Ensuring strict adherence to security during the phases of Android app development is essential, primarily due to the prevalent issue of apps being released without adequate security measures in place. While a few automated tools are employed to reduce potential vulnerabilities during development, their effectiveness in detecting vulnerabilities may fall short. To address this, “Defendroid”, a blockchain-based federated neural network enhanced with Explainable Artificial Intelligence (XAI) is introduced in this work. Trained on the LVDAndro dataset, the vanilla neural network model achieves a 96% accuracy and 0.96 F1-Score in binary classification for vulnerability detection. Additionally, in multi-class classification, the model accurately identifies Common Weakness Enumeration (CWE) categories with a 93% accuracy and 0.91 F1-Score. In a move to foster collaboration and model improvement, the model has been deployed within a blockchain-based federated environment. This environment enables community-driven collaborative training and enhancements in partnership with other clients. The extended model demonstrates improved accuracy of 96% and F1-Score of 0.96 in both binary and multi-class classifications. The use of XAI plays a pivotal role in presenting vulnerability detection results to developers, offering prediction probabilities for each word within the code. This model has been integrated into an Application Programming Interface (API) as the backend and further incorporated into Android Studio as a plugin, facilitating real-time vulnerability detection. Notably, Defendroid exhibits high efficiency, delivering prediction probabilities for a single code line in an average processing time of a mere 300 ms. The weight-sharing transparency in the blockchain-driven federated model enhances trust and traceability, fostering community engagement while preserving source code privacy and contributing to accuracy improvement.
Jie Cai, Qian Cai, Bin Li, Jiale Zhang · 5 authors
Abstract Application programming interface (API) recommendation plays a crucial role in facilitating smart contract development by providing developers with a ranked list of candidate APIs for specific recommendation points. Deep learning‐based approaches have shown promising results in this field. However, existing approaches mainly rely on token sequences or abstract syntax trees (ASTs) for learning recommendation point‐related features, which may overlook the essential knowledge implied in the relations between or within statements and may include task‐irrelevant components during feature learning. To address these limitations, we propose a novel code graph called pruned and augmented AST (pa‐AST). Our approach enhances the AST by incorporating additional knowledge derived from the control and data flow relations between and within statements in the smart contract code. Through this augmentation, the pa‐AST can better represent the semantic features of the code. Furthermore, we conduct AST pruning to eliminate task‐irrelevant components based on the identified flow relations. This step helps mitigate the interference caused by these irrelevant parts during the model feature learning process. Additionally, we extract the API sequence surrounding the recommendation point to provide supplementary knowledge for the model learning. The experimental results demonstrate our proposed approach achieving an average mean reciprocal rank (MRR) of 68.02%, outperforming the baselines' performance. Furthermore, through ablation experiments, we explore the effectiveness of our proposed code representation approach. The results indicate that combining pa‐AST with the API sequence yields improved performance compared with using them individually. Moreover, our AST augmentation and pruning techniques significantly contribute to the overall results.
Mohammad Alauthman, Ahmad Al–Qerem, Mouhammd Alkasassbeh, Nauman Aslam · 5 authors
As cryptocurrencies have grown in prevalence and value, associated malware threats have rapidly emerged, exploiting vulnerabilities in wallets, markets, and decentralization mechanisms. This paper provides a comparative review of dominant cryptocurrency malware categories, including ransomware, crypto-jacking, supply chain hijacking, malicious browser extensions, phishing kits, and miner botnets. Analysis of behaviors, targets, propagation tactics, motivations, and detection challenges reveal commonalities and differences across threat types. Examination of recent literature enables comprehensive characterization of the cryptocurrency malware ecosystem to derive insights into evolution trajectories and systemic issues. Ransomware, crypto-jacking, and coordinated botnets represent prevalent threats highlighted, with malware innovation incentivized by pseudonymous payments, irreversible transactions, and criminal usage of mineable privacy-focused coins. Software supply chain attacks and phishing kits showcase propagation risks. Comparative assessment enables identifying research priorities like transaction tracing, behavioral monitoring, and predictive indicators to strengthen adaptive defenses against cryptocurrency-targeting threats. As cryptocurrency permeates society, proactive ecosystem perspectives will grow crucial in responding to malware creativity.
