Blockchain Papers

Prasant Nawani, Prakash Srivastava, Ramesh Singh Rawat

No abstract is available for this record.

Millati Pratiwi, Y H Choi

The rapid growth of Decentralized Finance (DeFi) has been accompanied by increasingly sophisticated security threats. Price Oracle Manipulation Attacks (POMA), a critical vulnerability, have evolved beyond simple economic exploits to include complex, multi-transaction attacks that exploit smart contract logic, causing hundreds of millions in losses. State-of-the-art detection methods, however, often focus on single-transaction, economic manipulations and typically fail to identify these emerging attack vectors, particularly when smart contract source code is unavailable. This article introduces a novel, EVM-compatible detection pipeline that addresses this gap. By combining transaction event logs and execution traces, we engineer a rich set of semantic and structural features that capture the underlying behavior of on-chain operations. We train a regularized autoencoder exclusively on the features of benign transactions to learn a deep representation of normal activity, flagging significant deviations as malicious. Our evaluation demonstrates the effectiveness of this approach, achieving 100% recall on a comprehensive dataset of single-transaction attacks and 98.25% event-level recall on a new, manually collected dataset of real-world multi-transaction exploits, with an overall precision of 97.15%. We present a robust, learning-based model capable of identifying both known and unseen POMA variants without relying on source code. Furthermore, we contribute a new dataset of multi-transaction attacks to foster further research, providing a more generalizable and resilient approach to securing the DeFi ecosystem.

Stephen Taylor, Martin Gile Jaatun, Aida Omerovic, Ravishankar Borgaonkar · 15 authors

Internet of things (IoT) ecosystems introduce significant cybersecurity challenges due to device heterogeneity, firmware opacity, constrained resources, distributed deployment, and the integration of devices within wider socio-technical systems where they are used. Existing approaches to address IoT cybersecurity typically address isolated aspects of this problem, such as vulnerability enumeration, anomaly detection, or risk assessment; but without integrating them across the full lifecycle of devices and systems. This paper presents an extensible architecture that unifies cybersecurity testing, runtime monitoring, contextual risk modelling, secure update mechanisms, and auditable evidence management for IoT ecosystems that aims to address these challenges. The framework supports both device under test and system under test perspectives and integrates component-level techniques (such as SBOM generation, network fuzzing, machine learning-based anomaly detection, and access control risk evaluation) with system-level, knowledge-based, risk modelling to capture threat propagation across interconnected assets. A distributed ledger-backed auditable data infrastructure ensures integrity and traceability of indicators, results, and decisions. Automated workflow orchestration enables flexible tool chaining and lifecycle-aware execution aligned with established security development lifecycles. The approach is validated through three industrial use cases in aviation cargo monitoring, smart manufacturing, and telecommunication residential gateways. Results demonstrate the feasibility of combining static analysis, runtime indicators, and dynamic risk assessment to prioritise vulnerabilities contextually, detect anomalous behaviour, and support secure patch deployment in resource-constrained environments. The work advances lifecycle-integrated, system-aware cybersecurity assurance for IoT ecosystems and highlights the need for contextualised, interoperable tooling to address systemic vulnerability and risk propagation in complex systems where IoT, ICT and people interact.

Prakash Prasad

This chapter provides a practical guide to setting up a cryptocurrency investigation lab, including installing and testing open-source tools. It also covers the creation of custom-made tools for crypto investigation.

