Symbolic execution has proven effective for code analytics in smart contracts. However, for smart contracts, existing symbolic tools use multiple-transaction symbolic execution, which differs from traditional symbolic tools and also exacerbates the path explosion problem. In this paper, we first quantitatively analyze the bottleneck of symbolic execution in multiple transactions (TXs), finding the redundancy of the paths of TXs. Based on this finding, we propose LENT-SSE as a new speculation heuristic for Speculative Symbolic Execution of smart contracts, which leverages the executed and near TXs for skipping and recalling the SMT solving of paths. LENT-SSE uses an executed-transaction-based skipping algorithm to reduce the time required for SMT solving by leveraging the redundancy between executed and executing paths. Moreover, LENT-SSE uses a near-transaction-based recalling algorithm to reduce false skipping of the solving paths. Experimental results on the SmartBugs dataset show that LENT-SSE can reduce the total time by 37.4% and the solving time of paths by 65.2% on average without reducing the reported bugs. On the other dataset of 1000 realistic contracts, the total time and solving time are reduced by 38.1% and 54.7%.
Although Decentralized Finance (DeFi) applications facilitate tamper-proof transactions among multiple anonymous users, since attackers can access the smart contract bytecode directly, vulnerabilities in the transaction mechanism, contract code, or third-party components can be easily exploited to manipulate token prices, leading to financial losses. Since price manipulation often relies on specific states and complex trading sequences, existing detection tools have limitations in addressing this problem. In addition, to swiftly identify the root cause of an attack and implement targeted defense and remediation measures, auditors typically prioritize understanding the methodology behind the attack, emphasizing 'how' it occurred rather than simply confirming its existence. To address these problems, this paper presents a novel automatic price manipulation detection and analysis framework, named DeFort, which contains a price manipulation behavior model to guide on-chain detection, multiple price monitoring strategies to detect pools with abnormal token prices, and various profit calculation mechanisms to confirm attacks. Based on behavioral models, DeFort can automatically locate transactions and functions that cause abnormal price fluctuations and identify attackers and victims. Experimental results demonstrate that DeFort can outperform state-of-the-art price manipulation detection methods. Furthermore, after monitoring 441 real-world projects for two months, DeFort successfully detected five price manipulation attacks.
Open access
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
In the context of boosting smart contract applications, prioritizing their security becomes paramount. Smart contract exploits often result in notable financial losses. Ensuring their security is by no means trivial. Rather than resulting in program crashes, most attacks in on-chain smart contracts aim to induce financial loss, referred to as profitable exploits. By constructing seemingly innocuous inputs, profitable exploits try to extract extra profit or compromise the interests of others. However, due to the complexity of call chains in on-chain smart contracts and the need for effective oracles for profitable exploits, smart contract fuzzing suffers from low efficiency and low effectiveness in finding profitable exploits. In this paper, we present Midas, a novel feedback-driven fuzzing framework to mine profitable exploits in on-chain smart contracts effectively. Midas consists of two modules: diverse validity fuzzing and profitable transaction identification. The diverse validity fuzzing module applies two waypoints to efficiently generate valid transactions, addressing the complexity of on-chain smart contract call chains. The profitable transaction identification module applies differential analysis to effectively identify profitable exploits, addressing the limitation of ad-hoc oracles. Evaluation of Midas over on-chain smart contracts showed it effectively identified 40 real-world exploits with a precision of 80%, outperforming state-of-the-art tools (i.e., ItyFuzz and Slither) in both efficiency and effectiveness. Particularly, Midas effectively mines five unknown exploits in valuable smart contracts, and two of them have already been confirmed by their DApp developers.
Web3 describes an idea for the next evolution of the Internet, where blockchain technology enables the Internet of Value. As Web3 software, decentralized applications (DApps) have emerged in recent years. There exists a natural link between DApps and cryptocurrencies, where faults in DApps could directly lead to monetary losses associated with cryptocurrencies. Hence, efficient fault localization technology is of paramount importance for urgent DApp rescue operations and the mitigation of financial losses. However, fault localization methods applied in traditional applications are not well-suited for this specific field, due to their inability to identify DApp-specific fault features, e.g., a substantial amount of cryptocurrency is transferred from DApps to hackers. In order to explore the root cause of DApp faults, some researchers try to identify suspicious code snippets through mutation testing. Nonetheless, applying mutation testing for DApp fault localization is time-consuming and thus limited in practice. This paper conducts the first comprehensive study of DApp fault localization. We introduce DAppFL, a learning-based DApp fault localization tool that performs reverse engineering to gather executed source code and then trace cryptocurrency flow to assist in locating faulty functions. We also present the inaugural dataset for DApp fault localization, providing a new benchmark for this domain.Our experimental results demonstrate that DAppFL locates 63% of faults within the Top-5, 23% more than the state-of-the-art method. To facilitate further research, our code and dataset are freely available online: https://github.com/xplanet-sysu/awesome-works#dappfl.
