Abstract A smart city provides innovative services to citizens to improve their quality of life. A smart city generates vast amounts of data as Internet of Things (IoT) integration increases. However, gathering, storing, processing, and analyzing this data can pose significant challenges, particularly given its heterogeneous nature and the fact that citizens often contribute to it. A Linux Foundation project called Hyperledger includes the Hyperledger Fabric (HF), developed by IBM and contributing to Hyperledger's development. This paper suggests a smart contract-based data security network for smart cities that uses HF. Data access rules and data-sharing policies can be enforced using smart contracts. A framework is proposed for integrating multiple smart city applications and services while ensuring data privacy and security. A significant contribution to the existing literature is made by this study, which examines the usefulness of blockchain technology and smart contracts in smart cities for data security.
To empower smart contracts with the promising capabilities of cryptography, Ethereum officially introduced a set of cryptographic APIs that facilitate basic cryptographic operations within smart contracts, such as elliptic curve operations. However, since developers are not necessarily cryptography experts, requiring them to directly interact with these basic APIs has caused real-world security issues and potential usability challenges. To guide future research and solutions to these challenges, we conduct the first empirical study on Ethereum cryptographic practices. Through the analysis of 91,484,856 Ethereum transactions, 500 crypto-related contracts, and 483 StackExchange posts, we provide the first in-depth look at cryptographic tasks developers need to accomplish and identify five categories of obstacles they encounter. Furthermore, we conduct an online survey with 78 smart contract practitioners to explore their perspectives on these obstacles and elicit the underlying reasons. We find that more than half of practitioners face more challenges in cryptographic tasks compared to general business logic in smart contracts. Their feedback highlights the gap between low-level cryptographic APIs and high-level tasks they need to accomplish, emphasizing the need for improved cryptographic APIs, task-based templates, and effective assistance tools. Based on these findings, we provide practical implications for further improvements and outline future research directions.
Abstract. Due to the transparent nature of blockchain, all transaction information and smart contract code is recorded on the public blockchain. It is easy for existing static analysis tools to analyze and exploit vulnerabilities in smart contract code. To mitigate this risk, we propose HermHD, an automated security enhancement tool that protects smart contracts on the Ethereum network. HermHD employs six obfuscation patterns that can rewrite the bytecode of a smart contract without affecting its functionality. By applying these obfuscation techniques, we aim to prevent reverse static analysis tools from cracking the contract and thereby enhance the security of smart contracts. To validate the effectiveness of HermHD, we conducted experiments on 121 smart contracts from a public dataset. 54The evaluation results demonstrate that all the protected smart contracts are resistant to two popular reverse engineering tools, and the additional gas cost incurred is minimal.
Kai Ma, Jintao Huang, Ningyu He, Zhuo Wang · 5 authors
Non-fungible tokens (NFTs) drive the prosperity of the Web3 ecosystem. By November 2023, the total market value of NFT projects reached approximately 16 billion USD. Accompanying the success of NFTs are various security issues, i.e., attacks and scams are prevalent in the ecosystem. While NFTs have attracted significant attentions from both industry and academia, there is a lack of understanding of kinds of NFT security issues. The discovery, in-depth analysis, and systematic categorization of these security issues are of significant importance for the prosperous development of the NFT ecosystem. To fill the gap, we performed a systematic literature review related to NFT security, and we have identified 142 incidents from 213 security reports and 18 academic papers until October 1st, 2023. Through manual analysis of the compiled security incidents, we have classified them into 12 major categories. Then we explored potential solutions and mitigation strategies. Drawing from these analyses, we established the first NFT security reference frame. Except, we extracted the characteristics of NFT security issues, i.e., the prevalence, severity, and intractability. We have indicated the gap between industry and academy for NFT security, and provide further research directions for the community. This paper, as the first SoK of NFT security, has systematically explored the security issues within the NFT ecosystem, shedding light on their root causes, real-world attacks, and potential ways to address them. Our findings will contribute to the future research of NFT security.
