The openness and transparency of Ethereum transaction data make it easy to be exploited by any entities, executing malicious attacks. The sandwich attack manipulates the Automated Market Maker (AMM) mechanism, profiting from manipulating the market price through front or after-running transactions. To identify and prevent sandwich attacks, we propose a cascade classification framework GasTrace. GasTrace analyzes various transaction features to detect malicious accounts, notably through the analysis and modeling of Gas features. In the initial classification, we utilize the Support Vector Machine (SVM) with the Radial Basis Function (RBF) kernel to generate the predicted probabilities of accounts, further constructing a detailed transaction network. Subsequently, the behavior features are captured by the Graph Attention Network (GAT) technique in the second classification. Through cascade classification, GasTrace can analyze and classify the sandwich attacks. Our experimental results demonstrate that GasTrace achieves a remarkable detection and generation capability, performing an accuracy of 96.73% and an F1 score of 95.71% for identifying sandwich attack accounts.
Wenrui Zuo, Raúl J. Mondragón, Aravindh Raman, Gareth Tyson
There have been numerous recent attempts to “decentralize” social media platforms, loosely referred to as Web3. Such ideas, often underpinned by blockchain solutions, offer decentralized equivalents of well-known services (e.g., forums, social networks, video sharing sites, microblogs). One particularly challenging function to implement in such a design is content moderation, due to the lack of central control. Consequently, they often rely on user-controlled moderation, whereby each user must create their own personal block list to filter out content they do not wish to see. This paper presents a first study of user-controlled moderation on one exemplar Web3 social microblogging platform called memo.cash. Based on a dataset covering 391K posts, we study the factors that lead users to “mute” each other. We find that the most crucial factor is the platform action count, rather than the presence of things like hate speech. We also show that the followership network plays a pivotal role in determining their visibility on the platform, further influencing their muting behavior. This leads us to design tooling to automate the muting process on a per-user basis. We model this as a recommendation problem, and experiment with a number of state-of-the-art recommender engines. We show that our system can generate effective personalized mute lists for users.
Enzo Nicourt, Benjamin Kushigian, Chandrakana Nandi, Ylìès Falcone
This paper presents a successful industrial case study on the application of mutation testing to evaluate and improve test suites for smart contracts. ERCx is a comprehensive, hand-written test suite and framework for smart contract testing, created by Runtime Verification. Despite its thoroughness, hand-written tests can miss edge cases. To address this, we employed mutation testing, which introduces small, syntactic changes, known as mutants, to the program. Mutants that go undetected by the test suite highlight its potential weaknesses, and by presenting them as testing goals, mutation testing helps developers iteratively improve their test suites. In this study, we used mutation testing to expand the ERCx test suite with five new test cases, including one potential vulnerability identified as critical by the ERCx developers. We also developed a test redundancy metric by analyzing pairwise correlation of test data on mutants; we used this redundancy metric to minimize the test suite by removing redundant tests. Finally, we ran both the full and minimized test suites on 106 real-world, faulty ERC-20 contracts to compare the suites' effectiveness and efficiency. Our findings reveal that although the minimized test suite has systematically lower running times compared to the full suite, it still detected faults in 105 of the 106 real-world tokens, retaining nearly all of the full suite's fault-detection capability.
Sebastian Bănescu, Morena Barboni, Andrea Morichetta, Andrea Polini · 5 authors
Smart contracts hold the potential to revolutionize various industries, but their implementation requires thorough testing due to the associated financial risks. Mutation testing is a powerful technique that can boost the fault-detection capabilities of a test suite, but it can also foster a deeper understanding of smart contract behavior. This work investigates the productivity of mutants with respect to their capabilities in disclosing Solidity issues. Based on these findings, it proposes an enhanced mutation strategy to better assist smart contract auditors during code inspection activities. 9 novel mutation operators are introduced in this paper and 13 existing operators are improved. The results show a $30 \%$ reduction in the number of generated mutants and time savings of $62 \%$, while increasing the set of productive mutants related to issues by $43 \%$ overall. We note that the most valuable type of mutants that could help disclose an issue as a result of manual mutant inspection was increased by $125 \%$.