Ігор Романович Соломка, Богдан Богданович Любінський

This study investigates the process of validator committee selection in permissionless blockchain networks operating on the Proof-of-Stake algorithm. The task addressed relates to the vulnerability of conventional static selection schemes to identity-forging (Sybil) attacks. A fixed baseline weight facilitates stake splitting among numerous fictitious entities, allowing attackers to gain control over the network. In response to these challenges, a method for the dynamic stabilization of consensus based on an adaptive control law has been devised. This method automatically regulates the weight mixing intensity using the smoothed Gini coefficient. The concept of Proof-of-Persistence has been proposed, which replaces the uniform baseline distribution with a time-weighted reputation of the participants. The analytical and experimental analyses of data from 10 real-world networks were conducted, demonstrating that the proposed mechanism reliably reduces the aggregate weight of a potential attacker. The result is attributed to the fact that when new entities are created, their prior participation experience is not considered, and the loss of reputational weight outweighs the benefits of acquiring new baseline shares. This makes the stake-splitting strategy economically unviable. An important distinct feature is that the system's adaptation is carried out exclusively on the basis of deterministic on-chain data, without the need for external identification. The proposed system functions autonomously: under a normal mode, intervention is minimized, while under the risk of an oligopoly, protection is strengthened. The results could be practically applied to the architecture of permissionless blockchain networks as the method might be integrated both at the network protocol core level and in the form of smart contracts to enhance the security of distributed ledgers without additional manual adjustments.

Bowen Cai, Weiheng Bai, Youshui Lu, Haoran Xu · 7 authors

As blockchain ecosystems grow, financially motivated attackers increasingly exploit decentralized finance (DeFi) protocols, causing frequent and severe losses. Unlike conventional cyberattacks, DeFi exploits propagate rapidly due to the transparent and composable nature of smart contracts. We identify a critical pattern, Imitative Attack Cascade: an initial successful exploit is quickly followed by mimicking transactions that reuse attack logic with minor modifications or parameter changes. Our empirical analysis shows that over 69% of DeFi attacks exhibit strong behavioral similarity to earlier incidents, often within hours or days of the initial attack. This exposes a fundamental limitation in current reactive detection. Initial attacks are typically flagged via heuristic alerts (Tornado Cash traces, anomalous nonce usage, exploiter labels), but turning these signals into detection rules requires manual validation and handcrafted trace analysis -- a labor-intensive, slow process that leaves follow-up attacks to spread. Our goal is to ensure that once an attack has been observed, even a single instance, it can be rapidly abstracted into an actionable, generalizable detection rule. We decompose the problem into two challenges: (I) abstracting the semantics of diverse, obscure function signatures, and (II) matching transaction logic in noisy, evasive traces. We leverage two insights: (i) the open-source nature of most DeFi protocols enables high-fidelity semantic classification of function signatures; (ii) contract labels isolate essential logic by filtering irrelevant calls and classifying attack intent. Building on these, we develop GenDetect, which achieves ACC 98%, FPR 1%, FNR 3% and discovers 56 previously unrevealed attacks from the past three years. Source code and dataset: https://github.com/NobodyIsAnonymous/GenDetect_ICSE2026

Fahd Alhaidari, Sarah AlQahtani, Noura AlDossary, Rachid Zagrouba

As the Internet of Things (IoT) continues to expand across various domains, the number of connected devices is rapidly increasing, exposing IoT environments to large-scale Distributed Denial-of-Service (DDoS) botnet attacks. Due to limited computational and memory resources, IoT devices remain particularly vulnerable to traffic flooding and coordinated malicious behavior. This paper presents a layered security framework that integrates machine learning, protected gateway servers, and blockchain-based smart contracts to detect and mitigate DDoS botnet attacks in IoT environments. The proposed model performs behavioral anomaly detection off-chain using a two-stage machine learning process, while leveraging smart contracts on the blockchain for tamper-resistant logging, automated policy enforcement, and controlled economic penalties. A bounded spending mechanism and quarantine policy are introduced to discourage large-scale malicious traffic while limiting the impact on compromised legitimate devices. The system architecture and enforcement algorithms are presented to demonstrate the feasibility, scalability, and security advantages of the proposed framework.