A smart contract is a kind of code deployed on the blockchain that executes automatically once an event triggers a clause in the contract. Since smart contracts involve businesses such as asset transfer, they are more vulnerable to attacks, so it is crucial to ensure the security of smart contracts. Because a smart contract cannot be tampered with once deployed on the blockchain, for smart contract developers, it is necessary to fix vulnerabilities before deployment. Compared with many vulnerability detection tools for smart contracts, the amount of automatic fix approaches for smart contracts is relatively limited. These approaches mainly use defined pattern-based methods or heuristic search algorithms for vulnerability repairs. In this article, we propose RLRep , a reinforcement learning-based approach to provide smart contract repair recommendations for smart contract developers automatically. This approach adopts an agent to provide repair action suggestions based on the vulnerable smart contract without any supervision, which can solve the problem of missing labeled data in machine learning-based repair methods. We evaluate our approach on a dataset containing 853 smart contract programs (programming language: Solidity) with different kinds of vulnerabilities. We split them into training and test sets. The result shows that our approach can provide 54.97% correct repair recommendations for smart contracts.
As blockchain smart contracts become more widespread and carry more valuable digital assets, they become an increasingly attractive target for attackers. Over the past few years, smart contracts have been subject to a plethora of devastating attacks, resulting in billions of dollars in financial losses. There has been a notable surge of research interest in identifying defects in smart contracts. However, existing smart contract fuzzing tools are still unsatisfactory. They struggle to screen out meaningful transaction sequences and specify critical inputs for each transaction. As a result, they can only trigger a limited range of contract states, making it difficult to unveil complicated vulnerabilities hidden in the deep state space. In this paper, we shed light on smart contract fuzzing by employing a sequence-aware mutation and seed mask guidance strategy. In particular, we first utilize data-flow-based feedback to determine transaction orders in a meaningful way and further introduce a sequence-aware mutation technique to explore deeper states. Thereafter, we design a mask-guided seed mutation strategy that biases the generated transaction inputs to hit target branches. In addition, we develop a dynamic-adaptive energy adjustment paradigm that balances the fuzzing resource allocation during a fuzzing campaign. We implement our designs into a new smart contract fuzzer named MuFuzz, and extensively evaluate it on three benchmarks. Empirical results demonstrate that MuFuzz outperforms existing tools in terms of both branch coverage and bug finding. Overall, MuFuzz achieves higher branch coverage than state-of-the-art fuzzers (up to 25%) and detects 30 % more bugs than existing bug detectors.
Mazin Abed Mohammed, Abdullah Lakhan, Dilovan Asaad Zebari, Mohd Khanapi Abd Ghani · 8 authors
Industrial cyber–physical systems (ICPS) are emerging platforms for various industrial applications. For instance, remote healthcare monitoring, real-time healthcare data generation, and many other applications have been integrated into the ICPS platform. These healthcare applications encompass workflow tasks, such as processing within hospitals, laboratory tests, and insurance companies for patient payments, which necessitate a sequential flow. The external wireless, fog, and cloud services within ICPS face security issues that impact end-users’ healthcare applications. Blockchain technology offers an optimal solution for ICPS-enabled applications. However, blockchain technology for the ICPS platform is still vulnerable to cyberattacks, while microservices are essential for executing applications. This paper introduces the novel “Pattern-Proof Malware Validation” (PoPMV) algorithm designed for blockchain in ICPS. It exploits a deep learning model (LSTM) with reinforcement learning techniques to receive feedback and rewards in real-time. The primary objective is to mitigate security vulnerabilities, enhance processing speed, identify both familiar and unfamiliar attacks, and optimize the functionality of ICPS. Simulations demonstrate the superiority of the proposed approach compared to current blockchain frameworks, showcasing dynamic allocation of microservices and improved security with comprehensive attack detection by 30%.
With the development of the Internet of Things technology, the smart home industry is rapidly developing, and the collection and use of sensitive user data are also increasing. The issue of user privacy protection is becoming increasingly prominent and has received widespread attention. However, related research is still in its infancy. Firstly, the technical architecture of the smart home system was introduced, and an in-depth analysis was conducted on the privacy issues and the reasons for their increasing severity in the system. Secondly, based on the degree of use of privacy data such as user personal information and behavior, existing smart home systems were classified. Once again, the research status of different technologies in smart home privacy protection, such as access control, policy control, data minimization, network traffic obfuscation, federated learning, homomorphic encryption, and zero knowledge proof, was summarized and organized, and a comparative analysis was conducted on various technologies. Finally, corresponding suggestions were proposed for privacy protection in smart home systems.