Cryptocurrency is frequently used in a variety of virtual transactions to secure transactions. The few years have seen an increase in online scams, and with the advent of cryptocurrencies and their masquerading, it has never been easier for scammers. A cryptocurrency is a type of digital currency that can be exchanged for virtual goods and services over the Internet. Despite cryptocurrencies containing complex codes being kept secret which are meant to protect or preserve their security, capable hackers can nevertheless breach them. Ransomware attacks have emerged as a significant method of malware intrusion in recent years, usually, ransomware attacks take place through a website like linking the link the file gets corrupted. But here is the major scam during Bitcoin transactions. Therefore, we require improved ransomware prediction methods utilizing a suitable machine learning algorithm and a publicly accessible dataset. Using a variety of features to predict malicious transactions, abnormal Bitcoin transactions are used to evaluate these strategies.
This paper explores securing Non-Fungible Tokens (NFTs) within Ethereum's Decentralized Applications (DApps), crucial in the evolving blockchain landscape. NFTs represent a paradigm shift in digital asset ownership, but their innovation introduces security challenges. We navigate Ethereum-based NFT ecosystems, highlighting vulnerabilities like smart contract exploits and authentication issues. Emphasizing the need for proactive measures, we advocate for robust smart contract design, cryptographic protocols, decentralized identity management, and user education. Our objective is to empower the Ethereum community with a comprehensive roadmap for fortifying NFT transaction security, ensuring the integrity of digital ownership in the decentralized landscape. By addressing these challenges, we aim to contribute valuable insights to the discourse on securing blockchain innovations, fostering a safer environment for NFTs within Ethereum's DApps.
Our research paper addresses the pressing security challenges emerging within the rapidly expanding Internet of Things (IoT) landscape, with a specific focus on the IOTA Tangle—a distributed ledger based on Directed Acyclic Graph (DAG) technology. The proliferation of IoT devices has heightened the demand for secure and efficient transaction processing on distributed ledgers, but this surge also amplifies the risk of spam transactions that can compromise the integrity and efficiency of the ledger. In response to this imperative, we introduce EdgeGuard—a sophisticated rule-based spam detection system implemented on edge devices. This real-time system dynamically analyzes transaction data, applying predefined rules to differentiate between legitimate transactions and spam. Immediate action is taken to prevent spam transactions from infiltrating the IOTA Tangle, and the use of edge devices enhances the efficiency of spam detection by alleviating the load on servers. Notably, the system includes integration with real-time alerts using a messaging channel to notify system owners when spam transactions are identified. The effectiveness of EdgeGuard is rigorously validated through real-world data scenarios, demonstrating its capacity to thwart potentially harmful transactions. This research paper significantly contributes to the broader discourse on decentralized security measures, emphasizing the paramount importance of fortifying distributed ledgers. This is particularly crucial in critical IoT applications where unauthorized transactions could yield severe consequences. EdgeGuard stands as a robust solution, embodying innovation in tackling the evolving challenges posed by the intersection of IoT and distributed ledger technologies.
This work focuses on utilising Physically Unclonable Functions (PUFs) for device authentication, exploiting a device's unique manufacturing-induced hardware variations. Traditional PUF-based authentication methods often rely on trusted third parties for validation or necessitate that Verifiers maintain large databases. Existing approaches that aim to reduce storage demands by reutilizing information typically address only networklevel threats, leading to doubts about the necessity of PUFs, or they focus exclusively on adversaries aiming at non-volatile memory. This paper introduces a classification guideline that delineates the scenarios in which PUFs are necessary or advantageous. Additionally, we present a novel PUF-based authentication scheme that incorporates challenge concealment to safeguard against comprehensive invasive physical attacks. This method offers perfect hiding, an enhanced level of security compared to previous models that permitted the reusing of PUF challenges. Through this approach, we aim to provide a more secure yet efficient framework for PUF-based authentication, addressing the limitations of current methodologies and extending the protection against a broader spectrum of adversaries.