Smart contracts are a driving force for the Ethereum blockchain. A smart contract is a code that resides on blockchain and executes when certain predetermined conditions are satisfied. Ethereum smart contracts handle ether (a cryptocurrency) equivalent to millions of dollars and other essential assets. A bug in the smart contract can cause financial loss and damage to essential assets. The Ethereum community has developed ample tools to detect bugs in smart contracts. However, the tools generate false reports. We plan to integrate existing tools and detect smart contract bugs by combining the best of each tool. We use the Logistic Regression model to combine the tools. We are working on a training dataset of around 40K real-world Ethereum smart contracts labelled with vulnerabilities for the Logistic Regression model. We also plan to improve individual tools by finding the drawbacks of each tool. Finally, we aim to develop a new tool that will be better than existing tools regarding precision and recall.
Haya R. Hasan, Khaled Salah, Raja Jayaraman, Ibrar Yaqoob · 5 authors
The metaverse has gained immense popularity in recent years. However, the widespread adoption of this immersive virtual environment faces a substantial challenge from deepfake technology. The proliferation of deepfakes poses a significant risk as it enables the dissemination of misinformation and manipulated digital media. In this paper, we propose a blockchain and Non-Fungible Tokens (NFTs) based solution to combat the threats associated with deepfakes. Our proposed solution is applicable to various types of digital media found on the internet, social media platforms, and within the metaverse. We incorporate decentralized off-chain storage to ensure the security and integrity of digital media. This leads to preserving both the digital media and associated NFT metadata in a secure manner. We leverage the intrinsic features of blockchain, such as tamper-proof logs and data provenance, to enable users to verify the authenticity of digital media. We introduce a decentralized reputation system that employs equations, trust factors, and trust badges. Through this system, digital creators are incentivized with trust badges based on their trust factor values, which enhances the overall credibility of the content. We present the cost and security analyses as well as provide a comparative evaluation against existing solutions. We make our smart contract code publicly available on GitHub.
Our cyber security learning system involves an interactive environment for students to practice executing different attack and defense techniques relating to cyber security concepts. We intend to use a blockchain database to secure data from this learning system. The data being secured are students' scores accumulated by successful attacks or defends from the other students' implementations. As more professionals are departing from traditional relational databases, the enthusiasm around distributed ledger databases is growing, specifically blockchain. With many available platforms applying blockchain structures, it is important to understand how this emerging technology is being used, with the goal of utilizing this technology for our learning system. In order to successfully secure the data and ensure it is tamper resistant, an investigation of blockchain technology use cases must be conducted. In addition, this paper defined the primary characteristics of the emerging distributed ledgers or blockchain technology, to ensure we effectively harness this technology to secure our data. Moreover, we explored using a blockchain database for our data.