Naga Sekhar Madala, Ali Elrashidi, S. Saranya, A. Mathankumar · 6 authors

As the Internet of Things grows rapidly, more and more companies are using dispersed sensor networks. Companies in this sector focus on smart cities, intelligent transportation, healthcare, and industrial automation. The security and reliability of the Internet of Things are challenged by factors such as device heterogeneity, limited processing resources, and decentralised data generation, even as real-time data collecting and automation are taking place. There is a risk that data could be compromised due to threats. Systematic fraud or anomalous activity detection fails when it relies on centralised security. By incorporating AI and blockchain technology, this design enhances the reliability and security of distributed sensor networks. By analysing sensor-collected data, machine learning algorithms can detect fraudulent activity, unusual operational patterns, and real-time intrusions. Integrity of data, authentication of devices, and auditability of networks are all enhanced by blockchain technology, which generates an immutable distributed ledger. The immutability of ledger data makes this feasible. Securely enabling IoT nodes to work together without centralised authorities reduces the likelihood of failure points. This study demonstrates the use of decentralised trust systems and predictive intelligence to detect anomalies and secure data. Compared with conventional Internet of Things security measures, experimental results demonstrate higher detection accuracy, fewer false positives, and greater system resilience. To ensure the integrity of missioncritical data and the reliability of operations, the platform employs scalable, secure, and intelligent Iot.

Vasanthan Athiththan, Pavithira Sivasothy

Blockchain technology has emerged as a secure and decentralized solution for data management across various domains. However, existing consensus mechanisms face challenges related to security, scalability, and energy efficiency, while blockchains remain vulnerable to sophisticated attacks such as double spending, selfish mining, and Sybil attacks. This paper proposes a novel hybrid blockchain security framework that integrates a Hybrid Consensus Algorithm (HCA) combining Proof of Stake (PoS) and Practical Byzantine Fault Tolerance (PBFT) with Machine Learning based attack detection. The hybrid consensus improves transaction finality and reduces energy consumption, while the ML module detects anomalous behaviors in real time. Experimental evaluation using a private Ethereum based blockchain demonstrates that the proposed approach improves attack detection accuracy up to 96.8 %, reduces consensus latency by 34 %, and enhances throughput by 27 % compared to traditional PoW based systems. The results confirm that integrating hybrid consensus with intelligent security mechanisms significantly strengthens blockchain resilience.

Ruchika Lochab, Luckshay Batra, HC Taneja

.This article extends the theoretical framework of Rényi extropy by establishing new properties, including its convergence to information extropy under limiting parameter conditions and its ability to assume both positive and negative values. Furthermore, it explores the interrelationships among Rényi, information, and Tsallis extropies, providing a unified perspective on these uncertainty measures. To demonstrate its practical utility, we apply Rényi extropy to analyze uncertainty in cryptocurrency markets, specifically Bitcoin (BTC) and Ethereum (ETH). Our findings reveal its superior capability in capturing non Gaussian dynamics and assessing risk compared to traditional entropy-based methods. Furthermore, we integrate machine learning techniques, including Extreme Gradient Boosting (XGBoost) and k-Nearest Neighbors (kNN) to predict BTC and ETH prices, validating the synergy between advanced statistical measures and computational forecasting. The predictive performance is evaluated using advanced XGBoost and k-NN models, assessed through RMSE and R2 metrics. The results demonstrate a significant improvement over traditional benchmarks, including Shannon entropy and ARIMA, in forecasting risk-adjusted returns. The empirical results underscore Rényi extropy’s potential as a robust tool for financial market analysis and risk management.

Kentaro Sako, Daiki Ito, Takuya Watanabe, Yuta Takata · 7 authors

Smart contracts (SCs) cannot be modified once deployed on the blockchain, making pre-deployment vulnerability identification essential. Although numerous SC vulnerability (SCVul) detection tools (SCTs) have been developed, prior evaluations have examined only limited vulnerability types, leaving it uncertain whether SCTs can comprehensively detect vulnerabilities and what characteristics their detectable vulnerabilities exhibit. Because each SCT employs distinct analysis methods and detection strategies, using multiple SCTs can be advantageous; however, the detection accuracy of such combinations has not yet been systematically evaluated. In this study, we comprehensively investigate the types and characteristics of SCVuls targeted by eight SCTs whose execution environments were successfully established and verified.

