With the widespread adoption of blockchain platforms across various decentralized applications, the smart contract’s vulnerabilities are continuously growing and evolving. Consequently, a failure to optimize conventional vulnerability analysis methods results in unforeseen effects caused by overlooked classes of vulnerabilities. Current methods have difficulty dealing with multifaceted intrusions, which calls for more robust approaches. Therefore, overdependence on environment-defined parameters in the contract execution logic binds the contract to the manipulation of such parameters and is perceived as a security vulnerability. Several vulnerability analysis tools have been identified as insufficient to effectively identify certain types of vulnerability. In this paper, we perform a domain-specific evaluation of state-of-the-art vulnerability detection tools on smart contracts. A domain can be defined as a particular area of knowledge, expertise, or industry. We use a perspective specific to the area of energy contracts to draw logical and language-dependent features to advance the structural and procedural comprehension of these contracts. The goal is to reach a greater degree of abstraction and navigate the complexities of decentralized applications by determining their domains. In particular, we analyze code embedding of energy smart contracts and characterize their vulnerabilities in transactive energy systems. We conclude that energy contracts can be affected by a relatively large number of defects. It also appears that the detection accuracy of the tools varies depending on the domain. This suggests that security flaws may be domain-specific. As a result, in some domains, many vulnerabilities can be overlooked by existing analytical tools. Additionally, the overall impact of a specific vulnerability can differ significantly between domains, making its mitigation a priority subject to business logic. As a result, more effort should be directed towards the reliable and accurate detection of existing and new types of vulnerability from a domain-specific point of view.
The consumer Internet of Things (IoT) applications in particular smart cities are mostly equipped with Internet-connected networked devices to improve city operations by giving access to a massive amount of valuable information. However, these smart devices in a smart city environment mostly use public channels to access and share data among different participants. This has introduced a great interest in using authentication and key agreement (AKA) mechanisms and intrusion detection systems (IDS) based on artificial intelligence (AI) techniques. However, most of the AKA mechanisms have high computation and communication costs and cannot be trusted completely. On the other hand, the AI-based IDS are treated as blackbox by the security analyst due to their inability to explain the reasons behind the decision. In this direction, we have integrated blockchain-based AKA mechanism with explainable artificial intelligence (XAI) for securing smart city-based consumer applications. Specifically, first, the participating entities communicate with each other in a secure manner to exchange data using a blockchain-based AKA mechanism. On the other hand, we have used SHapley Additive exPlanations (SHAP) mechanism to explain and interpret the prominent features that constituent most in the decision. The practical implementation of the proposed framework proves the efficiency over other recent state-of-the-art techniques.
IOTA is a new public chain system specifically designed for the Internet of Things (IoT), which provides strong support for the high concurrency, scalability, and zero handling fees of the IoT. The distributed ledger of IOTA, called the tangle, adopts a Directed Acyclic Graph (DAG) structure. However, compared to the single-chain architecture, the tangle is more complex and highly vulnerable to security threats. The existing transaction verification methods still cannot simultaneously meet the need for accelerating approval speed and improving security to resist illegal transactions, such as lazy tips and permanent tips. In this work, we propose TDTS, a tip-selection algorithm based on time division to improve the efficiency of transaction verification. The main idea of the algorithm is to quickly determine two tips of an incoming transaction that need to be confirmed by sorting tip values in a time slot. It shortens the transaction verification time and reduces the number of lazy tips and permanent tips. A comprehensive theoretical analysis confirmed the effectiveness of our proposed algorithm. Based on 1000 IOTA nodes, the evaluations showed that TDTS can select tips quickly like URTS and resist lazy tips like MCMC.