Charlotte McCabe, Althaff Irfan Cader Mohideen, Raman Singh
Passwords are the first line of defence against preventing unauthorised access to systems and potential leakage of sensitive data. However, the traditional reliance on username and password combinations is not enough protection and has prompted the implementation of technologies such as two-factor authentication (2FA). While 2FA enhances security by adding a layer of verification, these techniques are not impervious to threats. Even with the implementation of 2FA, the relentless efforts of cybercriminals present formidable obstacles in securing digital spaces. The objective of this work is to implement blockchain technology as a form of 2FA. The findings of this work suggest that blockchain-based 2FA methods could strengthen digital security compared to conventional 2FA methods.
The concept of a Smart City involves transparent information exchange between decentralized cyber environments using distributed ledger technology (DLT). Unlike a centralized database, the distributed ledger does not require a central administrator and therefore does not have a single (central) point of failure. However, this technology has the following problems: (1) majority attacks on DLT systems; (2) assessment of the current level of DLT system security; (3) constant growth in blockchain file size. As a result of the analysis of studies devoted to solving these issues, it was found that today the known solutions have a number of limitations that do not allow them to completely solve these problems. The paper reviews a new approach aimed at consistently solving these challenges. To protect DLT systems in Smart Cities against majority attacks, the method based on dynamic neutralization of the destructive effects of the intruder is proposed. To assess the security level of DLT systems, a method based on calculating the performance of DLT nodes is discussed. To reduce the volume of the block graph, there is presented a new structure of a DLT system. An experimental study has shown the effectiveness of the proposed approach.
Smart contracts are programs that reside and execute on a blockchain, like any transaction. They are automatically executed when preprogrammed terms and conditions are met. Although the smart contract (SC) must be presented in the blockchain for the integrity of data and transactions stored within it, it is highly exposed to several vulnerabilities attackers exploit to access the data. In this paper, classification and detection of vulnerabilities targeting smart contracts are performed using deep learning algorithms over two datasets containing 12,253 smart contracts. These contracts are converted into RGB and Grayscale images and then inserted into Residual Network (ResNet50), Visual Geometry Group-19 (VGG19), Dense Convolutional Network (DenseNet201), k-nearest Neighbors (KNN), and Random Forest (RF) algorithms for binary and multi-label classification. A comprehensive analysis is conducted to detect and classify vulnerabilities using different performance metrics. The performance of these algorithms was outstanding, accurately classifying vulnerabilities with high F1 scores and accuracy rates. For binary classification, RF emerged in RGB images as the best algorithm based on the highest F1 score of 86.66% and accuracy of 86.66%. Moving on to multi-label classification, VGG19 stood out in RGB images as the standout algorithm, achieving an impressive accuracy of 89.14% and an F1 score of 85.87%. To the best of our knowledge, and according to the available literature, this study is the first to investigate binary classification of vulnerabilities targeting Ethereum smart contracts, and the experimental results of the proposed methodology for multi-label vulnerability classification outperform existing literature.
In recent years, a more advanced form of phishing has arisen on Ethereum, surpassing early-stage, simple transaction phishing.This new form, which we refer to as payload-based transaction phishing (PTXPHISH), manipulates smart contract interactions through the execution of malicious payloads to deceive users.PTXPHISH has rapidly emerged as a significant threat, leading to incidents that caused losses exceeding $70 million in 2023 reports.Despite its substantial impact, no previous studies have systematically explored PTXPHISH.In this paper, we present the first comprehensive study of the PTXPHISH on Ethereum.Firstly, we conduct a long-term data collection and put considerable effort into establishing the first ground-truth PTXPHISH dataset, consisting of 5,000 phishing transactions.Based on the dataset, we dissect PTXPHISH, categorizing phishing tactics into four primary categories and eleven sub-categories.Secondly, we propose a rule-based multidimensional detection approach to identify PTXPHISH, achieving an F1-score of over 99% and processing each block in an average of 390 ms.Finally, we conduct a large-scale detection spanning 300 days and discover a total of 130,637 phishing transactions on Ethereum, resulting in losses exceeding $341.9 million.Our in-depth analysis of these phishing transactions yielded valuable and insightful findings.Scammers consume approximately 13.4 ETH daily, which accounts for 12.5% of the total Ethereum gas, to propagate address poisoning scams.Additionally, our analysis reveals patterns in the cash-out process employed by phishing scammers, and we find that the top five phishing organizations are responsible for 40.7% of all losses.Furthermore, our work has made significant contributions to mitigating real-world threats.We have reported 1,726 phishing addresses to the community, accounting for 42.7% of total community contributions during the same period.Additionally, we have sent 2,539 on-chain alert messages, assisting 1,980 victims.This research serves as a valuable reference in combating the emerging PTXPHISH and safeguarding users' assets.