Joseph Sprute

SPT × VLSA: Novel Contributions and Scale Proof (Sprute, 2026) This paper presents five original contributions to civilizational protocol theory organized under the SPT triad (Security · Privacy · Trust) and validates them through the ERES VLSA (Very-Large System Architecture) scale test — 91 tests, 100% pass rate, spanning seven orders of magnitude from a personal THOW (~30m²) to an interstellar generation ship. The five contributions map the ERES Institute's 6 Key Development Areas onto the internet's three-tier protocol stack (TCP/HTTPS/WEB3), addressing gaps no existing standard resolves. Under Security: the Energy–Security Dependency identifies every TLS session's security as bounded by its energy supply's sustainability, resolved through SECUIR circular energy; Emergency Retransmission establishes architectural identity between peacetime and crisis delivery via GunnySack Storm Party. Under Privacy: State-Aware Identity introduces psycho-physiological coherence (ARI) into the authentication handshake with zero-knowledge sovereign disclosure through BERA/FAVORS. Under Trust: Semantic Authentication verifies the meaning of exchanges across CyberRAVE's 72-domain × 3-dimension × 3-codex evaluation space (648 semantic coordinates); Proof-of-Resonance introduces a third consensus class where bio-electric coherence — not computational expenditure — validates transactions through Meritcoin ("It's not mining — it's tuning"). The central finding is fractal scale invariance: FDRV at maximum scale IS the interstellar vessel, and the THOW is its test article. A worked medical exchange example demonstrates all five contributions operating simultaneously on a single transaction. Companion to ERES Institute: Complete Architecture (Sprute, 2026). Published under CCAL v2.1.

Hamza Ibrahim, Love Allen Chijioke Ahakonye, Jae-Min Lee, D. Kim

The Industrial Internet of Things (IIoT) has transformed critical infrastructure but has also introduced severe security vulnerabilities, with breaches capable of causing catastrophic physical and operational damage. While blockchain technology offers a promising foundation for tamper-proof logging, existing platforms are often ill-suited for IIoT due to high latency, low throughput, and excessive energy consumption. Furthermore, most current research treats intrusion detection, secure logging, and system recovery as isolated components, lacking a unified framework for autonomous, verifiable resilience. To bridge this critical gap, this paper introduces PureChain, a holistic, secure, and resilient ecosystem. PureChain integrates a custom lightweight blockchain with a deep learning-based intrusion detection system and a novel verifiable recovery protocol, creating a closed-loop security model. The framework leverages a novel Proof of Authority and Association (PoA2) consensus mechanism, achieving high throughput (16.82 TPS), low latency (0.0594 s), and minimal energy consumption (12.43 W), demonstrating suitability for resource-constrained IIoT environments compared to general-purpose platforms like Ethereum and Hyperledger which are optimized for different use cases. Upon intrusion detection by optimized models like XGBoost (99.87% accuracy), immutable blockchain logs actively trigger and cryptographically attest to infrastructure-enforced recovery actions such as device isolation via SDN switches or state rollback through hardware management controllers. Extensive evaluation on benchmark IIoT datasets (IoT-CAD and IoTForge) demonstrates a detection-to-recovery success rate of up to 98.59% while maintaining 100% data integrity. PureChain establishes a new paradigm that unifies real-time threat intelligence, blockchain-based trust, and provable autonomous recovery for next-generation IIoT security.