Physical Unclonable Functions (PUFs) and Hardware Security
Distributed ledger technology such as blockchain is considered essential for supporting large numbers of micro-transactions in the Machine Economy, which is envisioned to involve billions of connected heterogeneous and decentralized cyber-physical systems. This stresses the need for performance and scalability of distributed ledger technologies. Addressing this, sharding techniques that divide the blockchain network into multiple committees are a common approach to improve scalability. However, with current sharding approaches, costly cross-shard verification is needed to prevent double-spending. This article proposes a novel and more scalable distributed ledger method named ScaleGraph that implements dynamic sharding by using routing and logical proximity concepts from distributed hash tables. ScaleGraph addresses cybersecurity in terms of integrity and availability to support frequent micro-transactions between autonomous devices. Benefits of ScaleGraph include a total storage space complexity of \(O(t)\) , where \( t \) is the global number of transactions (assuming a constant replication degree). This space is sharded over \( N \) nodes so that each node needs \(O(t/N)\) storage in expectation, which provides a high level of concurrency and data localization as compared to other delegated consensus proposals. ScaleGraph allows for a dynamic grouping of validators that are selected based on a distance metric. We analyze the consensus requirements in such a dynamic setting and show that a synchronous consensus protocol allows shards to be smaller than an asynchronous one, and likely yields better performance. Moreover, we provide an experimental analysis of security aspects regarding the required size of the consensus groups with ScaleGraph. Our analysis shows that dynamic sharding based on proximity concepts brings attractive scalability properties in general, especially when the fraction of corrupt nodes is small.
Fuzzing is effective at finding vulnerabilities in traditional applications and has been adapted to smart contracts. However, existing fuzzing solutions for smart contracts are not smart enough and can hardly be applied to large-scale testing since they heavily rely on source code or ABI. In this paper, we propose a fuzzing solution ConFuzz applicable to large-scale testing, especially for bytecode-only contracts. ConFuzz adopts Adaptive Interface Recovery (AIR) and Function Information Collection (FIC) algorithm to automatically recover the function interfaces and information, supporting fuzzing smart contracts without source code or ABI. Furthermore, ConFuzz employs a Dependence-based Transaction Sequence Generation (DTSG) algorithm to infer dependencies of transactions and generate high-quality sequences to trigger the vulnerabilities. Lastly, ConFuzz utilizes taint analysis and function information to help detect harmful vulnerabilities and reduce false positives. The experiment shows that ConFuzz can accurately recover over 99.7% of function interfaces and reports more vulnerabilities than state-of-the-art solutions with 98.89% precision and 93.69% accuracy. On all 1.4M unique contracts from Ethereum, ConFuzz found over 11.92% vulnerable contracts. To the best of our knowledge, ConFuzz is the first efficient and scalable solution to test all smart contracts deployed in Ethereum.
Fuzzing is one of the major techniques for uncovering vulnerabilities in smart contracts. The effectiveness of fuzzing is significantly affected by its throughput but unfortunately existing fuzzers for smart contracts have low throughput due to the slow execution of EVM, the delay introduced by the consensus protocols, the limited parallelization capability of CPUs, and the overhead caused by the instrumented EVM. To tackle this critical issue, in this paper, we take the first step to leverage GPU’s parallel computing power to boost the throughput of smart contract fuzzing. More precisely, by converting the fuzzing workload to a SIMD task, we can activate thousands of GPU cores to test the smart contract simultaneously. To achieve this purpose, we design new solutions to address three major challenges, namely developing incremental storage to reduce GPU memory cost, proposing a stateful bitmap to embed transaction dependency to the feedback metric, and designing a parallel feedback algorithm to rule out undesired seeds that cause redundant overlaps. We implement a prototype named Mau, which first transforms the bytecode of a smart contract to a SIMD application in PTX assembly and then runs it parallelly on the GPU. We evaluate Mau using both a large and small benchmark. The experimental results demonstrate that the throughput of Mau reaches 162.37K execs/sec and 328.06K execs/sec, which leads to an 8.69-15.38X improvement to the state-of-the-art tool. Moreover, the high throughput empowers Mau to detect 1.01-2.50X more bugs and obtain 1.03–4.71X more code coverage than baselines.
