferrara P. · 5 authors
Smart Contracts are at the heart of blockchain transactions, and their integrity is essential to blockchain reliability and performance. Specific errors in Smart Contract code are known to trigger vulnerabilities, which have been categorized into different patterns. Following the success of Large Language Models in software analysis, several authors have proposed the use of LLM to detect Smart Contract vulnerabilities. In this paper, we compare the performance of various LLM as well as formal analysis tools in analyzing Ethereum Smart Contracts for various vulnerabilities, based on standard datasets. Unlike previous work that used LLM fine-tuning, we explore performance based on direct In-Context Learning using standard Prompt Engineering techniques. Our results suggest that the straightforward use of LLM may still be beneficial in the analysis of Smart Contracts, depending on the vulnerability type.