Smart contracts are becoming appealing targets for hackers because of the vast amount of cryptocurrencies under their control. Asset loss due to the exploitation of smart contract codes has increased significantly in recent years. To guarantee that smart contracts are vulnerability-free, there are many works to detect the vulnerabilities of smart contracts, but only a few vulnerability repair works have been proposed. Repairing smart contract vulnerabilities at the source code level is attractive as it is transparent to users, whereas existing repair tools, such as SCRepair and sGuard , suffer from many limitations: (1) ignoring the code of vulnerability prevention; (2) possibly applying the repair to the wrong statements and changing the original business logic of smart contracts; and (3) showing poor performance in terms of time and gas overhead. In this work, we propose machine learning guided rule-based automated vulnerability repair on smart contracts to improve the effectiveness and efficiency of sGuard . To address the limitations mentioned above, we design the features that characterize both the symptoms of vulnerabilities and the methods of vulnerability prevention to learn various vulnerability patterns and reduce false positives. Additionally, a fine-grained localization algorithm is designed by traversing the nodes of the abstract syntax tree, and we refine and extend the repair rules of sGuard to preserve the original business logic of smart contracts and support new vulnerability types. Our tool, named sGuard+ , reduces time overhead based on machine learning models, and reduces gas overhead by fewer code changes and precise patching. In our experiment, we collect a publicly available vulnerability dataset from CVE, SWC, and SmartBugs Curated as a ground truth for evaluations. Overall, sGuard+ repairs more vulnerabilities with less time and gas overhead than state-of-the-art tools. Furthermore, we reproduce about 9,000 historical transactions for regression testing. It is shown that sGuard+ has no impact on the original business logic of smart contracts.
Smart contracts are Turing-complete programs that execute on the blockchain. Developers can implement complex contracts, such as auctions and lending, on Ethereum using the Solidity programming language. As an object-oriented language, Solidity provides libraries within its syntax to facilitate code reusability and reduce development complexity. Library misuse refers to the incorrect writing or usage of libraries, resulting in unexpected results, such as introducing vulnerabilities during library development or incorporating an unsafe library during contract development. Library misuse could lead to contract defects that cause financial losses. Currently, there is a lack of research on library misuse. To fill this gap, we collected more than 500 audit reports from the official websites of five audit companies and 223,336 real-world smart contracts from Etherscan to measure library popularity and library misuse. Then, we defined eight general patterns for library misuse; three of them occurring during library development and five during library utilization, which covers the entire library lifecycle. To validate the practicality of these patterns, we manually analyzed 1,018 real-world smart contracts and publicized our dataset. We identified 905 misuse cases across 456 contracts, indicating that library misuse is a widespread issue. Three patterns of misuse are found in more than 50 contracts, primarily due to developers lacking security awareness or underestimating negative impacts. Additionally, our research revealed that vulnerable libraries on Ethereum continue to be employed even after they have been deprecated or patched. Our findings can assist contract developers in preventing library misuse and ensuring the safe use of libraries.
This research introduces innovative features tailored to capture distinctive characteristics of ransomware activity within the cryptocurrency ecosystem. The study employs a multifaceted analysis to delve into ransomware-related data encompassing transaction metadata, ransom analysis, behavioral patterns, and financial aspects. A feature selection algorithm is explored to discern ransomware transactions in Bitcoin (BTC) and the United States Dollar (USD) using the UGRansome dataset. This comprehensive dataset of ransomware-related transactions facilitates the proposal of novel features designed to capture the unique traits of ransomware activity. The correlation matrix and temporal analysis of these features contribute to a nuanced understanding of the dynamic nature of ransomware threats. The research presents the Ransomware Feature Selection Algorithm (RFSA) based on Gini Impurity and Mutual Information (MI) to effectively select crucial ransomware features. Evaluation metrics such as precision, recall, accuracy, and F1 score highlight the effectiveness of the RFSA. The analysis reveals that approximately 68% of ransomware incidents involve BTC transactions ranging from 1.46 to 2.56, with an average of 2.01 BTC transactions per attack. Moreover, ransomware causes financial damages ranging from 4.38 to 172.36 USD, with an average damage of 88.37 USD. The RFSA identifies 17 ransomware types and their associated malware to shed light on their characteristics. The study investigates the pricing of ransomware and reveals that TowerWeb is associated with the highest fee, amounting to 135.26 BTC, while CryptoLocker has the lowest fee, recorded at 10.51 BTC. Additionally, the impact of ransomware duration on financial gains and network flow is investigated, disclosing a correlation between extended duration and higher financial gains. The research achieves outstanding performance metrics, including an MI score of 95%, accuracy of 93%, recall of 92%, and precision of 89%. These results showcase the superiority of the proposed approach over existing studies, emphasizing the dynamic and adaptable nature of ransomware demands. The findings suggest that there is no fixed amount for specific cyberattacks. This underscores the importance of adapting to the evolving landscape of ransomware threats.