D. Victor Abhishek, Y. Meena Kumari, G Surekha, B. Sai Hemanth Reddy

Web3 authentication has become a key to the decentralized applications and allows users to sign in using cryptographic wallet signatures rather than centralized credentials. Nevertheless, recent research has shown that the current Web3 authentication systems are very susceptible to message-based attacks especially Blind Message Attacks, which takes advantage of unclear message semantics, lack of domain binding, insecurity with nonce, and lack of verification on the server side. This paper critically examines those vulnerabilities based on realworld deployments of Web3 authentication and shows that a large percentage of extant implementations can be compromised by an attacker. In order to handle such issues, we present a configurable and deployable authentication model, the socalled Secure Web3 Authentication Framework (SWAF), that implements structured authentication messages, high message equality checking, nonce management in context-sensitive fashion, and protocol-level domain binding. The suggested scheme is tested on a real-world set of 29 Web3 authentication examples, in which it perfectly mitigates Blind Message Attacks, Replay Attacks, Blind Multi-Message Attacks, as well as, cross-domain authentication abuses keeping its computational overhead at only a small fraction. Our findings indicate that looking at protocol-level authentication semantics strictly is feasible and necessary to enhancing confidence and security in Web3 authentication schemes.

Anthony Coslett

Recent disclosures of industrial-scale knowledge distillation — including campaigns comprising millions of fraudulent API exchanges targeting frontier models [Anthropic, 2026] — have made post-hoc detection of model theft a critical security requirement. Building on a formally-verified framework of log-prob order-statistic geometry, we investigate the adversarial resilience of neural network identity across 72 experimental checkpoints. We establish a Two-Layer Identity Hypothesis: a model’s structural identity (weights-regime geometry) is empirically invariant to distillation (within acceptance threshold epsilon across all 18 protocols), while its functional identity (API-regime Poisson Point Process residuals) predictably transfers to the student, converging up to 52% toward the teacher’s template. Stress-testing this forensic channel against a white-box adversary, we find that functional provenance is geometrically coupled to the knowledge transfer objective. Adversarial erasure gradients are consistently dominated by the distillation loss, achieving only a transient suppression that rebounds within one epoch. Passive fine-tuning on fresh data erases the trace more effectively than any adversarial method, but at a measurable cost to general capability — revealing a Pareto frontier with no favorable region for the adversary. This establishes API forensics as a time-sensitive detective control (“The Tripwire”) and weights-regime identity as the immutable anchor (“The Vault”). Finally, we observe an apparent vulnerability: a cross-family adversarial spoofing attack achieves 69.4% convergence toward a decoy’s fingerprint, while same-family spoofing catastrophically fails. We resolve this paradox by mapping the PPP-residual vector space, revealing that models cluster by capability topology, not corporate lineage. Cross-family “spoofing” is a spatial illusion caused by a narrow 7.8 degree alignment between the decoy and the primary distillation trajectory (R2 = 0.995), whereas same-family decoys are anti-aligned. Across all adversarial interventions, the underlying Gumbel universality (delta_norm) remains invariant (CV = 1.9%). We conclude that during active distillation, an adversary cannot simultaneously acquire a teacher’s capabilities and erase or redirect the forensic trace. In this setting, the geometry forbids it. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Mansi Dilip Shriwastav, Madhavi Satish Avhankar

The increasing deployment of Agricultural Internet of Things (Ag-IoT) systems is transforming food production and enabling climate-resilient farming practices.However, the growing reliance on interconnected sensing, automation, and cloud platforms significantly expands the attack surface, exposing agricultural operations to cyber threats that can disrupt critical processes, compromise data integrity, and undermine food security.This paper explores adaptive cybersecurity mechanisms designed to enhance the resilience of Ag-IoT ecosystems operating under climate-induced environmental and network constraints.The proposed approach integrates context-aware access control, federated threat learning, zero-trust architectures, and distributed ledger technologies to secure dataflows, device interactions, and supply-chain processes.Experimental evaluations and simulated farm scenarios demonstrate improved attack detection, operational continuity, and system reliability during extreme weather events and adversarial conditions.The results suggest that adaptive cybersecurity strategies are essential for protecting next-generation digital agriculture and ensuring resilient, secure, and sustainable food systems in an era of accelerating climate variability.

