Yuyan Sun, Sun Enbo, Zhao Erfan, Liu Yangyang · 6 authors
In recent years, the field of blockchain technology has witnessed significant growth, particularly in its extensive application within the financial sector. However, this progress has also brought a concerning issue whereby an increasing number of users are becoming vulnerable to phishing scams. Many extant studies are focused on this issue; nonetheless, a paucity of emphasis has been placed on the comprehensive characterization of Ethernet transaction data from multiple perspectives which enhances the precision and generalization capabilities of the model. Consequently, within the context of this paper, we introduce an innovative detection model. In an effort to mitigate overhead while ensuring the acquisition of substantial information, we initially preprocess Ethernet transaction data and establish transaction subgraphs. Then, we leverage a graph autoencoder to amalgamate local structural information, global structural information, and node features within the graph, culminating in the detection of phishing scams. Our model significantly enhances detection accuracy by exploiting multi-view features. We implemented this method on the dataset from TSGN, and the results show that the accuracy of our method is 95.39%, which is at least 4.07% higher than other related methods.
Kevin K.W. Ho, Dickson K.W. Chiu, C. H. Au, Francis Dalisay · 6 authors
This position article summarizes the panelistsâ presentations and discussions at the panel âFake News, Misinformation, and Privacy: How COVID-19 Pandemic Changed Our Society,â held at the 15th International Conference on Information Resources Management (Conf-IRM 2022) on October 18, 2022. The panel discussed their views on (1) how to stop the spreading of health misinformation; (2) how information sources affect online health information behavior; (3) how news literacy increases people's desire to seek out information by increasing their skepticism; and (4) how political beliefs, trust, and privacy concerns affect people's decisions during COVID-19. This article also discusses how blockchain and distributed ledger technologies can help tackle the fake news and misinformation problem.
The proliferation of smart contracts on blockchain technology has led to several security vulnerabilities, causing significant financial losses and instability in the contract layer. Existing machine learning-based static analysis tools have limited detection accuracy, even for known vulnerabilities. In this study, we propose a novel deep learning-based model combined with attention mechanisms for identifying security vulnerabilities in smart contracts. Our experiments on two large datasets (SmartBugs Wild and Slither Audited Smart Contracts) demonstrate that our approach successfully achieves a 90% detection accuracy in identifying smart contract reentrancy attacks (e.g. performing better than other existing state-of-the-art deep learning-based approaches). In addition, this work also establishes the practical application of deep learning-based technology in smart contract reentrancy vulnerability detection, which can promote future research in this domain.
Mutlu Tahsin ĂstĂŒndaÄ, Gizem Yıldız, Mustafa TANRIVERDÄ°, Togay Seçkin BÄ°RBUDAK
In this study, it is aimed to analyze the articles on Web3 and present the general situation about Web3 to researchers. Within the scope of this purpose, the trends of the studies published on Web3 according to years, the trends of the journals in which they were published, the institutions and countries that contributed the most, the keywords used in the studies, the topics and themes based on the studies, and the distribution of research areas were revealed. The research is based on bibliometric analysis. A total of 280 articles published in WoS and SCOPUS databases were analyzed. WoSViewer and Bibliometrix programs were used in data analysis. The findings were analyzed and interpreted separately in WoS and SCOPUS. As a result of the research, there was a significant increase in studies on Web3 in 2022, and the journals with the highest number of publications in WoS and SCOPUS differ. The countries that contributed the most to Web3 were China, The USA, India, England, Germany. The most cited countries are China, the USA, India, England, Iran and Canada. In general, it can be said that countries and institutions have conducted studies on Web3 by addressing many issues related to Web3. Within the scope of the results, Web3 studies address many different disciplines with many topics. However, there is a need to deepen the studies. The policies, practices and even the laws created by countries on Web3 are important for studies on Web3. Blockchain is one of the most studied topics, but it is understood that there are some hesitations about blockchain security. For this reason, Web3 studies can be conducted to increase blockchain security.
Yu Zhou, Shang Gao, Weiwei Qiu, Kai Lei · 5 authors
Though designed with security in mind, blockchains are vulnerable to various kinds of attacks, especially when the network computational power is low. Selfish mining is one of the most rudimentary and notorious attacks, which maliciously renders blocks found by honest miners orphaned by strategically withholding and revealing the found blocks. In this paper, we analyze the profitability of selfish mining under the checkpoint mechanismâa mechanism that has been adopted as a finality gadget by many blockchains like Ethereum and Bitcoin Cash. We develop a rigorous analysis method and conduct quantitative evaluations in various scenarios to explore the mechanism's suppression effect on selfish mining. The results illustrate that the checkpoint mechanism can restrict the profit of selfish mining and increase the threshold of computational power that makes selfish mining profitable, suggesting that it is a practical defense mechanism against selfish mining.