Long He, Xiangfu Zhao, Yichen Wang, Jiahui Yang · 5 authors
Security incidents in smart contracts still occur frequently, as the underlying code is often vulnerable to attacks. However, traditional methods to detect vulnerabilities in smart contracts are limited by certain rigid rules, reducing accuracy and scalability. In this work, we propose GraphSA, which combines Graph neural networks (GNNs) and Static Analysis for smart contract vulnerability detection. First, we present the contract tree, which is obtained by converting the control flow graph (CFG) of a smart contract. Each node in the tree represents a crucial operation code (opcode) block, and each edge represents the control flow (execution order) between code blocks. Then, we propose an extended SAGConv and Topkpooling graph neural network (ST-GNN) to learn the features of each node in the tree. To enhance detection accuracy, we eliminate and merge some non-crucial nodes to highlight key nodes and execution orders. Finally, we evaluate our approach on 7,962 real-world smart contracts running on Ethereum and compare it with state-of-the-art approaches on six types of vulnerabilities. Experimental results show that our approach achieves higher detection accuracy than others.
The use of smart contracts enhances the capabilities of blockchain-based botnets, allowing for greater information capacity, richer application scenarios, and the deployment of program functions directly on the blockchain. However, smart blockchains offer a better solution for the intelligence of IoT systems, but they also come with some security risks. Botnet is a highly insecure community because it is used to do hazardous things like Distributed Denial of Service (DDoS). It is extremely essential to detect botnets with some useful tools, such as artificial intelligence (AI) algorithms, because these algorithms can assist us to monitor the network automatically. We need to pay the utmost attention to some feature engineering work, as recognition rates of AI models are considerably improved with suitable features. In this article, we propose domain embedding (DE) models to generate low-dimensional features for domains with unsupervised learning algorithms. We also explore some key parameters of the DE model to obtain decent effects on domain features. A modified version of the$k$-means algorithm called extended$k$-means, is used to cluster these domains in certain hubs and botnets that can be found for smart blockchain-based IoT systems. In the experiments, some domain correlation scores can be computed during the DE model, and similar domains have higher correlation scores.
The Internet of Things (IoT) is the most extensively utilized technology nowadays that is simple and has the advantage of replacing the data with other devices by employing cloud or wireless networks. However, cyber-threats and cyber-attacks significantly affect smart applications on these IoT platforms. The effects of these intrusions lead to economic and physical damage. The conventional IoT security approaches are unable to handle the current security problems since the threats and attacks are continuously evolving. In this background, employing Artificial Intelligence (AI) knowledge, particularly Machine Learning (ML) and Deep Learning (DL) solutions, remains the key to delivering a dynamically improved and modern security system for next-generation IoT systems. Therefore, the current manuscript designs the Honey Badger Algorithm with an Optimal Hybrid Deep Belief Network (HBA-OHDBN) technique for cyberattack detection in a blockchain (BC)-assisted IoT environment. The purpose of the proposed HBA-OHDBN algorithm lies in its accurate recognition and classification of cyberattacks in the BC-assisted IoT platform. In the proposed HBA-OHDBN technique, feature selection using the HBA is implemented to choose an optimal set of features. For intrusion detection, the HBA-OHDBN technique applies the HDBN model. In order to adjust the hyperparameter values of the HDBN model, the Dung Beetle Optimization (DBO) algorithm is utilized. Moreover, BC technology is also applied to improve network security. The performance of the HBA-OHDBN algorithm was validated using the benchmark NSLKDD dataset. The extensive results indicate that the HBA-OHDBN model outperforms recent models, with a maximum accuracy of 99.21%.