Given the growing importance of smart contracts in various applications, ensuring their security and reliability is critical. Fuzzing, an effective vulnerability detection technique, has recently been widely applied to smart contracts. Despite numerous studies, a systematic investigation of smart contract fuzzing techniques remains lacking. In this paper, we fill this gap by: 1) providing a comprehensive review of current research in contract fuzzing, and 2) conducting an in-depth empirical study to evaluate state-of-the-art contract fuzzers' usability. To guarantee a fair evaluation, we employ a carefully-labeled benchmark and introduce a set of pragmatic performance metrics, evaluating fuzzers from five complementary perspectives. Based on our findings, we provide direction for the future research and development of contract fuzzers.
The Internet of Things (IoT) has revolutionized industries by enabling the interconnection of devices, creating opportunities for enhanced automation and real-time data analysis. However, the rapid proliferation of IoT devices has introduced significant security vulnerabilities, such as unauthorized access, data manipulation, and privacy breaches. These challenges stem from the inherent limitations of IoT devices, such as low computational power, and the reliance on centralized security models that are susceptible to single points of failure. To address these issues, this paper proposes a Blockchain-Based Secure Framework for IoT devices. Blockchain, a decentralized, immutable, and transparent distributed ledger technology, offers an effective solution for securing IoT networks. By leveraging blockchain's cryptographic features and consensus mechanisms, this framework ensures secure device authentication, data integrity, and transparent communication between IoT devices. Devices can securely authenticate themselves through blockchain-based digital identities, eliminating the need for centralized servers, thus reducing the risk of unauthorized access.Moreover, the framework guarantees data integrity by recording all IoT transactions on the blockchain, making them tamper-proof and verifiable. Blockchain's decentralized nature also mitigates the risk of Distributed Denial of Service (DDoS) attacks by removing central points of vulnerability. Privacy is enhanced through techniques such as zero-knowledge proofs, allowing users to control access to their personal data. This proposed framework not only enhances IoT security but also provides scalability, transparency, and resilience. By combining the strengths of blockchain with IoT, it offers a robust solution for secure, reliable, and privacy-preserving communication in the ever-growing IoT ecosystem. The integration of blockchain technology is poised to transform IoT security, facilitating the secure deployment and management of IoT devices across various industries.
Once deployed in blockchain, smart contracts become immutable: Attackers can exploit bugs and vulnerabilities in their code that cannot be replaced with a bug-free version. For this reason, the verification of smart contracts before they are deployed in blockchain is important. However, the development of verification tools is not easy, especially if one wants to obtain guarantees by using formal methods. This article describes the development, from scratch, of a static analyzer based on abstract interpretation for the verification of real-world Tezos smart contracts. The analyzer is generic with respect to the property under analysis. This article shows taint analysis as a concrete instantiation of the analyzer, at different levels of precision, to detect untrusted cross-contract invocations.
The rapid development of physical device-based data collection in emerging technology needs smart, secure, and intelligent transmission. Cyber physical systems compete with the requirement of intelligent transmission of data. In cyber physical systems, security is a very challenging task due to the heterogeneous connections of devices in real time. This paper proposes a novel methodology for cyber-attack finding in cyber physical systems. The proposed system employed a DNN-deep neural network for the categorization of normal and attack data. The employed deep neural network design for 4 hidden layers for the detection of anomalies. For the secured transmission, we employed the blockchain process in Ethereum. The process of Ethereum generates blocks of blockchain with headers and transmits data over the cyberworld to the physical world with the alteration of data. For the authentication of the projected algorithm tested on two real-time datasets, such as NSL-KDD15 and CIDDS_001. The working of proposed algorithm is very promising in compression of existing algorithms of deep learning like RNN-recurrent neural networks, DBN, and DNN.