Abstract This paper introduces a novel integrated hybrid malware attack detection algorithm, focusing on enhancing cybersecurity within blockchain systems by addressing the prevalent challenges of Byzantine fault tolerance, Reentrancy, and DDOS attacks. The significance of this research lies in its contribution to safeguarding blockchain technology, a cornerstone for secure, decentralized digital transactions, against sophisticated malware threats. Current cybersecurity solutions frequently fall short of offering a complete defense mechanism, making it difficult to effectively combat a variety of dynamic malware attacks at the same time. Thus, the main objective of this research is to provide a hybrid framework that combines DDOS attack prevention, reentrancy attack detection, and Byzantine fault tolerance detection into a single, cohesive architecture. The proposed hybrid framework encompasses a detailed algorithmic approach integrating SHA-256 and DSA to analyze the aforementioned three malware attacks. A hybrid model combining these algorithms, implemented in one block, has been developed to mitigate malicious activity. These measures aim to improve computational complexity and expedite execution within the network of nodes. To test the efficacy of the proposed framework, the approach is tested on the NSL-KDD dataset to analyze the malicious activities. The performance analysis of the proposed frameworks presents a recall and F1 score of 73 and .68 respectively. Furthermore, for efficient mitigation, the time and space complexity analysis is performed on proposed algorithms for attack analysis, which resulted in a combination of constant and linear time complexity operations. The findings reveal that the proposed algorithm successfully identifies and mitigates the targeted malware attacks and maintains optimal performance in terms of time and space complexity. Specifically, the algorithm showcases linear and constant time complexities across different attack vectors, ensuring swift and scalable defense capabilities. This research’s contribution to the cybersecurity field is significant, offering a robust, scalable solution that enhances the resilience of blockchain networks against a broad spectrum of malware attacks.
Ethereum has become one of the primary global platforms for cryptocurrency, playing an important role in promoting the diversification of the financial ecosystem. However, the relative lag in regulation has led to a proliferation of malicious activities in Ethereum, posing a serious threat to fund security. Existing regulatory methods usually detect malicious accounts through feature engineering or large-scale transaction graph mining. However, due to the immense scale of transaction data and malicious attacks, these methods suffer from inefficiency and low robustness during data processing and anomaly detection. In this regard, we propose an Ethereum Transaction Graph Compression method named TGC4Eth, which assists malicious account detection by lightweighting both features and topology of the transaction graph. At the feature level, we select transaction features based on their low importance to improve the robustness of the subsequent detection models against feature evasion attacks; at the topology level, we employ focusing and coarsening processes to compress the structure of the transaction graph, thereby improving both data processing and inference efficiency of detection models. Extensive experiments demonstrate that TGC4Eth significantly improves the computational efficiency of existing detection models while preserving the connectivity of the transaction graph. Furthermore, TGC4Eth enables existing detection models to maintain stable performance and exhibit high robustness against feature evasion attacks.
Love Allen Chijioke Ahakonye, Cosmas Ifeanyi Nwakanma, Dong‐Seong Kim
This paper surveys the implementation of blockchain technology in cybersecurity in Internet of Things (IoT) networks, presenting a comprehensive framework that integrates blockchain technology with intrusion detection systems (IDS) to enhance IDS performance. This paper reviews articles from various domains, including AI, blockchain, IDS, IoT, and Industrial IoT (IIoT), to identify emerging trends and challenges in this field. An analysis of various approaches incorporating AI and blockchain demonstrates the potentiality of integrating AI and blockchain to transform IDS. This paper's structure establishes the foundation for further investigation and provides a blueprint for the development of IDS that is accessible, scalable, transparent, immutable, and decentralized. A demonstration from case studies integrating AI and blockchain shows the viability of combining the duo to enhance performance. Despite the challenges posed by resource constraints and privacy concerns, it is notable that blockchain is the key to securing IoT networks and that continued innovation in this area is necessary. Further research into lightweight cryptography, efficient consensus mechanisms, and privacy-preserving techniques is needed to realize all of the potential of blockchain-powered cybersecurity in IoT.
Decentralized finance (DeFi) protocols are crypto projects developed on the blockchain to manage digital assets. Attacks on DeFi have been frequent and have resulted in losses exceeding \$77 billion. However, detection methods for malicious DeFi events are still lacking. In this paper, we propose DeFiTail, the first framework that utilizes deep learning to detect access control and flash loan exploits that may occur on DeFi. Since the DeFi protocol events involve invocations with multi-account transactions, which requires execution path unification with different contracts. Moreover, to mitigate the impact of mistakes in Control Flow Graph (CFG) connections, we validate the data path by employing the symbolic execution stack. Furthermore, we feed the data paths through our model to achieve the inspection of DeFi protocols. Experimental results indicate that DeFiTail achieves the highest accuracy, with 98.39% in access control and 97.43% in flash loan exploits. DeFiTail also demonstrates an enhanced capability to detect malicious contracts, identifying 86.67% accuracy from the CVE dataset.