If tokenized assets are to be a reality in the future decentralized Web3 then transaction keys need to be distributed and under the control of the asset-owners. This requires a careful design of wallet systems based on trusted hardware. A core feature needed for wallet systems is the attestation of the state of the transaction keys in the wallet without disclosure of the keys. This feature is relevant for relying parties such as insurance providers who need to perform risk assessment based on the security quality of the environment inside the wallet system that is protecting the transaction keys. In the longer term, all key-bearing devices that participate in a decentralized tokenized asset network will need to be hardened using trusted hardware, with attestation capabilities for detecting and countering cyberattacks.
M. Mazhar Rathore, Sushil S. Chaurasia, Dhirendra Shukla, Prashant Anand
Due to the rise in the use of crypto-currencies, such as Bitcoin and Ethereum, the fraud activities in the financial sector are increasing at the same pace. It becomes very challenging to detect frauds in crypto-currencies, because of it's distributed and anonymized nature and not having central control. In this paper, we exploited the decision-tree based machine learning model using a boosting approach, particularly XGBoost, to identify the fraudulent addresses in the Ethereum crypto-currency. To select a best decision tree and learning approach on our fraud dataset, initially, we chose four highly performed decision tree learning approaches including CART, random forest, LGBM, XGBoost, and applied a cross validation mechanism to select the top one based on accuracy. Among CART, random forest, gradient boosting tree, we selected the XGBoost model as the final model and tuned it for the best hyper parameters. Finally, we built the model on 80% of the training data, which has produced accuracy of more than 96% on test data. Further, the model is highly efficient to work in a real environment, as proved by running extensive experiments.
Smart contracts are programs that define rules for transactions running on blockchains. Since any qualified transaction sequence within the same block can be orchestrated by the blockchain miner, unexpected results may occur due to data races between transactions (called transaction races). Surprisingly, transaction races in smart contracts have not been fully investigated. To address this, we propose TransRacer, an automated approach and open-source tool that employs symbolic execution to detect transaction races in smart contracts. TransRacer analyzes function dependencies to identify transaction races hidden in specific contract states. It also generates witness transactions that can trigger such races. The experimental results on 50 real-world smart contracts show the effectiveness and efficiency of TransRacer: it detects 426 races in 255.9 minutes, including 149 race bugs leading to inconsistent states.
We present SmartFix, a new technique for repairing vulnerable smart contracts. There is an urgent need to develop automatic bug-repair techniques for smart contracts, as smart contracts are safety-critical software and manual debugging is burdensome and error-prone. While several repair approaches have been proposed recently, they are unsatisfactory since no existing techniques can achieve high repairability, full automation, and safety guarantee at the same time, posing significant problems for practical use. SmartFix aims to address these shortcomings by using a “generate-and-verify” approach that iteratively enumerates candidate patches while validating their correctness by invoking a safety verifier. However, in this approach, a technical challenge arises as the search space is huge and the verification-based patch validation is expensive. To address this challenge, we present a novel technique for accelerating the generate-and-verify repair procedure using statistical models derived from the verifier’s feedback. Experimental results on real-world Ethereum smart contracts show that SmartFix is able to achieve a fix success rate of 94.8% for critical classes of vulnerabilities, far outperforming sGuard, the existing state-of-the-art technique whose success rate is 65.4%.
As the development of Solidity smart contracts has increased in popularity, the reliance on external sources such as third-party packages increases to reduce development costs. However, despite the use of external sources bringing flexibility and efficiency to the development, they could also complicate the process of assuring the security of downstream applications due to the lack of package managers for standardized ways and sources. While previous studies have only focused on code clones without considering how the external components are introduced, the compositions of a smart contract and their characteristics still remain puzzling.
Cyber-physical systems (CPS) are becoming increasingly ubiquitous, connecting the physical world with the cyber realm. This convergence has exposed CPS to a growing threat landscape, necessitating robust intrusion detection systems (IDS) to safeguard critical infrastructure. Deep learning (DL) has emerged as a powerful tool for IDS, and convolutional neural networks (CNNs) have demonstrated exceptional performance in this domain. However, traditional IDS models are susceptible to data tampering and manipulation, compromising their integrity and effectiveness. Blockchain technology, with its inherent immutability and tamper-proof nature, offers a promising solution to enhance the security and reliability of IDS models. In this study, we propose a CNN-based IDS model that leverages blockchain technology to secure network traffic data. Our hypothesis is that integrating blockchain with CNNs can significantly improve the security and robustness of IDS models against data tampering and manipulation. To test our hypothesis, we employ a greedy-based genetic algorithm to select the most relevant features from network traffic data, followed by training a CNN model using the selected features. Finally, we evaluate the trained CNN model on a real-world dataset, demonstrating its ability to accurately classify network traffic as normal or intrusive. The results of our evaluation reveal that the proposed CNN-based IDS model achieves a classification accuracy of 99.2%, surpassing traditional IDS models. Moreover, our model exhibits enhanced resilience against data tampering and manipulation, demonstrating the effectiveness of blockchain integration in safeguarding the integrity of IDS models. Our findings underscore the potential of blockchain-enhanced CNNs as a robust and secure solution for intrusion detection in CPS, ensuring the integrity and protection of critical infrastructure.