As blockchain platforms grow exponentially, millions of lines of smart contract code are being deployed to manage extensive digital assets. However, vulnerabilities in this mission-critical code have led to significant exploitations and asset losses. Thorough automated security analysis of smart contracts is thus imperative. This paper introduces LLM4Fuzz to optimize automated smart contract security analysis by leveraging large language models (LLMs) to intelligently guide and prioritize fuzzing campaigns. While traditional fuzzing suffers from low efficiency in exploring the vast state space, LLM4Fuzz employs LLMs to direct fuzzers towards high-value code regions and input sequences more likely to trigger vulnerabilities. Additionally, LLM4Fuzz can leverage LLMs to guide fuzzers based on user-defined invariants, reducing blind exploration overhead. Evaluations of LLM4Fuzz on real-world DeFi projects show substantial gains in efficiency, coverage, and vulnerability detection compared to baseline fuzzing. LLM4Fuzz also uncovered five critical vulnerabilities that can lead to a loss of more than $247k.
Bhupendra Acharya, Muhammad Saad, Antonio Emanuele Ciná, Lea Schönherr · 8 authors
The mainstream adoption of cryptocurrencies has led to a surge in wallet-related issues reported by ordinary users on social media platforms. In parallel, there is an increase in an emerging fraud trend called cryptocurrency-based technical support scam, in which fraudsters offer fake wallet recovery services and target users experiencing wallet-related issues.In this paper, we perform a comprehensive study of cryptocurrency-based technical support scams. We present an analysis apparatus called HoneyTweet to analyze this kind of scam. Through HoneyTweet, we lure over 9K scammers by posting 25K fake wallet support tweets (so-called honey tweets). We then deploy automated systems to interact with scammers to analyze their modus operandi. In our experiments, we observe that scammers use Twitter as a starting point for the scam, after which they pivot to other communication channels (e.g., email, Instagram, or Telegram) to complete the fraud activity. We track scammers across those communication channels and bait them into revealing their payment methods. Based on the modes of payment, we uncover two categories of scammers that either request secret key phrase submissions from their victims or direct payments to their digital wallets. Furthermore, we obtain scam confirmation by deploying honey wallet addresses and validating private key theft. We also collaborate with the prominent payment service provider by sharing scammer data collections. The payment service provider feedback was consistent with our findings, thereby supporting our methodology and results. By consolidating our analysis across various vantage points, we provide an end-to-end scam lifecycle analysis and propose recommendations for scam mitigation.
Pengcheng Xia, Yu Zhou, Kailong Wang, Kai Ma · 9 authors
The dark web has emerged as the state-of-the-art solution for enhanced anonymity. Just like a double-edged sword, it also inadvertently becomes the safety net and breeding ground for illicit activities. Among them, cryptocurrencies have been prevalently abused to receive illicit income while evading regulations. Despite the continuing efforts to combat illicit activities, there is still a lack of an in-depth understanding regarding the characteristics and dynamics of cryptocurrency abuses on the dark web. In this work, we conduct a multi-dimensional and systematic study to track cryptocurrency-related illicit activities and campaigns on the dark web. We first harvest a dataset of 4,923 cryptocurrency-related onion sites with over 130K pages. Then, we detect and extract the illicit blockchain transactions to characterize the cryptocurrency abuses, targeting features from single/clustered addresses and illicit campaigns. Throughout our study, we have identified 2,564 illicit sites with 1,189 illicit blockchain addresses, which account for 90.8 BTC in revenue. Based on their inner connections, we further identify 66 campaigns behind them. Our exploration suggests that illicit activities on the dark web have strong correlations, which can guide us to identify new illicit blockchain addresses and onions, and raise alarms at the early stage of their deployment.