The rapid expansion of the Internet of Things (IoT) on a global scale has facilitated the convergence of revolutionary technologies such as artificial intelligence (AI), blockchain, and cloud computing. The integration of these technologies has paved the way for the development of intricate infrastructures, such as smart homes, smart cities, and smart industries, that are capable of delivering advanced solutions and enhancing human living standards. Nevertheless, IoT devices, while providing effective connectivity and convenience, often rely on traditional network interfaces that can be vulnerable to exploitation by adversaries. If not properly secured and updated, these legacy communication protocols and interfaces can expose potential vulnerabilities that attackers may exploit to gain unauthorized access, disrupt operations, or compromise sensitive data. To overcome the security challenges associated with smart home systems, we have devised a robust framework that leverages the capabilities of both AI and blockchain technology. The proposed framework employs a standard dataset for smart home systems, from which we first eliminated the anomalies using an isolation forest (IF) algorithm using random partitioning, path length, anomaly score calculation, and thresholding stages. Next, the dataset is utilized for training classification algorithms, such as K-nearest neighbors (KNN), support vector machine (SVM), linear discriminate analysis (LDA), and quadratic discriminant analysis (QDA) to classify the attack and non-attack data of the smart home system. Further, an interplanetary file system (IPFS) is utilized to store classified data (non-attack data) from classification algorithms to confront data-manipulation attacks. The IPFS acts as an onsite storage system, securely storing non-attack data, and its computed hash is forwarded to the blockchain’s immutable ledger. We evaluated the proposed framework with different performance parameters. These include training accuracy (99.53%) by the KNN classification algorithm and 99.27% by IF for anomaly detection. Further, we used the validation curve, lift curve, execution cost of blockchain transactions, and scalability (86.23%) to showcase the effectiveness of the proposed framework.
This paper serves as a progress report on our research, specifically focusing on utilizing interval analysis, an existing static analysis method, for detecting vulnerabilities in smart contracts. We present a selection of motivating examples featuring vulnerable smart contracts and share the results from our experiments conducted with various existing detection tools. Our findings reveal that these tools were unable to detect the vulnerabilities in our examples. To enhance detection capabilities, we implement interval analysis on top of Slither [3], an existing detection tool, and demonstrate its effectiveness in identifying certain vulnerabilities that other tools fail to detect.
With the economic development of Ethereum, the frequent security incidents involving smart contracts running on this platform have caused billions of dollars in losses. Consequently, there is a pressing need to identify the vulnerabilities in contracts, while the state-of-the-art (SOTA) detection methods have been limited in this regard as they cannot overcome three challenges at the same time. (i) Meet the requirements of detecting the source code, bytecode, and opcode of contracts simultaneously; (ii) reduce the reliance on manual pre-defined rules/patterns and expert involvement; (iii) assist contract developers in completing the contract lifecycle more safely,e.g., vulnerability repair and abnormal monitoring. With the development of machine learning (ML), using it to detect the contract runtime execution sequences (called instances) has made it possible to address these challenges. However, the lack of datasets with fine-grained sequence labels poses a significant obstacle, given the unreadability of bytecode/opcode. To this end, we propose a method named VulHunter that extracts the instances by traversing the Control Flow Graph built from contract opcodes. Based on the hybrid attention and multi-instance learning mechanisms, VulHunter reasons the instance labels and designs an optional classifier to automatically capture the subtle features of both normal and defective contracts, thereby identifying the vulnerable instances. Then, it combines the symbolic execution to construct and solve symbolic constraints to validate their feasibility. Finally, we implement a prototype of VulHunter with 15K lines of code and compare it with 9 SOTA methods on five open source datasets including 52,042 source codes and 184,289 bytecodes. The results indicate that VulHunter can detect contract vulnerabilities more accurately (90.04% accurate rate and 85.60% F1 score), efficiently (only took 4.4 seconds per contract), and robustly (0% analysis failed rate) than the SOTA methods. Also, it can focus on specific metrics such as precision and recall by employing different baseline models and hyperparameters to meet the various user requirements,e.g., vulnerability discovery and misreport mitigation. More importantly, compared with the previous ML-based arts, it can not only provide classification results, defective contract source code statements, key opcode fragments, and vulnerable execution paths, but also eliminate misreports and facilitate more operations such as vulnerability repair and attack simulation during the contract lifecycle.