The rapid development of blockchain technology has led to a constant increase in its financial and technological value. However, this has also led to malicious attacks. Distributed denial-of-service attacks pose a considerable threat to blockchain technology out of many attacks due to its effectiveness and distributed nature. To protect the blockchain from DDoS attacks, researchers have proposed a large number of defensive schemes. However, these schemes are not well-suited for use in practical situations. In this work, we propose a DDoS attack detection scheme based on centralized federated learning, where multiple participating nodes locally train models and upload them to a central node for aggregation. Additionally, we propose a more suitable method for blockchain scenarios, using decentralized federated learning technology, where multiple nodes exchange models in a peer-to-peer manner to complete model training without a central server. We simulate DDoS attacks in blockchain and generate a large dataset by combining it with traditional network layer DDoS attack data to evaluate the effectiveness of our schemes. The experimental results show that the proposed schemes perform well in classification accuracy, demonstrating that our techniques can detect DDoS attacks effectively.
Kai Wang, Michael Wen Tong, Jun Pang, Jitao Wang · 5 authors
Recently, there is a surge in ransomware activities that encrypt users’ sensitive data and demand bitcoins for ransom payments to conceal the criminal’s identity. It is crucial for regulatory agencies to identify as many ransomware addresses as possible to accurately estimate the impact of these ransomware activities. However, existing methods for detecting ransomware addresses rely primarily on time-consuming data collection and clustering heuristics, and they face two major issues: (1) The features of an address itself are insufficient to accurately represent its activity characteristics, and (2) the number of disclosed ransomware addresses is extremely less than the number of unlabeled addresses. These issues lead to a significant number of ransomware addresses being undetected, resulting in a substantial underestimation of the impact of ransomware activities. To solve the above two issues, we propose an optimized ransomware address detection method based on Bitcoin transaction relationships, named XRAD , to detect more ransomware addresses with high performance. To address the first one, we present a cascade feature extraction method for Bitcoin transactions to aggregate features of related addresses after exploring transaction relationships. To address the second one, we build a classification model based on Positive-unlabeled learning to detect ransomware addresses with high performance. Extensive experiments demonstrate that XRAD significantly improves average accuracy, recall, and F1 score by 15.07%, 19.71%, and 34.83%, respectively, compared to state-of-the-art methods. In total, XRAD detects 120,335 ransomware activities from 2009 to 2023, revealing a development trend and average ransom payment per year that aligns with three reports by FinCEN, Chainalysis, and Coveware.
Information sharing on social media, especially about daily news and events, is a major focus area. Timely identification of urgent needs, sharing relevant posts, and delivering accurate information are crucial tasks. To combat the spread of fake news, a Reinforcement Learning (RL) technique is used alongside blockchain security to verify social media content. Twitter, a key platform with a major influence on public discourse, is particularly susceptible to false information due to its rapid news dissemination. The approach involves collecting news articles and their metadata, which are then pre-processed to clean and tokenize the data. An RL agent is trained on attributes like word frequency and readability, learning to distinguish between genuine and fake news through rewards and penalties. The trained RL agent classifies new news as true or false based on learned patterns. While blockchain's role in enhancing security is highlighted, further details are necessary to clarify its integration. This approach aims to reduce the spread of misinformation in digital news effectively.
