Stephen Kirkman, Steven Fulton, Jeffrey Hemmes, Christopher Garcia · 5 authors
The motivation of this research (and also one of the nation’s cyber goals) is enhancing the resilience of Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA) systems against ransomware attacks. ICS and SCADA systems run some of the most important networks in the country: our critical infrastructure (i.e., water flow, power grids, etc.). Disruption of these systems causes confusion, panic, and in some cases loss of life. We propose a SCADA architecture that uses blockchain to help protect ICS data from ransomware. We focus on the historian. In a SCADA system, the historian collects events from devices in the control network for real-time and future analysis. We choose to use Ethereum and its Proof of Stake (PoS) consensus protocol. The other goal of this research focuses on the resilience of blockchain. There is very little research in protecting the blockchain itself. By performing encryption testing on an Ethereum private network, we explore how vulnerable blockchain is and discuss potential ways to make a blockchain client more resilient.
Dec 21, 2023·2023 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking (ISPA/BDCloud/SocialCom/SustainCom)
With the rapid advancement of blockchain technology, cryptocurrencies based on blockchain have become a hot topic. However, various issues accompany this development, with phishing scams emerging as a severe financial crime within the blockchain ecosystem, causing significant economic losses to both blockchain platforms and users. In order to address this threat, this essay proposes a phishing scam account identification model based on Bidirectional Long Short-Term Memory Networks (BiLSTM) named BILAM. The model has been validated on the Ethereum platform and has been proven to be effective.This study proposes a novel approach by using transaction records for the first time to construct a time series, and it leverages the BILAM model to learn latent information. Experimental results demonstrate the effectiveness of this method in constructing transaction time series. Moreover, the BILAM model shows excellent performance, with its predictive accuracy significantly surpassing other models, particularly achieving an AUC index of 92.8%.
Smart contracts as one of the most successful applications of blockchain. It holds digital currency with huge economic value. During the rapid development of smart contracts, vulnerabilities in the contracts have caused huge financial losses to the blockchain. This has strengthened researchers’ focus on smart contract security vulnerability detection. In this paper, we explore a vulnerability detection deep neural network-based method on combining features in both contract source code and bytecode forms. We conduct extensive experiments on the Ethereum smart contract datasets for reentrancy vulnerability. The experiment demonstrates that our method achieves 87% accuracy and 78% f1-score. Another experiment shows that our method maintains a good detection performance even when the feature part is missing.
Jannik Lucas Sommer, Magnus Mølgaard Lund, Nicola Cibin, Michele Albano
The frequency of software supply chain attacks has reached unprecedented levels, primarily due to the increasing reliance on huge numbers of software and hardware dependencies, and the inherent vulnerabilities they harbor. Currently, vendors providing these software and hardware components share security advisories to centralized databases or post them on proprietary websites, which security engineers have to search manually to find vulnerabilities relevant for their systems. Furthermore, the security advisories often do not follow a standard machine-readable format, which results in the engineers having to manually analyze the documents. In this paper, SENTINEL, a novel solution for automating dissemination and discovery of security advisories leveraging Web3 technologies, is presented. In particular, the Ethereum blockchain is used by vendors to notify asset owners of novel vulnerabilities in their systems in a reliable and accountable manner. Evaluation tests conducted on the Ethereum Sepolia Testnet confirm that our proposal is a functional and functioning solution for securely disseminating and discovering security advisories utilizing a fully decentralized infrastructure. SENTINEL’s source code is released as open source software on GitHub.
Blockchain technologies have gained widespread use in security-sensitive applications due to their robust data protection. However, as blockchains are increasingly integrated into critical data management systems, they have become attractive targets for attackers. Among the various attacks on blockchain systems, distributed denial of service (DDoS) attacks are one of the most significant and potentially devastating. These attacks render the systems incapable of processing transactions, causing the blockchain to come to a halt. To address the challenge of detecting DDoS attacks on blockchains, existing visualization schemes have been developed. However, these schemes often fail to provide early DDoS detection since they typically display only past and current system status. In this paper, we present a novel visualization scheme that not only portrays past and current values but also forecasts future expected system statuses. We achieve these future predictions by utilizing polynomial regression with blockchain data. Additionally, we offer an alternative DDoS detection method employing statistical analysis, specifically the coefficient of determination, to enhance accuracy. Through our experiments, we demonstrate that our proposed scheme excels at predicting future blockchain statuses and anticipating DDoS attacks with minimal error. Our work empowers system managers of blockchain-based applications to identify and mitigate DDoS attacks at an earlier stage.