Cyber attack detection is the process of detecting and responding to malicious or unauthorized activities in networks, computer systems, and digital environments. The objective is to identify these attacks early, safeguard sensitive data, and minimize the potential damage. An intrusion detection system (IDS) is a cybersecurity tool mainly designed to monitor system activities or network traffic to detect and respond to malicious or suspicious behaviors that may indicate a cyber attack. IDSs that use machine learning (ML) and deep learning (DL) have played a pivotal role in helping organizations identify and respond to security risks in a prompt manner. ML and DL techniques can analyze large amounts of information and detect patterns that may indicate the presence of malicious or cyber attack activities. Therefore, this study focuses on the design of blockchain-assisted hybrid metaheuristics with a machine learning-based cyber attack detection and classification (BHMML-CADC) algorithm. The BHMML-CADC method focuses on the accurate recognition and classification of cyber attacks. Moreover, the BHMML-CADC technique applies Ethereum BC for attack detection. In addition, a hybrid enhanced glowworm swarm optimization (HEGSO) system is utilized for feature selection (FS). Moreover, cyber attacks can be identified with the design of a quasi-recurrent neural network (QRNN) model. Finally, hunter–prey optimization (HPO) algorithm is used for the optimal selection of the QRNN parameters. The experimental outcomes of the BHMML-CADC system were validated on the benchmark BoT-IoT dataset. The wide-ranging simulation analysis illustrates the superior performance of the BHMML-CADC method over other algorithms, with a maximum accuracy of 99.74%.
Abstract Future connected and autonomous vehicles (CAVs) must be secured against cyberattacks for their everyday functions on the road so that safety of passengers and vehicles can be ensured. This article presents a holistic review of cybersecurity attacks on sensors and threats regarding multi‐modal sensor fusion. A comprehensive review of cyberattacks on intra‐vehicle and inter‐vehicle communications is presented afterward. Besides the analysis of conventional cybersecurity threats and countermeasures for CAV systems, a detailed review of modern machine learning, federated learning, and blockchain approach is also conducted to safeguard CAVs. Machine learning and data mining‐aided intrusion detection systems and other countermeasures dealing with these challenges are elaborated at the end of the related section. In the last section, research challenges and future directions are identified. This article is categorized under: Commercial, Legal, and Ethical Issues > Security and Privacy Technologies > Machine Learning Technologies > Internet of Things
Auto-completing code enables developers to speed up coding significantly. Recent advances in transformer-based large language model (LLM) technologies have been applied to code synthesis. However, studies show that many of such synthesized codes contain vulnerabilities. We propose a novel vulnerability-constrained decoding approach to reduce the amount of vulnerable code generated by such models. Using a small dataset of labeled vulnerable lines of code, we fine-tune an LLM to include vulnerability labels when generating code, acting as an embedded classifier. Then, during decoding, we deny the model to generate these labels to avoid generating vulnerable code. To evaluate the method, we chose to automatically complete Ethereum Blockchain smart contracts (SCs) as the case study due to the strict requirements of SC security. We first fine-tuned the 6-billion-parameter GPT-J model using 186,397 Ethereum SCs after removing the duplication from 2,217,692 SCs. The fine-tuning took more than one week using ten GPUs. The results showed that our fine-tuned model could synthesize SCs with an average BLEU (BiLingual Evaluation Understudy) score of 0.557. However, many codes in the auto-completed SCs were vulnerable. Using the code before the vulnerable line of 176 SCs containing different types of vulnerabilities to auto-complete the code, we found that more than 70% of the auto-completed codes were insecure. Thus, we further fine-tuned the model on other 941 vulnerable SCs containing the same types of vulnerabilities and applied vulnerability-constrained decoding. The fine-tuning took only one hour with four GPUs. We then auto-completed the 176 SCs again and found that our approach could identify 62% of the code to be generated as vulnerable and avoid generating 67% of them, indicating the approach could efficiently and effectively avoid vulnerabilities in the auto-completed code.