In essence, blockchain is a distributed, secure ledger that contains a hierarchical network of blocks that maintains a record of all transactions. Bringing cloud capabilities closer to computation tasks is the goal of edge computing. It is possible to overcome existing security and scalability issues with blockchain and edge computing. Security is strengthened by the integration of Blockchain technology into Industrial IoT (IIoT) intrusion detection frameworks. In the proposed framework, the decentralized and tamper-proof nature of Blockchain is leveraged to enhance trust and integrity at the edge of the network in the detection of malicious activities. It aims to identify and mitigate cyber threats in IIoT systems for a robust security solution. The framework's performance is measured using various IIoT scenarios, including detection accuracy, response time, delay time, and overall performance score. A combination of blockchain technology and edge-based intrusion detection significantly improves the security posture of IIoT networks, producing high detection accuracy and minimal delays. A more resilient, trustworthy and secure IIoT network can be achieved with this study, which advances secure IIoT architectures.
Smart contracts are a major tool in Ethereum transactions. Therefore hackers can exploit them by adding code vulnerabilities to their sources and using these vulnerabilities for performing malicious transactions. This paper presents two successful approaches for detecting malicious contracts: one uses opcode and relies on GPT2 and the other uses the Solidity source and a LORA fine-tuned CodeLlama. Finally, we present an XGBOOST model that combines gas properties and Hexa-decimal signatures for detecting malicious transactions. This approach relies on early assumptions that maliciousness is manifested by the uncommon usage of the contracts' functions and the effort to pursue the transaction.
Ammar Almomani, Ahmad Al–Qerem, Mohammad Al Khaldy, Mohammad Alauthman · 6 authors
This chapter analyzes the most sophisticated cryptography methods which are used to protect blockchain-based cryptocurrency transactions against attacks by botnets. First, a background will explain blockchain, cryptocurrencies, and threat space for bots is going to sing in. Core cryptographic building blocks such as hash functions and digital signatures are outlined. The chapter furthermore outlines methods to confront botnet threats in blockchain ecosystems, including two processes to sign the user charting, a sign policy standard, code signing, attestation, multi-party computation for private transactions, and zero-knowledge proofs. Finally, we present some obstacles and ideas for research along the way. Conclusively, the systematic incorporation of cryptographic defenses would be the providing layer of security as well as the guarantee of the integrity of cryptocurrency transactions. Continual improvements in scalable cryptographic algorithms and their implication in blockchain platforms will make secure mechanisms against botnets possible.
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
The metaverse, known as the next-generation 3D Internet, represents virtual environments that mirror the physical world. It is supported by innovative technologies such as digital twins and extended reality (XR), which elevate user experiences across various fields. However, the metaverse also introduces significant cybersecurity and privacy challenges that remain underexplored. Due to its complex multi-tech infrastructure, the metaverse requires sophisticated, automated, and intelligent cybersecurity measures to mitigate emerging threats effectively. Therefore, this paper is the first to explore Artificial Intelligence (AI)-driven cybersecurity techniques for the metaverse, examining academic and industrial perspectives. First, we provide an overview of the metaverse, presenting a detailed system model, diverse use cases, and insights into its current industrial status. We then present attack models and cybersecurity threats derived from the unique characteristics and technologies of the metaverse. Next, we review AI-driven cybersecurity solutions based on three critical aspects: User authentication, intrusion detection systems (IDS), and the security of digital assets, specifically for Blockchain and Non-fungible Tokens (NFTs). Finally, we highlight challenges and suggest future research opportunities to enhance metaverse security, privacy, and digital asset transactions.
Aria Seo, Young-Tak Kim, Ji Seok Yang, YangSun Lee · 5 authors
Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.
We present VirtSecIO, a hypervisor-based platform for executing secure modules. VirtSecIO provides the modules with secure paths to peripheral devices, which can be shared between the modules and the operating system. Moreover, VirtSecIO is a thin hypervisor with a negligible performance overhead and a minimal attack surface. We demonstrate VirtSecIO’s abilities by developing HyperWallet, a secure module that acts as a hardware crypto-wallet, without requiring any dedicated hardware.
Open access
Security and Verification in Computing
Advanced Malware Detection Techniques
Physical Unclonable Functions (PUFs) and Hardware Security
Blockchain fuelled the innovation of numerous application fields. In particular, Web3 applications benefit the most because blockchain can be used to implement a rewarding system for users that contribute the most, thus increasing the overall social good provided by these platforms. One of the sectors that has benefited most from blockchain technology is the gaming sector through the so-called Play-to-Earn (P2E) model. The P2E Blockchain Video Games allow players to earn rewards in the form of tokens or NFTs, by having an impact on the social good. Unfortunately, bot accounts could exploit these platforms, which defeats the purpose of having a reward system because they invalidate the social good introduced by the rewards. In this paper, we provide an analysis geared towards detecting suspicious behaviour in P2E blockchain-based games by exploiting Gods Unchained as a case study. Using the game’s official APIs, we download 12 months’ worth of players’ activity. Analysing the data, we detect two groups of players with abnormal activity. Additionally, analysing the players’ graph, we find communities made of the best players with similar activity. Lastly, we observe that users with suspicious behaviour belong to these communities.