S Varalakshmi, Dhananjay Kumar Yadav, K R Varalakshmi
Because of the combination of cloud computing and distributed ledger technologies (DLTs) the information technology sector can now implement cutting-edge safety standards. This article examines the application cases, benefits, and underlying mechanisms that improve security when distributed ledger technologies (DLTs) are integrated with cloud computing. These aspects, when combined, contribute to the greater security of the cloud. The “Privacy-Preserving Smart Contracts Algorithm” offers a revolutionary method for deploying smart contracts while protecting user privacy. This data includes health records and financial information. Line plots, scatter plots, and box plots are examples of modern visualization techniques used in the presentation of the findings. These graphs demonstrate the advantages of the proposed technique over the more common options presented. The proposed method's memory, accuracy, and precision have all been shown to improve, proving its efficacy in achieving the goal of boosting security. Furthermore, it has a very fast runtime and a high F1-Score, suggesting the product's usefulness and usability. To summarize, the integration of cloud computing and DLTs constitutes a significant achievement in the field of data security. The findings of this study shed light on the potential benefits of this type of integration and laid a solid foundation for establishing additional safety safeguards. The technique presented here is a practical solution to the challenge of strengthening digital security, and it is supported by complex algorithms and mathematical calculations.
Low-speed internet can negatively impact incident response by causing delayed detection, ineffective response, poor collaboration, inaccurate analysis, and increased risk. Slow internet speeds can delay the receipt and analysis of data, making it difficult for security teams to access the relevant information and take action, leading to a fragmented and inadequate response. All of these factors can increase the risk of data breaches and other security incidents and their impact on IoT-enabled communication. This study combines virtual network function (VNF) technology with software -defined networking (SDN) called virtual network function software-defined networking (VNFSDN). The adoption of the VNFSDN approach has the potential to enhance network security and efficiency while reducing the risk of cyberattacks. This approach supports IoT devices that can analyze large volumes of data in real time. The proposed VNFSDN can dynamically adapt to changing security requirements and network conditions for IoT devices. VNFSDN uses threat filtration and threat-capturing and decision-driven algorithms to minimize cyber risks for IoT devices and enhance network performance. Additionally, the integrity of IoT devices is safeguarded by addressing the three risk categories of data manipulation, insertion, and deletion. Furthermore, the prioritized delegated proof of stake (PDPoS) consensus variant is integrated with VNFSDN to combat attacks. This variant addresses the scalability issue of blockchain technology by providing a safe and adaptable environment for IoT devices that can quickly be scaled up and down to pull together the changing demands of the organization, allowing IoT devices to efficiently utilize resources. The PDPoS variant provides flexibility to IoT devices to proactively respond to potential security threats, preventing or mitigating the impact of cyberattacks. The proposed VNFSDN dynamically adapts to the changing security requirements and network conditions, improving network resiliency and enabling proactive threat detection. Finally, we compare the proposed VNFSDN to existing state-of-the-art approaches. According to the results, the proposed VNFSDN has a 0.08 ms minimum response time, a 2% packet loss rate, 99.5% network availability, a 99.36% threat detection rate, and a 99.77% detection accuracy with 1% malicious nodes.
In blockchains, mempool controls transaction flow before consensus, denial of whose service hurts the health and security of blockchain networks. This paper presents MPFUZZ, the first mempool fuzzer to find asymmetric DoS bugs by exploring the space of symbolized mempool states and optimistically estimating the promisingness of an intermediate state in reaching bug oracles. Compared to the baseline blockchain fuzzers, MPFUZZ achieves a > 100x speedup in finding known DETER exploits. Running MPFUZZ on major Ethereum clients leads to discovering new mempool vulnerabilities, which exhibit a wide variety of sophisticated patterns, including stealthy mempool eviction and mempool locking. Rule-based mitigation schemes are proposed against all newly discovered vulnerabilities.
The industrial Internet of Things (IIoT) involves the integration of Internet of Things (IoT) technologies into industrial settings. However, given the high sensitivity of the industry to the security of industrial control system networks and IIoT, the use of software-defined networking (SDN) technology can provide improved security and automation of communication processes. Despite this, the architecture of SDN can give rise to various security threats. Therefore, it is of paramount importance to consider the impact of these threats on SDN-based IIoT environments. Unlike previous research, which focused on security in IIoT and SDN architectures separately, we propose an integrated method including two components that work together seamlessly for better detecting and preventing security threats associated with SDN-based IIoT architectures. The two components consist in a convolutional neural network-based Intrusion Detection System (IDS) implemented as an SDN application and a Blockchain-based system (BS) to empower application layer and network layer security, respectively. A significant advantage of the proposed method lies in jointly minimizing the impact of attacks such as command injection and rule injection on SDN-based IIoT architecture layers. The proposed IDS exhibits superior classification accuracy in both binary and multiclass categories.