The rapid growth of blockchain technology hasintroduced newsecurity challengesin decentralized systems.In this paper, we present Block-AD, a Blockchain Attack-Defense Capture The Flag (CTF) competition aimed at improving smart contract security skills and addressing evolving security threats in Next-Web3 environments. Unlike traditional CTF competitions, participants engage in attack and defense actions to exploit vulnerabilities and protect their smart contract services. This game-based approach concludes with rewards distributed from the competition’s vault and the allocation of non-fungible tokens (NFTs) as proof of participation. This approach aims to provide a fun and engaging way to improve the security skills of all participants, as well as to identify and fix vulnerabilities in smart contracts. By combining blockchain technology, CTF methodology, and Next-Web3 security, Block-AD provides a unique and innovative approach for enhancing cybersecurity skills in decentralized systems and smart contracts.
Abstract The emergence of Web 3.0, blockchain technology (BC), and artificial intelligence (AI) are transforming multiplayer online gaming in the metaverse. This development has its concerns about safety and inclusivity. Hate speech, in particular, poses a significant threat to the harmony of these online communities. Traditional moderation methods struggle to cope with the immense volume of user‐generated content, necessitating innovative solutions. This article proposes a novel framework,MetaHate, that employs AI and BC to detect and combat hate speech in online gaming environments within the metaverse. Various machine learning (ML) models are applied to analyze Hindi–English code mixed datasets, with gradient boosting proving the most effective, achieving 86.01% accuracy. AI algorithms are instrumental in identifying harmful language patterns, while BC technology ensures transparency and user accountability. Moreover, a BC‐based smart contract is proposed to support the moderation of hate speech in the game chat. Integrating AI and BC can significantly enhance the safety and inclusivity of the metaverse, underscoring the importance of these technologies in the ongoing battle against hate speech and in bolstering user engagement. This research emphasizes the potential of AI and BC synergy in creating a safer metaverse, highlighting the need for continuous refinement and deployment of these technologies.
Smart contracts are programs running on the blockchain. Comments in source code provide meaningful information for developers to facilitate code writing and understanding. Given various kinds of token standards in smart contracts (e.g., ERC-20, ERC-721), developers often copy&paste code from other projects as templates, and then implement their own logic as add-ons to such templates. In many cases, the consistency between code and comment is not well-aligned, leading to comment-code inconsistencies (as we call CCIs). Such inconsistencies can mislead developers and users, and even introduce vulnerabilities to the contracts. In this paper, we present SmartCoCo, a novel framework to detect comment-code inconsistencies in smart contracts. In particular, our research focuses on comments related to roles, parameters, and events that may lead to security implications. To achieve this, SmartCoCo takes the original smart contract source code as input and automatically analyzes the comment and code to find potential inconsistencies. SmartCoCo associates comment constraints and code facts via a set of propagation and binding strategies, allowing it to effectively discover inconsistencies with more contextual information. We evaluated SmartCoCo on 101,780 unique smart contracts on Ethereum. The evaluation result shows that SmartCoCo achieves good effectiveness and efficiency. In particular, SmartCoCo reports 4,732 inconsistencies from 1,745 smart contracts, with a precision of over 79% on 439 manual-labeled comment-code inconsistencies. Meanwhile, it only takes 2.64 seconds to check a smart contract on average.
Smart contracts have the potential to revolutionize many sectors by automating difficult procedures and removing the need for middlemen. Smart contracts are self-executing contracts in which the contents of the agreement between the buyer and seller are directly encoded into lines of code. Nevertheless, because smart contracts are immutable, vulnerabilities cannot be easily rectified after they are implemented. For this reason, it is essential to identify and eliminate vulnerabilities before implementation. The Ethereum Blockchain is the primary home of such Contracts which are written in the full-fledged programming language-Solidity. The process of finding these vulnerabilities before deployment is known as Smart Contract Auditing. We propose this new scalable framework of Smart Contract Auditing which promises accuracy and dependability using Deep Learning approaches that can be leveraged for large scale auditing.
Sep 7, 2023·2023 IEEE 12th International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS)
In this paper we analyze how and why new emerging technologies originally developed outside security fields such as Blockchain and Large Language Models (LLMs) can and may impact the development of cybersecurity. It proposes a security framework to deal with security challenges in Web3.