Phishing scams have become the most serious type of crime involved in Ethereum. However, existing methods ignore the natural camouflage and sparse distribution of phishing scams in Ethereum leading to unsatisfactory performance, and they are also limited by the data scale which cannot be applied to real-world dynamic scenarios. In this paper, we propose a Transaction Graph Contrast network (TGC) to enhance phishing scam detection performance on Ethereum. TGC inputs subgraphs instead of the entire graph for training, which eases the modelâs requirements for machine configuration and data connectivity. Motivated by phishing nodes are surrounded by normal nodes, we design the comparison between node-level to help phishing nodes learn the unique properties of themselves different from their neighbors. Observing the small number and sparse distribution of phishing nodes, we narrow the distance between phishing nodes by comparing node context-level structures, so as to learn universal transaction patterns. We further combine the obtained features with common statistics to identify phishing addresses. Evaluated on real-world Ethereum phishing scams datasets, our TGC outperforms the state-of-the-art methods in detecting phishing addresses and has obvious advantages in large-scale and dynamic scenarios.
In recent years, there have been incidents which decreased people's trust in some organizations and authorities responsible for ratings and accreditation. For a few prominent examples, there was a security breach at Equifax (2017), misconduct was found in the Standard & Poor's Ratings Services (2015), and the Accrediting Council for Independent Colleges and Schools (2022) validated some of the low-performing schools as delivering higher standards than they actually were. A natural solution to these types of issues is to decentralize the relevant trust management processes using blockchain technologies. The research problems which are tackled in this thesis consider the issue of trust in reputation for assessment and review credibility at different angles, in the context of blockchain applications. We first explored the following questions. How can we trust courses in one college to provide students with the type and level of knowledge which is needed in a specific workplace? Micro-accreditation on a blockchain was our solution, including using a peer-review system to determine the rigor of a course (through a consensus). Rigor is the level of difficulty in regard to a student's expected level of knowledge. Currently, we make assumptions about the quality and rigor of what is learned, but this is prone to human bias and misunderstandings. We present a decentralized approach that tracks student records throughout the academic progress at a school and helps to match employers' requirements to students' knowledge. We do this by applying micro-accredited topics and Knowledge Units (KU) defined by NSA's Center of Academic Excellence to courses and assignments. We demonstrate that the system was successful in increasing accuracy of hires through simulated datasets, and that it is efficient, as well as scalable. Another problem is how can we trust that the peer reviews are honest and reflect an accurate rigor score? Assigning reputation to peers is a natural method to ensure correctness of these assessments. The reputation of the peers providing rigor scores needs to be taken into account for an overall rigor of a course, its topics, and its tasks. Specifically, those with a higher reputation should have more influence on the total score. Hence, we focused on how a peer's reputation is managed. We explored decentralized reputation management for the peers, choosing a decentralized marketplace as a sample application. We presented an approach to ensuring review credibility, which is a particular aspect of trust in reviews and reputation of the parties who provide them. We use a Proof-of-Stake based Algorand system as a base of our implementation, since this system is open-source, and it has a rich community support. Specifically, we directly map reputation to stake, which allows us to deploy Algorand at the blockchain layer. Reviews are analyzed by the proposed evaluation component using Natural Language Processing (NLP). In our system, NLP gauges the positivity of the written review, compares that value to a scaled numerical rating given, and determines adjustments to a peer's reputation from that result. We demonstrate that this architecture ensures credible and trustworthy assessments. It also efficiently manages the reputation of the peers, while keeping reasonable consensus times. We then turned our focus on ensuring that a peer's reputation is credible. This led us to introducing a new type of consensus called "Proof-of-Review". Our proposed implementation is again based on Algorand, since its modular architecture allows for easy modifications, such as adding extra components, but this time, we modified the engine. The proposed model then provides a trust in evaluations (review and assessment credibility) and in those who provide them (reputation credibility) using a blockchain. We introduce a blacklisting component, which prevents malicious nodes from participating in the protocol, and a minimum-reputation component, which limits the influence of under-performing users. Our results showed that the proposed blockchain system maintains liveliness and completeness. Specifically, blacklisting and the minimum-reputation requirement (when properly tuned) do not affect these properties. We note that the Proof-of-Review concept can be deployed in other types of applications with similar needs of trust in assessments and the players providing them, such as sensor arrays, autonomous car groups (caravans), marketplaces, and more.