Phishing scams have become the most serious type of crime involved in Ethereum. However, existing methods ignore the natural camouflage and sparse distribution of phishing scams in Ethereum leading to unsatisfactory performance, and they are also limited by the data scale which cannot be applied to real-world dynamic scenarios. In this paper, we propose a Transaction Graph Contrast network (TGC) to enhance phishing scam detection performance on Ethereum. TGC inputs subgraphs instead of the entire graph for training, which eases the model’s requirements for machine configuration and data connectivity. Motivated by phishing nodes are surrounded by normal nodes, we design the comparison between node-level to help phishing nodes learn the unique properties of themselves different from their neighbors. Observing the small number and sparse distribution of phishing nodes, we narrow the distance between phishing nodes by comparing node context-level structures, so as to learn universal transaction patterns. We further combine the obtained features with common statistics to identify phishing addresses. Evaluated on real-world Ethereum phishing scams datasets, our TGC outperforms the state-of-the-art methods in detecting phishing addresses and has obvious advantages in large-scale and dynamic scenarios.
Amit Kumar, Neha Sharma, Rahul Chauhan, Manish Sharma
The implementation of blockchain technology has become prevalent across several businesses, although its initial design was primarily intended for cryptocurrencies. The preservation of security and integrity inside blockchain networks is of utmost importance, and the process of anomaly detection serves as a crucial component in the identification and mitigation of potential threats. This research study aims to examine the patterns within the Google BigQuery Bitcoin Blockchain Dataset and utilize unsupervised anomaly detection techniques to locate anomalies within the dataset. The analysis conducted provides valuable insights into the temporal patterns exhibited by significant components of blockchain technology, including Transactions, Blocks, and Output Satoshis. Following this, we proceed to assess the effectiveness of the LSTM and Isolation Forest methods in recognising anomalous instances. The results of this study offer a significant basis for improving the security of blockchain systems by implementing anomaly detection techniques.
Shereen Ismail, Muhammad Nouman, Diana W. Dawoud, Hassan Reza
Cyber-attacks pose a significant challenge to the security of Internet of Things (IoT) sensor networks, necessitating the development of robust countermeasures tailored to their unique characteristics and limitations. Various prevention and detection techniques have been proposed to mitigate these attacks. In this paper, we propose an integrated security framework using Blockchain (BC) and Machine Learning (ML) to protect IoT sensor networks. The framework consists of two modules: a BC prevention module and a ML detection module. The BC prevention module has two lightweight mechanisms: identity management and trust management. Identity management employs a lightweight Smart Contract (SC) to manage the node registration and authentication, ensuring that unauthorized entities are prohibited from engaging in any tasks, while trust management uses a lightweight SC that is responsible for maintaining trust and credibility between sensor nodes throughout the network's lifetime and tracking historical node behaviors. Consensus and transaction validation are achieved through a Verifiable Byzantine Fault Tolerance (VBFT) mechanism to ensure network reliability and integrity. The ML detection module utilizes LightGBM algorithm to classify malicious nodes and notify the BC network if it must make decisions to mitigate their impacts. We investigate the performance of several off-the-shelf ML algorithms, including Logistic Regression, Complement Naive Bayes, Nearest Centroid, and Stacking, using the WSN-DS dataset. LightGBM is selected following a detailed comparative analysis conducted using accuracy, precision, recall, F1-score, processing time, training time, prediction time, computational complexity, and Matthews Correlation Coefficient (MCC) evaluation metrics.
Cyber-physical systems (CPS) are becoming increasingly ubiquitous, connecting the physical world with the cyber realm. This convergence has exposed CPS to a growing threat landscape, necessitating robust intrusion detection systems (IDS) to safeguard critical infrastructure. Deep learning (DL) has emerged as a powerful tool for IDS, and convolutional neural networks (CNNs) have demonstrated exceptional performance in this domain. However, traditional IDS models are susceptible to data tampering and manipulation, compromising their integrity and effectiveness. Blockchain technology, with its inherent immutability and tamper-proof nature, offers a promising solution to enhance the security and reliability of IDS models. In this study, we propose a CNN-based IDS model that leverages blockchain technology to secure network traffic data. Our hypothesis is that integrating blockchain with CNNs can significantly improve the security and robustness of IDS models against data tampering and manipulation. To test our hypothesis, we employ a greedy-based genetic algorithm to select the most relevant features from network traffic data, followed by training a CNN model using the selected features. Finally, we evaluate the trained CNN model on a real-world dataset, demonstrating its ability to accurately classify network traffic as normal or intrusive. The results of our evaluation reveal that the proposed CNN-based IDS model achieves a classification accuracy of 99.2%, surpassing traditional IDS models. Moreover, our model exhibits enhanced resilience against data tampering and manipulation, demonstrating the effectiveness of blockchain integration in safeguarding the integrity of IDS models. Our findings underscore the potential of blockchain-enhanced CNNs as a robust and secure solution for intrusion detection in CPS, ensuring the integrity and protection of critical infrastructure.