Turki Alshammari, Talal Albalawi

With the increase in the rate of cyber threats, such as ransomware, social engineering, and zero-day exploits, it is urgent to adopt new security mechanisms like Security Orchestration, Automation, and Response (SOAR) systems. The increase in cyber threats has not only amplified in frequency but also in sophistication. This escalation has forced organizations to rethink traditional defense strategies. SOAR has shown itself to be an important solution by automating repetitive tasks and helping security teams in focusing on strategic threat hunting as well as mitigation. The integration of AI and ML in SOAR frameworks helps in predictive analytics, in which systems can anticipate potential breaches based on pattern recognition from vast datasets. The role of blockchain is to enhance data integrity and help enable secure and decentralized threat intelligence sharing between stakeholders. This paper presents a systematic literature review (SLR) on recent advancements in SOAR technologies, especially the incorporation of artificial intelligence (AI), machine learning (ML), and blockchain; it also reviews case studies across various industry sectors, such as healthcare, finance, industrial control systems, and critical infrastructures, as well as the challenges facing SOAR adoption. By examining 29 studies from academic research, industry case studies, and technical reports, the review synthesizes methodologies, architectures, and performance outcomes to summarize the current state of SOAR systems. The research found that SOAR can significantly reduce incident response times and improve threat detection accuracy, with findings indicating that SOAR can lower response times by up to 80% compared to legacy systems, although implementation costs may reach as high as $5 million. Additionally, specialized personnel are still needed to operate these systems. The skills gap increases barriers to adoption, as few professionals possess expertise in cybersecurity as well as in automation tools. Future directions emphasize developing hybrid models that blend human intuition with machine efficiency for more robust defenses. Finally, the review discusses future research directions to help SOAR further scale, interoperate across platforms, and enable autonomous decision-making

José-María Oliet-Villalba, Jose-Amelio Medina-Merodio, Mikel Ferrer-Oliva, José-Javier Martínez-Herráiz

The rapid growth of cryptocurrencies and non-fungible tokens (NFTs) has expanded technological opportunities, but it has also increased the exposure surface to cyber threats, creating a need for a more precise understanding of the field’s scientific evolution. This study aims to systematically analyse academic output related to cybersecurity and cyber threats within cryptocurrency and NFT ecosystems, identifying central themes, the most influential authors, and emerging trends. A bibliometric methodology was employed, based on the PRISMA 2020 protocol and scientific mapping tools such as SciMAT (v1.1.06) and VOSviewer (v1.6.20), using a corpus of 337 articles published between 2014 and 2025. The findings indicate sustained growth in the literature, a marked geographical and editorial concentration, and the presence of motor themes such as blockchain, cybersecurity, emerging technologies and illegal mining, alongside emerging areas such as intrusion detection. The results also reveal a progressive integration of artificial intelligence techniques in the detection and prevention of attacks. In conclusion, this study provides a comprehensive overview of the state of the art, identifies critical gaps, and underscores the need for interdisciplinary approaches to strengthen security in decentralised environments.

Minh Trung Tran, Brayden Killeen, Tony McGrath

Slow Liquidity Drain (SLID) scams have recently emerged as a subtle and persistent threat within the decentralized finance (DeFi) environment. While prior studies have introduced heuristic and machine learning techniques for identifying SLID behaviors, deploying these methods in real-world industrial systems reveals substantial challenges. In particular, updated large-scale datasets collected from operational DeFi platforms show that SLID behaviors and their effective detection time-range evolve over time, rendering previously reported fixed thresholds unreliable for production use. This work presents a data-driven reassessment of SLID detection under contemporary DeFi conditions and demonstrates that the observation window required for reliable detection shifts as new data and new scam behaviors emerge. Building on these findings, we introduce an industry-oriented detection framework that decouples machine learning models from time-range selection and supports adaptive operation without retraining or feature redesign. Rather than proposing a single deployment strategy, we outline two practical operating modes: a slow-adaptive mode that prioritizes stability and auditability through periodic window updates, and a fast-adaptive mode that enables flexible sensitivity and tiered alerts for security-driven environments. Together, these designs translate empirical insights into concrete system architectures suitable for large-scale DeFi monitoring, bridging the gap between academic SLID detection research and production deployment requirements.