In public blockchains, leaking secret keys can cause the permanent loss of crypto assets. It is imperative to understand the illicit activities on blockchains related to leaked keys. This paper presents the first measurement study that uncovers, quantifies, and characterizes the actual misuses of the leaked keys from top websites on the Internet to withdraw assets on Ethereum. By finding key-leaking web pages and joining them with transactions, the study reveals 7.29*10^6/0.59*10^6 USD worth of assets on Ethereum mainnet/Binance Smart Chain (BSC) are withdrawn from 1421/1514 leaked secret keys. Mitigations are proposed to avoid the financial loss caused by leaked keys.
Open access
User Authentication and Security Systems
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
Tanusree Sharma, Vivek Nair, Henry Wang, Yang Wang · 5 authors
Key management has long remained a difficult unsolved problem in the field of usable security. While password-based key derivation functions (PBKDFs) are widely used to solve this problem in centralized applications, their low entropy and lack of a recovery mechanism make them unsuitable for use in decentralized contexts. The multi-factor key derivation function (MFKDF) is a recently proposed cryptographic primitive that aims to address these deficiencies by incorporating commonly used authentication factors into the key derivation process. In this paper, we implement an MFKDF-based Ethereum wallet and perform a user study with 27 participants to directly compare its usability against traditional cryptocurrency wallet architectures. Our results show that MFKDF-based applications outperform conventional key management approaches on both subjective and objective metrics, with a 37% higher average SUS score (p < 0.0001) and 71% faster task completion times (p < 0.0001) for the MFKDF-based wallet.
The Internet of Things (IoT) refers to a complex network comprising interconnected devices that transmit their data via the Internet. Due to their open environment, limited computation power, and absence of built-in security, IoT environments are susceptible to various cyberattacks. Denial of service (DDoS) attacks are among the most destructive types of threats. The Multi-vector DDoS attack is a contemporary and formidable form of DDoS wherein the attacker employs a collection of compromised IoT devices as zombies to initiate numerous DDoS attacks against a target server. A Blockchain-based Operational Threat Intelligence framework, OTI-IoT, is proposed in this article to counter multi-vector DDoS attacks in IoT networks. A “Prevent-then-Detect” methodology was utilized to deploy the OTI-IoT framework in two distinct stages. During Phase 1, the consortium Blockchain network validators employ the IPS module, composed of a smart contract for attack prevention and access control, and Proof of Voting consensus, to thwart attacks. Validators are outfitted with deep learning-based IDS instances to detect multi-vector DDoS attacks during Phase 2. Alert messages are generated by the IDS module’s alert generation and propagation smart contract in response to identifying malicious IoT sources. The feedback loop from the IDS module to the IPS module prevents incoming traffic from malicious sources. The proposed OTI framework capabilities are realized as an outcome of combining and storing the outcomes of the IDS and IPS modules on the consortium Blockchain. Each validator maintains a shared ledger containing information regarding threat sources to ensure robust security, transparency, and integrity. The operational execution of OTI-IoT occurs on an individual Ethereum Blockchain. The empirical findings indicate that our proposed framework is most suitable for real-time applications due to its ability to lower attack detection time, decreased block validation time, and higher attack prevention rate.
Abstract: Eclipse attacks pose a serious threat to blockchain networks. Research has proven that Ethereum is more vulnerable to the Eclipse attack than the Bitcoin peer-to-peer network. Therefore, related research on Eclipse attacks on Ethereum is of great value. This paper proposes an improved XGBoost algorithm based on Bagging. It simulates a variety of random situations through the Bagging method, introduces randomness, reduces the risk of high errors, reduces the variance of the XGBoost model output, and improves the generalization ability of the model. It further enhances the model performance on binary classification problems and achieves efficient identification of Eclipse attack traffic and normal traffic.