The latest advancements in artificial intelligence (AI) technologies, including machine and deep learning models, in prediction, recommending, and automating processes have greatly impacted IoT devices in general, and protect them from cyberattacks in particular. Blockchain also has features that assist in creating more secure IoT devices due to its abilities of traceability, acceptability, and trust. This paper studies the current advancements in the IoT and blockchain, their architectures, and their effect on security. The paper proposes a novel framework that takes into consideration the advantages and benefits of machine/deep learning models and blockchain in order to provide a solution that makes IoT devices more secure. This framework is based on the IoT four-layer architecture, and it aims to enhance the way IoT devices detect and recognise cyberattacks using blockchain and machine/deep learning algorithms. Machine and deep learning algorithms are responsible for detecting security attacks in the IoT, based on their patterns. The blockchain platform is responsible for verifying whether a specific request is secure, and it also uses cryptography to sign all new requests in order to recognise them in future requests. The MQTTset dataset, which is contains data associated with intrusion detection cases, has been used to implement a case study that aims to prove the validity of this framework. Various machine and deep learning algorithms have been used in this case study which have all achieved high results with regard to precision, recall, accuracy, and F1 performance measurements. Such results have proven the validity and reliability of the proposed framework to detect and predict new attacks before their requests are processed within a particular IoT system.
Anna Vacca, Michele Fredella, Andrea Di Sorbo, Corrado Aaron Visaggio · 5 authors
Abstract Blockchain is a cross‐cutting technology allowing interactions among untrusted entities in a distributed manner without the need for involving a trusted third party. Smart contracts (i.e., programs running on the blockchain) enabled organizations to envision and implement solutions to real‐world problems in less cost and time. Given the immutability of blockchain and the lack of best practices for properly designing and developing smart contracts, it is crucial to assure smart contract quality before deployment. With the help of an exploratory survey involving developers and researchers, this paper identifies the practices and tools used to develop, implement, and evaluate smart contracts. The survey received 55 valid responses. Such responses indicate that (i) inefficiencies may occur during the development cycle of a smart contract, especially regarding requirements specification, design, and testing phases, and (ii) the lack of a shared standard to evaluate the functional quality of implemented smart contracts. To start coping with these issues, the adoption of functional suitability assessment measures recommended by the ISO/IEC 25000 standard, widely used in software engineering, is proposed by adapting them to the context of smart contracts. Through some examples, the manuscript also illustrates how to measure the functional completeness and correctness of smart contracts. The proposed procedure to measure smart contract functional suitability brings advantages to both developers and users of decentralized finance or non‐fungible tokens platforms, data marketplaces, or shipping and real estate services, just to mention a few. In particular, it helps (i) better outline the responsibilities of smart contracts, (ii) uncover errors and deficiencies of smart contracts in the early stages, and (iii) ensure that the established requirements are met.
Ayodeji Adeniran, Mohammed Alkinoon, Aziz Mohaisen
We present our results on analyzing and understanding the behavior and security of various metaverse platforms incorporating cryptocurrencies. We obtained the top metaverse coins with a capitalization of at least 25 million US dollars and the top metaverse domains for the coins, and augmented our data with name registration information (via whois), including the hosting DNS IP addresses, registrant location, registrar URL, DNS service provider, expiry date and check each metaverse website for information on fiat currency for cryptocurrency. The result from virustotal.com includes the communication files, passive DNS, referrer files, and malicious detections for each metaverse domain. Among other insights, we discovered various incidents of malicious detection associated with metaverse websites. Our analysis highlights indicators of (in)security, in the correlation sense, with the files and other attributes that are potentially responsible for the malicious activities.