Ruslan Tiahniienko

Description of the Invention The present invention relates to the field of cybersecurity and artificial intelligence, and more particularly to a method and system for local autonomous internal penetration testing using artificial intelligence agents augmented by retrieval-based knowledge mechanisms. The invention discloses a technical solution in which one or more autonomous artificial intelligence agents operate within an internal enterprise environment to continuously assess the security posture of information systems, networks, services, and configurations. Unlike conventional penetration testing approaches that rely on manual effort, predefined scripts, or static rule-based scanners, the proposed system dynamically adapts its behavior based on observed system states, retrieved security knowledge, and learned experience. The system employs reinforcement learning to model penetration testing as a sequential decision-making problem, wherein an agent observes an environment state, selects an action from a defined action space, receives a reward based on the outcome, and updates its policy to maximize an expected cumulative reward associated with discovering security weaknesses, misconfigurations, or policy violations. The environment may include hosts, network topology, authentication mechanisms, access control rules, and security monitoring components. To overcome the limitations of fixed context windows and static knowledge in machine learning models, the invention integrates retrieval-augmented mechanisms. At each decision step, the agent retrieves relevant contextual information from a locally stored vector database containing embeddings of security documentation, vulnerability descriptions, configuration policies, compliance requirements, historical findings, and system metadata. The retrieval process is performed using approximate nearest neighbor search, enabling low-latency access to relevant knowledge at scale. The retrieved contextual data is used to augment the agent’s internal state representation and, in some embodiments, to construct augmented prompts for a local large language model responsible for high-level planning, reasoning, or task decomposition. This combination enables the agent to make informed decisions grounded in both learned behavior and up-to-date domain-specific knowledge. In certain embodiments, the system supports multiple cooperating agents, each specializing in a subset of penetration testing activities, such as reconnaissance, vulnerability identification, exploitation simulation, lateral movement analysis, or compliance auditing. Coordination between agents is achieved through a centralized planner or critic during training, while execution may occur in a decentralized manner. A key feature of the invention is that all data processing, retrieval, learning, and inference are performed locally within the organization’s infrastructure, without transmitting sensitive information to external systems. This design preserves confidentiality, complies with regulatory and organizational privacy requirements, and enables deployment in restricted or high-security environments. The disclosed method and system provide continuous, adaptive, and knowledge-informed internal security assessment, improving the detection of security weaknesses while reducing reliance on manual testing and static tools.

Mariam Akkawi, Khaleel Mershad

Front-running attacks have become a threat to blockchain security. By exploiting transaction ordering, attackers use front-running to gain profits on Ethereum-based blockchains. Existing heuristics and ML approaches fail to capture the complex relational dependencies in these attacks. We propose a novel framework by leveraging instruction-tuned large language models, Llama-3.2-3B and Gemma-2-2B, for multi-class front-running detection on Ethereum. Through parameter-efficient fine-tuning with LoRA and an enriched dataset augmented with blockchain metadata from Alchemy and Chainstack, our models achieve up to 96.4 % macro accuracy, surpassing the baseline approach by 8.7 %. We further identify that 256 tokens is the optimal input length while discussing the trade-offs between runtime efficiency and performance. Our findings demonstrate that LLMs are a powerful tool for learning complex transactional patterns, which is crucial for blockchain security.