Smart contracts are computer programs that run on a blockchain. As the functions implemented by smart contracts become increasingly complex, the number of cross-contract interactions within them also rises. Consequently, the combinatorial explosion of transaction sequences poses a significant challenge for smart contract security vulnerability detection. Existing static analysis-based methods for detecting cross-contract vulnerabilities suffer from high false-positive rates and cannot generate test cases, while fuzz testing-based methods exhibit low code coverage and may not accurately detect security vulnerabilities. The goal of this paper is to address the above limitations and efficiently detect cross-contract vulnerabilities. To achieve this goal, we present CrossFuzz, a fuzz testing-based method for detecting cross-contract vulnerabilities. First, CrossFuzz generates parameters of constructors by tracing data propagation paths. Then, it collects inter-contract data flow information. Finally, CrossFuzz optimizes mutation strategies for transaction sequences based on inter-contract data flow information to improve the performance of fuzz testing. We implemented CrossFuzz, which is an extension of ConFuzzius, and conducted experiments on a real-world dataset containing 396 smart contracts. The results show that CrossFuzz outperforms xFuzz, a fuzz testing-based tool optimized for cross-contract vulnerability detection, with a 10.58% increase in bytecode coverage. Furthermore, CrossFuzz detects 1.82 times more security vulnerabilities than ConFuzzius. Our method utilizes data flow information to optimize mutation strategies. It significantly improves the efficiency of fuzz testing for detecting cross-contract vulnerabilities.
Vulnerabilities in smart contracts may trigger serious security events, and the detection of smart contract vulnerabilities has become a significant problem. In this paper, to solve the limitations of current deep learning-based vulnerability detection methods in extracting various code critical features, using the multi-scale cascade encoder architecture as the backbone, we propose a novel Multi-Scale Encoder Vulnerability Detection (MEVD) approach to hit well-known high-risk vulnerabilities in smart contracts. Firstly, we use the gating mechanism to design a unique Surface Feature Encoder (SFE) to enrich the semantic information of code features. Then, by combining a Base Transformer Encoder (BTE) and a Detail CNN Encoder (DCE), we introduce a dual-branch encoder to capture the global structure and local detail features of the smart contract code, respectively. Finally, to focus the model’s attention on vulnerability-related characteristics, we employ the Deep Residual Shrinkage Network (DRSN). Experimental results on three types of high-risk vulnerability datasets demonstrate performance compared to state-of-the-art methods, and our method achieves an average detection accuracy of 90%.
Shereen Ismail, Salah Dandan, Diana W. Dawoud, Hassan Reza
The security of Industrial Supply Chain (ISC) has emerged through the integration of Industrial Internet of Things (IIoT) and Blockchain (BC) technology. This new era involves effectively protecting IIoT systems from various threats and ensuring their smooth operation and resilience against potential cyber-attacks. Within the ISC ecosystem, combining machine learning (ML)-based security models for cyber-attack detection can play a crucial role in enhancing the ISC security and proactively identifying potential threats. This paper presents a BC-enabled ISC that embed ML security model integrated within a multi-layered approach. We conducted a comparative study and performance analysis of several ML classification techniques, with a focus on supervised methods to identify the lightweight model for cyber-attack detection suitable for deployment in resource-constrained IIoT environment. We investigate the performance of Gaussian Naive Bayes (NB), K-Nearest Neighbors (KNN), Random Forest (RF), Decision Tree (DT), and three ensemble techniques, namely Bagging, Stacking, and Boosting. The study employs the WUSTL-IIOT-2021 imbalanced dataset, which contains samples representing four types of attacks, including denial of service (DoS), SQL injection, reconnaissance, and backdoor. The paper addresses the imbalance in class representation by customizing the dataset for training and testing the ML models. Both Mutual Information (MI) and Extra-trees (ET) are applied as a one-stage ensemble feature selection. The performance of the ML models are investigated using classification accuracy (Acc), precision, recall, F1 score, Matthews correlation coefficient (MCC), model size (Mem), training time (TT) and prediction time (PT).