Krishnendu Chatterjee, A. Ebrahimzadeh, Mehrdad Karrabi, Krzysztof Pietrzak · 6 authors
We study selfish mining attacks in longest-chain blockchains like Bitcoin, but where the proof of work is replaced with efficient proof systems -- like proofs of stake or proofs of space -- and consider the problem of computing an optimal selfish mining attack which maximizes expected relative revenue of the adversary, thus minimizing the chain quality. To this end, we propose a novel selfish mining attack that aims to maximize this objective and formally model the attack as a Markov decision process (MDP). We then present a formal analysis procedure which computes an $ε$-tight lower bound on the optimal expected relative revenue in the MDP and a strategy that achieves this $ε$-tight lower bound, where $ε>0$ may be any specified precision. Our analysis is fully automated and provides formal guarantees on the correctness. We evaluate our selfish mining attack and observe that it achieves superior expected relative revenue compared to two considered baselines. In concurrent work [Sarenche FC'24] does an automated analysis on selfish mining in predictable longest-chain blockchains based on efficient proof systems. Predictable means the randomness for the challenges is fixed for many blocks (as used e.g., in Ouroboros), while we consider unpredictable (Bitcoin-like) chains where the challenge is derived from the previous block.
Block Chain is one of the technologies that is gaining popularity in the modern world. The technology in question offers an exceptionally robust level of protection. Users do not have a lot of information about Block Chain, but its security is used to safeguard the data that is sent in several directions. This user continued to utilize the “ChaCha” and RBJ25 algorithms, which are considered to be compact and secure varieties. In this article, we present the new security mechanism that we have decided to call RPBB24-1. Two components make up the RPBB-24-1 approach, which are encryption and decryption. Five stages are involved in the encryption procedure. Assignment of the “Latin Alphabet cod” to PT is the first step in the procedure. Multiplying the number by itself four times using Equation (1) is the second step. Using encrypted data, the third procedure involves swapping the cell values, but the process begins with the 0th cell value from the most recent cell value. The fourth step involves dividing the prime key into the values of the matrix cells. Implementing the “ChaCha” algorithm in the matrix is the fifth step in the procedure. At long last, the ordinary text is transformed into encrypted text. Unlike the encryption procedure, the decryption approach works in the opposite direction. When compared to the approach that is currently in use, the suggested method offers a higher level of security.
Lilita Infante, Roger A. Hallman, J. Ray Hays, Evelyn Cronnon · 5 authors
The increasing use of the Internet and cyber capabilities by criminals have made digital forensics a critical component of criminal investigations and prosecution. Criminal networks were early adopters of the cryptocurrency ecosystem; however, forensics capabilities for cryptocurrency-related investigations have been lacking. While investigators may utilize a number of commercially available digital forensics tools to search for cryptocurrency-related evidence, these tools are inadequate for the task. This paper presents Recovery CAT, a cryptocurrency-specific forensics tool for finding cryptographic artifacts or cryptographic material(s) such as seed phrases, addresses, private keys, wallet applications, hardware wallet usage, exchange domains, etc.
Kaixuan Li, Yue Xue, Sen Chen, Han Liu · 9 authors
In recent years, the importance of smart contract security has been heightened by the increasing number of attacks against them. To address this issue, a multitude of static application security testing (SAST) tools have been proposed for detecting vulnerabilities in smart contracts. However, objectively comparing these tools to determine their effectiveness remains challenging. Existing studies often fall short due to the taxonomies and benchmarks only covering a coarse and potentially outdated set of vulnerability types, which leads to evaluations that are not entirely comprehensive and may display bias. In this paper, we fill this gap by proposing an up-to-date and fine-grained taxonomy that includes 45 unique vulnerability types for smart contracts. Taking it as a baseline, we develop an extensive benchmark that covers 40 distinct types and includes a diverse range of code characteristics, vulnerability patterns, and application scenarios. Based on them, we evaluated 8 SAST tools using this benchmark, which comprises 788 smart contract files and 10,394 vulnerabilities. Our results reveal that the existing SAST tools fail to detect around 50% of vulnerabilities in our benchmark and suffer from high false positives, with precision not surpassing 10%. We also discover that by combining the results of multiple tools, the false negative rate can be reduced effectively, at the expense of flagging 36.77 percentage points more functions. Nevertheless, many vulnerabilities, especially those beyond Access Control and Reentrancy vulnerabilities, remain undetected. We finally highlight the valuable insights from our study, hoping to provide guidance on tool development, enhancement, evaluation, and selection for developers, researchers, and practitioners.