Yuheng Zhang, Liu Pin, Guojun Wang, Peiqiang Li · 8 authors
With the evolution of blockchain technology, the issue of transaction security, particularly on platforms like Ethereum, has become increasingly critical. Front-running attacks, a unique form of security threat, pose significant challenges to the integrity of blockchain transactions. In these attack scenarios, malicious actors monitor other users' transaction activities, then strategically submit their own transactions with higher fees. This ensures their transactions are executed before the monitored transactions are included in the block. The primary objective of this paper is to delve into a comprehensive classification of transactions associated with front-running attacks, which aims to equip developers with specific strategies to counter each type of attack. To achieve this, we introduce a novel detection method named FRAD (Front-Running Attacks Detection on Ethereum using Ternary Classification Model). This method is specifically tailored for transactions within decentralized applications (DApps) on Ethereum, enabling accurate classification of front-running attacks involving transaction displacement, insertion, and suppression. Our experimental validation reveals that the Multilayer Perceptron (MLP) classifier offers the best performance in detecting front-running attacks, achieving an impressive accuracy rate of 84.59% and F1-score of 84.60%.
The increasing reliance on cyber-physical systems (CPSs) in critical domains such as healthcare, smart grids, and intelligent transportation systems necessitates robust security measures to protect against cyber threats. Among these threats, blackhole and greyhole attacks pose significant risks to the availability and integrity of CPSs. The current detection and mitigation approaches often struggle to accurately differentiate between legitimate and malicious behavior, leading to ineffective protection. This paper introduces Gini-index and blockchain-based Blackhole/Greyhole RPL (GBG-RPL), a novel technique designed for efficient detection and mitigation of blackhole and greyhole attacks in smart health monitoring CPSs. GBG-RPL leverages the analytical prowess of the Gini index and the security advantages of blockchain technology to protect these systems against sophisticated threats. This research not only focuses on identifying anomalous activities but also proposes a resilient framework that ensures the integrity and reliability of the monitored data. GBG-RPL achieves notable improvements as compared to another state-of-the-art technique referred to as BCPS-RPL, including a 7.18% reduction in packet loss ratio, an 11.97% enhancement in residual energy utilization, and a 19.27% decrease in energy consumption. Its security features are also very effective, boasting a 10.65% improvement in attack-detection rate and an 18.88% faster average attack-detection time. GBG-RPL optimizes network management by exhibiting a 21.65% reduction in message overhead and a 28.34% decrease in end-to-end delay, thus showing its potential for enhanced reliability, efficiency, and security.
Bitcoin has been launched for over a decade and made an increasing impact on the world’s financial order, which attracted extensive attention of researchers. Bitcoin system runs on a dynamic P2P network, containing tens of thousands of nodes including reachable nodes and unreachable nodes. In this article, a detection system BNS (Bitcoin Network Sniffer) was prososed, which could collect as many Bitcoin nodes as possible. For reachable nodes, the authors designed an algorithm BRF (Bitcoin Reachable-nodes Finding) based on node activity evaluation, which reduced the nodes to be detected and greatly shortened the detection time. For unreachable nodes, the authors trained a dicision tree model BUF(Bitcoin Unreachable-nodes Finding) to identify unreachable nodes based on attribute features from massive node addresses. Experiments showed that BNS performed better than the website "Bitnodes" in total number and efficiency. Based on the experimental results, the authors analyzed the real network size, node "churn" and geographical distribution.
Artificial intelligence and blockchain are quickly integrating in daily life and business applications. When numerous information systems must access and analyze data in real-time in centralized systems and applications, such as healthcare, a bottleneck develops. This issue would be resolved by blockchain's decentralized database architecture, safe data storage, data exchange, and authentication. Additionally, AI can be present at the very top of the blockchain and produce insights from the shared data that is created and applied to forecasts. Blockchain is a cutting-edge Cybersecurity technology that creates chains by mutual consent between nodes that chronologically link new blocks to those previously stored in nodes. A number of industries, including banking, insurance, cybersecurity, forecasting, healthcare, and cryptocurrencies, among others, are growing more quickly as a result of technology convergence. The likelihood of these systems being hacked increases as more digital technologies are used and these businesses provide services. Blockchain technology and artificial intelligence can work together to create a strong defense against these dangers and security problems. We'll examine how blockchain and AI are merged in cybersecurity in this chapter. We'll go into more detail about how they help secure cyber-physical systems.