Algimantas Venčkauskas, Vacius Jusas, Dominykas Barisas, Boriss Mišņevs
Sharing cyber threat intelligence (CTI) can significantly improve the security of information technology (IT) in organizations. However, stakeholders and practitioners are not keen on sharing CTI data due to the risk of exposing their private data and possibly losing value as an organization on the market. We present a model for CTI data sharing that maintains trust and confidentiality and incentivizes the sharing process. The novelty of the proposed model is that it combines two incentive mechanisms: money and reputation. The reputation incentive is important for ensuring trust in the shared CTI data. The monetary incentive is important for motivating the sharing and consumption of CTI data. The incentives are based on a subscription fee and a reward score for activities performed by a user. User activities are considered in the following three fields: producing CTI data, consuming CTI data, and reviewing CTI data. Each instance of user activity is rewarded with a score, and this score generates some value for reputation. An algorithm is proposed for assigning reward scores and for recording the accumulated reputation of the user. This model is implemented on the Hyperledger Fabric blockchain and the Interplanetary File System for storing data off-chain. The implemented prototype demonstrates the feasibility of the proposed model. The provided simulation shows that the selected values and the proposed algorithm used to calculate the reward scores are in accordance with economic laws.
This paper explores the vulnerability of machine learning models, specifically Random Forest, Decision Tree, and K-Nearest Neighbors, to very simple single-feature adversarial attacks in the context of Ethereum fraudulent transaction detection. Through comprehensive experimentation, we investigate the impact of various adversarial attack strategies on model performance metrics, such as accuracy, precision, recall, and F1-score. Our findings, highlighting how prone those techniques are to simple attacks, are alarming, and the inconsistency in the attacks' effect on different algorithms promises ways for attack mitigation. We examine the effectiveness of different mitigation strategies, including adversarial training and enhanced feature selection, in enhancing model robustness.
The emergence of the Internet of Things (IoT), Industry 5.0 applications and associated services have caused a powerful transition in the cyber threat landscape. As a result, organisations require new ways to proactively manage the risks associated with their infrastructure. In response, a significant amount of research has focused on developing efficient Cyber Threat Intelligence (CTI) sharing. However, in many cases, CTI contains sensitive information that has the potential to leak valuable information or cause reputational damage to the sharing organisation. While a number of existing CTI sharing approaches have utilised blockchain to facilitate privacy, it can be highlighted that a comprehensive approach that enables dynamic trust-based decision-making, facilitates decentralised trust evaluation and provides CTI producers with highly granular sharing of CTI is lacking. Subsequently, in this paper, we propose a blockchain-based CTI sharing framework, called Priv-Share, as a promising solution towards this challenge. In particular, we highlight that the integration of differential sharing, trustless delegation, democratic group managers and incentives as part of Priv-Share ensures that it can satisfy these criteria. The results of an analytical evaluation of the proposed framework using both queuing and game theory demonstrate its ability to provide scalable CTI sharing in a trustless manner. Moreover, a quantitative evaluation of an Ethereum proof-of-concept prototype demonstrates that applying the proposed framework within real-world contexts is feasible.
Ransomware attacks, exploiting cryptocurrencies like Bitcoin for ransom payments, represent a significant cybersecurity threat. Detecting these malicious activities within the Bitcoin network is challenging due to complex transaction patterns and blockchain’s inherent anonymity. Understanding these patterns is crucial for effective defense mechanisms. However, existing research lacks comprehensive analysis of ransomware behavior on the Bitcoin network, leaving gaps in understanding. Moreover, current detection strategies often struggle to accurately identify ransomware activities. To address these gaps, this study conducted experimental research using the BitcoinHeist dataset. Employing machine learning techniques and feature engineering, the analysis aims to decipher transaction patterns and identify ransomware characteristics. The model achieves an accuracy of 85%, demonstrating its effectiveness in detecting ransomware activities. By bridging theoretical knowledge with empirical analysis, this research enhances understanding and aids in developing robust defense strategies against ransomware attacks.