With the proliferation of blockchain technology in decentralized applications like decentralized finance and supply chain and identity management, smart contracts operating on a blockchain frequently encounter security issues such as reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and integer overflow vulnerabilities. These security concerns pose a significant risk of causing substantial losses to user accounts. Consequently, the detection of vulnerabilities in smart contracts has become a prominent area of research. Existing research exhibits limitations, including low detection accuracy in traditional smart contract vulnerability detection approaches and the tendency of deep learning-based solutions to focus on a single type of vulnerability. To address these constraints, this paper introduces a smart contract vulnerability detection method founded on multimodal feature fusion. This method adopts a multimodal perspective to extract three modal features from the lifecycle of smart contracts, leveraging both static and dynamic features comprehensively. Through deep learning models like Graph Convolutional Networks (GCNs) and bidirectional Long Short-Term Memory networks (bi-LSTMs), effective detection of vulnerabilities in smart contracts is achieved. Experimental results demonstrate that the proposed method attains detection accuracies of 85.73% for reentrancy vulnerabilities, 85.41% for timestamp dependency vulnerabilities, 83.58% for tx.origin vulnerabilities, and 90.96% for integer Overflow vulnerabilities. Furthermore, ablation experiments confirm the efficacy of the newly introduced modal features, highlighting the significance of fusing dynamic and static features in enhancing detection accuracy.
Web3, the next generation of the Internet, represents a decentralized and democratized web. Although it has garnered significant public interest and found numerous real-world applications, there is a limited understanding of people's perceptions and experiences with Web3. In this study, we conducted an empirical study to investigate the categories of Web3 applications and their popularity, as well as the potential challenges and opportunities within this emerging landscape. Our research was carried out in two phases. In the first phase, we analyzed 200 popular Web3 projects associated with 10 leading Web3 venture capital firms. In the second phase, we collected and examined code-related data from GitHub and market-related data from blockchain browsers (e.g., Etherscan) for these projects. Our analysis revealed that the Web3 ecosystem can be categorized into two groups, i.e., Web3 infrastructure and Web3 applications, with each consisting of several subcategories or subdomains. We also gained insights into the popularity of these Web3 projects at both the code and market levels and pointed out the challenges in the Web3 ecosystem at the system, developer, and user levels, as well as the opportunities it presents. Our findings contribute to a better understanding of Web3 for researchers and developers, which in turn promotes further exploration and advancement in this innovative field.
Ayodeji Adeniran, Mohammed Alkinoon, Aziz Mohaisen
We present our results on analyzing and understanding the behavior and security of various metaverse platforms incorporating cryptocurrencies. We obtained the top metaverse coins with a capitalization of at least 25 million US dollars and the top metaverse domains for the coins, and augmented our data with name registration information (via whois), including the hosting DNS IP addresses, registrant location, registrar URL, DNS service provider, expiry date and check each metaverse website for information on fiat currency for cryptocurrency. The result from virustotal.com includes the communication files, passive DNS, referrer files, and malicious detections for each metaverse domain. Among other insights, we discovered various incidents of malicious detection associated with metaverse websites. Our analysis highlights indicators of (in)security, in the correlation sense, with the files and other attributes that are potentially responsible for the malicious activities.
Yuheng Zhang, Liu Pin, Guojun Wang, Peiqiang Li · 8 authors
With the evolution of blockchain technology, the issue of transaction security, particularly on platforms like Ethereum, has become increasingly critical. Front-running attacks, a unique form of security threat, pose significant challenges to the integrity of blockchain transactions. In these attack scenarios, malicious actors monitor other users' transaction activities, then strategically submit their own transactions with higher fees. This ensures their transactions are executed before the monitored transactions are included in the block. The primary objective of this paper is to delve into a comprehensive classification of transactions associated with front-running attacks, which aims to equip developers with specific strategies to counter each type of attack. To achieve this, we introduce a novel detection method named FRAD (Front-Running Attacks Detection on Ethereum using Ternary Classification Model). This method is specifically tailored for transactions within decentralized applications (DApps) on Ethereum, enabling accurate classification of front-running attacks involving transaction displacement, insertion, and suppression. Our experimental validation reveals that the Multilayer Perceptron (MLP) classifier offers the best performance in detecting front-running attacks, achieving an impressive accuracy rate of 84.59% and F1-score of 84.60%.