Leandro Cunha, Miguel A. Brito, Domingos F. Oliveira, Ana Paula Martins
The cryptocurrency market has grown significantly, and this quick growth has given rise to scams. It is necessary to put fraud detection mechanisms in place. The challenge of inadequate labeling is addressed in this work, which is a barrier to the training of high-performance supervised classifiers. It aims to lessen the necessity for laborious and time-consuming manual labeling. Some unlabeled data points have labels that are more pertinent and informative for the supervised model to learn from. The viability of utilizing unsupervised anomaly detection algorithms and active learning strategies to build an iterative process of acquiring labeled transactions in a cold start scenario, where there are no initial-labeled transactions, is being investigated. Investigating anomaly detection capabilities for a subset of data that maximizes supervised models’ learning potential is the goal. The anomaly detection algorithms under performed, according to the results. The findings underscore the need that anomaly detection algorithms be reserved for situations involving cold starts. As a result, using active learning techniques would produce better outcomes and supervised machine learning model performance.
K R Varalakshmi, T R Mahesh, Akhilendra Pratap Singh
wireless sensor system technology has made it possible for ubiquitous sensing, which affects many aspects of contemporary life. Indicators of environmental health, from sensitive ecologies as well as biodiversity to urban settings, may now be measured, inferred, and understood. The Internet of Things is enabled by the extensive utilization of these devices in a network that facilitates communication and action. In this network, the actuators and sensors smoothly interact with our environment as data is exchanged across platforms to provide a unified operational view. Near field communication (NFC) is the upcoming technology that will enable the transformation of the worldwide web into a fully integrated Future Internet. This technology is being advanced through the adoption of variousenabling device methods, such as tags, audience members, encased sense and actuators nodes, and nodes for near field interaction. The demand for data-on-demand, using complex and straightforward queries, increases significantly as studies transition from web to web2 to web3. This study presents a cloud-centric vision for the worldwideimplementation of the Internet of Things. The future of IoT research is expected to be influenced by many significant technology enablers and their corresponding application domains, which are emphasized. A cloud architecture based on the interplay of public as well as private clouds and employing Aneka is shown. Study conducted elaborate on the need of unity, the global web, and distributed processing in our last section of our IoT vision for the community of technical researchers.
Advances in blockchain technology have attracted significant attention across the world. The practical blockchain applications emerging in various domains, ranging from finance, healthcare, and entertainment, have quickly become attractive targets for adversaries. The novelty of the technology coupled with the high degree of anonymity it provides made malicious activities even less visible in the blockchain environment. This made their robust detection challenging. This article presents EtherShield, a novel approach for identifying malicious activity on the Ethereum blockchain. By combining temporal transaction information and contract code characteristics, EtherShield can detect various types of threats and provide insight into the behavior of contracts. The time-interval-based analysis used by EtherShield enables expedited detection, achieving comparable accuracy to other approaches with significantly less data. Our validation analysis, which involved over 15,000 Ethereum accounts, demonstrated that EtherShield can significantly expedite the detection of malicious activity while maintaining high accuracy levels (86.52% accuracy with 1 hour of transaction history data and 91.33% accuracy with 1 year of transaction history data).
Cloud computing forms a mainstream in the emerging field of Internet of Things (IoT) networks, which provides high storage and access to data whenever needed. The cloud architecture is highly vulnerable to various anomalies due to the centralised process that has the capability of ruining the reputation or causing the loss of trust in an organisation. Preventing anomalies in cloud architecture extends the lifetime of the system and increases privacy preservation. In this research, blockchain technology is adopted for facilitating secure communication in the network, and anomaly detection is performed using the proposed Hexabullus optimisation-based Fuzzy classifier based on the entropy-based rules. The importance of this research relies on the calculation of entropy and anomaly detection using optimal rules generated using the proposed hexabullus optimisation. The experimental results show that the proposed blockchain-enabled cloud architecture prevents the occurrence of attacks more efficiently. The proposed hexabullus optimisation-based anomaly detection is evaluated with existing methods that attained an improved accuracy of 88%, precision of 88%, and recall of 90%, which is highly efficient in rendering the secure communication of the data in the cloud.