Muhammad Arshad, Ali Algarni

This study presents HoloCyberChain, an entropy-driven blockchain framework for decentralized cyber-threat intelligence with formal verification and privacy preservation. Each cyber event is encoded as a four-dimensional entropy fingerprint capturing structural, temporal, behavioral, and propagation uncertainty. A novel Shannon–β hybrid distance integrates residual-entropy geometry with β-divergence-based distributional separation, yielding a unified statistical–topological measure of threat dissimilarity. Residuals are transformed into calibrated novelty probabilities through a logistic uniqueness gate, while a proof-of-detection consensus protocol enables publicly verifiable and Byzantine-resilient acceptance of novel intelligence. Privacy is maintained using zero-knowledge entropy proofs, and accepted threats are organized into a spectral threat-intelligence graph that preserves family-level separability. Simulation experiments demonstrate reliable discrimination (ROC-AUC ≈0.81, PR-AUC ≈0.77) and stable calibration under noise and concept drift. Real-world validation using the CICIDS-2017 dataset (225 745 flows, 79 features; 97 718 benign and 128 027 DDoS flows) confirms that DDoS traffic exhibits higher Shannon–β entropy, with right-shifted density profiles, higher medians, and tighter interquartile ranges relative to benign traffic, indicating that the proposed entropy formulation preserves separability under realistic traffic imbalance. These empirical results align with theoretical guarantees and simulation findings, establishing HoloCyberChain as a reproducible, entropy-verified foundation for scalable and privacy-preserving cyber-threat intelligence sharing.

Amro Alghamdi, Ismail Keshta

The rapid proliferation of smart home IoT devices has introduced unprecedented cybersecurity vulnerabilities, necessitating scalable and privacy-preserving intrusion detection systems (IDS). Federated Learning (FL) offers a promising decentralized approach by training models locally without sharing raw data, but it remains susceptible to poisoning attacks and relies on a vulnerable central aggregator. This paper presents a novel blockchain-enhanced FL framework tailored for smart home IDS, integrating multiple consensus mechanisms—Proof-of-Stake (PoS), Practical Byzantine Fault Tolerance (PBFT), and Proof-of-Authority (PoA)—for the first time in this context. Our approach uniquely combines differential privacy (DP) and secure aggregation (SA) within a blockchain-managed workflow to mitigate gradient inversion and membership inference attacks while ensuring tamper-resistant, decentralized trust. Experimental evaluation using the N-BaIoT dataset demonstrates that the proposed system achieves up to 88.3% detection accuracy with manageable latency (~200 ms/round) and formal privacy guarantees ($\varepsilon$=1.0 DP). The framework introduces 52.8% system overhead compared to vanilla FL—a reasonable trade-off for enhanced security and privacy. This work establishes a robust, transparent, and scalable security infrastructure for smart homes, effectively addressing the limitations of both centralized and conventional FL-based IDS.

Ahmed El-Kosairy, Heba K. Aslan, Nashwa Abdelbaki

This paper introduces a cybersecurity framework that combines a deception-based ransomware detection system, called the Intrusion and Ransomware Detection System for Cloud (IRDS4C), with a blockchain-enabled Cyber Threat Intelligence platform (CTIB). The framework aims to improve the detection, reporting, and sharing of ransomware threats in cloud environments. IRDS4C uses deception techniques such as honeypots, honeytokens, pretender network paths, and decoy applications to identify ransomware behavior within cloud systems. Tests on 53 Windows-based ransomware samples from seven families showed an ordinary detection time of about 12 s, often quicker than tralatitious methods like file hashing or entropy analysis. These detection results are currently limited to Windows-based ransomware environments, and do not yet cover Linux, containerized, or hypervisor-level ransomware. Detected threats are formatted using STIX/TAXII standards and firmly shared through CTIB. CTIB applies a hybrid blockchain consensus of Proof of Stake (PoS) and Proof of Work (PoW) to ensure data integrity and protection from tampering. Security analysis shows that an attacker would need to control over 71% of the network to compromise the system. CTIB also improves trust, accuracy, and participation in intelligence sharing, while smart contracts control access to erogenous data. In a local prototype deployment (Hardhat devnet + FastAPI/Uvicorn), CTIB achieved 74.93–125.92 CTI submissions/min, The number of attempts or requests in each test was 100 with median end-to-end latency 455.55–724.99 ms (p95: 577.68–1364.17 ms) across PoW difficulty profiles (difficulty_bits = 8–16).