Sepideh HajiHosseinKhani, Arash Habibi Lashkari, Ali Mizani Oskui
Smart Contracts (SCs) are crucial in maintaining trust within blockchain networks. However, existing methods for analyzing SC vulnerabilities often lack accuracy and effectiveness, while approaches based on Deep Neural Networks (DNN) struggle with detecting complex vulnerabilities due to limited data availability. This paper proposes a novel approach to analyze Smart Contracts (SCs) vulnerabilities. Our method leverages an advanced form of Genetic Algorithm (GA) and includes the development of a comprehensive benchmark dataset consisting of 36,670 Solidity source code samples. The primary objective of our study is to profile vulnerable SCs effectively. To achieve this goal, we have devised an analyzer called SCsVulLyzer based on Genetic Algorithms, designed explicitly for profiling SCs. Additionally, we have carefully curated a new dataset encompassing a wide range of examples, ensuring the practical validation of our approach. Furthermore, we have established three distinct taxonomies that cover SCs, profiling techniques, and feature extraction. These taxonomies provide a systematic classification and analysis of information, improving the efficiency of our approach. Our methodology underwent rigorous testing through experimentation, and the results demonstrated the superior capabilities of our model in detecting vulnerabilities. Compared to traditional and DNN-based approaches, our approach achieved higher precision, recall, and F1-score, widely used metrics for evaluating model performance. Across all these metrics, our model showcased exceptional results. The customization and adaptations we implemented within the Genetic Algorithm significantly enhanced its effectiveness. Our approach detects smart contract vulnerabilities more efficiently and facilitates robust exploration. These promising results highlight the potential of GA-based profiling to improve the detection of smart contract vulnerabilities, contributing to enhanced security in blockchain networks.
The prosperity of Ethereum attracts many users to send transactions and trade crypto assets. However, this has also given rise to a new form of transaction-based phishing scam, named TxPhish. Specifically, tempted by high profits, users are tricked into visiting fake websites and signing transactions that enable scammers to steal their crypto assets. The past year has witnessed 11 large-scale TxPhish incidents causing a total loss of more than 70 million.
The Information Age, embraced by the 21st century, has seen the rapid adoption of new technologies, including in the election process. However, the security and transparency of both voters and their votes remain a concern with the centralized traditional system. The database can be tampered with, vote rigging, hacking, and booth capturing are possible. Blockchain technology provides a solution based on a decentralized and distributed system, where the database is controlled and owned by multiple users. E-voting is a quick, inexpensive, and effective way to cast a vote. Our proposed V2E system uses a Peer-to-peer network that enhances accountability and security. We will employ distributed ledger technologies to prevent vote faking and design a user credential model based on cryptographically secure Hash Functions to provide authenticity and non-repudiation. Since votes will be updated synchronously to the ledger, vote rigging, hacking, or system destruction will be nearly impossible.
Internet Traffic Analysis and Secure E-voting
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
Online social networks (OSNs) are becoming more and more integrated into people's everyday lives. In any case, since all notable OSNs are controlled, there are a few issues with privacy, management, and security. Users are usually restricted to using the services that OSN firms deploy after agreeing the OSN agreements. But a lot of contracts let OSN companies get to user data to provide personalized services like ads. Users typically have to submit a number of elaborate applications or even stop using such Online Social Network (OSN) if they don't let the businesses use their information while protecting their privacy. Blockchain technology combined with a decentralized architecture can address the aforementioned problems. In this architecture, most of the network functions are distributed among the multiple nodes. It means they are responsible for managing their own network policies, security and performance because the network traffic directly flows between those nodes. It is suggested in this project work to create an OSN service based on blockchain technology and demonstrate its decentralized operation. An enormous amount of data with generally low security requirements can be decentralized by storing it in the Interplanetary File system (IPFS). This distributes data to nodes consisting of hundreds of thousands of individual computers connected to the IPFS, rather than storing data in a single centralized server. A decentralized autonomous organization that allows users to democratically self-manage the OSN may be established in order to promote user autonomy.
Abstract The vulnerability in smart contracts (SCs) on the blockchain system may lead to severe security compromises. The SC can be invoked from an externally owned account (EOA) or a contract account (CA). The account a user creates to receive or send ether is an EOA. A CA contains codes that can interact with SCs. In Solidity SC, some vulnerabilities can only be exploited by the interactions between CAs and vulnerable SCs, which can be named externalârisky vulnerabilities . Most stateâofâtheâart (SOTA) detectors detect externalârisky vulnerabilities by executing contract codes as an EOA user, thus reporting many unexploitable vulnerabilities. Therefore, we propose a CAâtriggering method to identify exploitable externalârisky vulnerabilities in Solidity SCs. We first designed agent contracts to simulate CAs' interactions with the target SCs in the real blockchain environment. We then detect vulnerability exploitation by analyzing transaction logs between agent contracts and target SCs and identifying successful exploits. We implemented the CAâtriggering method in a tool named SoliTester and evaluated it using three benchmark datasets, which contain three types of externalârisky vulnerabilities, namely, Reentancy (RE), Unchecked Call (UcC), and TxOrigin (TO). The results show that SoliTester can efficiently detect exploitable externalârisky vulnerabilities with significantly better precisions and recalls than SOTA detectors.