Alejandro M. Chirivella-Ciruelos, Marisol García‐Valls
Verification of smart contracts improves the sentiment of trust in blockchain as it guarantees their authenticity. However, verification has a cost that can affect the lifecycle flow in time-sensitive systems; as these may require shorter times in code development and smart contract deployment. This paper contributes a strategy to automate the execution of verification tests over smart contracts to extract the meaningful characteristics about the source code authenticity.
KeXin Gong, Xiangmei Song, Na Wang, Chunyang Wang · 5 authors
Abstract The security of smart contract has always been one of the significant problems in blockchain. As shown in previous studies, vulnerabilities in smart contracts can lead to unpredictable losses. With the rapid growth of the number of smart contracts, more and more data driven detection technologies based on machine learning have been proposed. However, some state‐of‐the‐art approaches mainly rely on the source code of smart contract. These methods are limited by the openness of the source code and the version of the programming language. To address this problem, we propose a novel vulnerability detection method based on transformer by constructing the control flow graph (CFG) of smart contracts operation codes (opcodes), which shields the difference of various versions of program language. Extensive experiments are conducted to evaluate the effectiveness of the proposed method on the authors' own collected dataset. The experimental results show that the proposed method achieves 94.36% accuracy in vulnerability detection, which performs better than other state‐of‐the‐art methods.
Solana has quickly emerged as a popular platform for building decentralized applications (DApps), such as marketplaces for non-fungible tokens (NFTs). A key reason for its success are Solana's low transaction fees and high performance, which is achieved in part due to its stateless programming model. Although the literature features extensive tooling support for smart contract security, current solutions are largely tailored for the Ethereum Virtual Machine. Unfortunately, the very stateless nature of Solana's execution environment introduces novel attack patterns specific to Solana requiring a rethinking for building vulnerability analysis methods. In this paper, we address this gap and propose FuzzDelSol, the first binary-only coverage-guided fuzzing architecture for Solana smart contracts. FuzzDelSol faithfully models runtime specifics such as smart contract interactions. Moreover, since source code is not available for the large majority of Solana contracts, FuzzDelSol operates on the contract's binary code. Hence, due to the lack of semantic information, we carefully extracted low-level program and state information to develop a diverse set of bug oracles covering all major bug classes in Solana. Our extensive evaluation on 6049 smart contracts shows that FuzzDelSol's bug oracles find bugs with a high precision and recall. To the best of our knowledge, this is the largest evaluation of the security landscape on the Solana mainnet.
Abstract The reentrancy vulnerability in smart contracts has caused significant losses in the digital currency economy. Existing solutions for detecting and repairing this vulnerability are limited in scope and lack a comprehensive framework. Additionally, there is currently a lack of guidance methods for effectively pinpointing the location of vulnerabilities. The proposed bytecode‐level method addresses these challenges by incorporating a detection module, an auxiliary localization module, and a repair module. An opcode classification method is introduced using vulnerability features and a BiLSTM‐Attention‐based sequence model to enhance detection accuracy. To overcome difficulties in vulnerability localization, an auxiliary localization method based on data flow and control flow analysis is proposed, enabling developers to better locate vulnerabilities. Current reentrancy vulnerability repair methods are analyzed and strategies for three reachable patterns are proposed. The bytecode rewriting strategy utilizes Trampoline technology for repair, while a fuel optimization method reduces bytecode generation length to optimize gas costs. Through extensive experimental validation, the effectiveness and superiority of the proposed methods are confirmed, further validating the feasibility of the entire framework. Experimental results demonstrate that the framework offers enhanced protection against reentrancy vulnerability attacks in smart contracts.
Ethereum recently unveiled its upcoming roadmap's \textit{Splurge} phase, highlighting the integration of EIP-\hlhref{https://eips.ethereum.org/EIPS/eip-3074}{4337} as a foundational standard for account abstraction (AA). AA aims to enhance user accessibility and facilitate the expansion of functionalities. Anticipatedly, the deployment of AA is poised to attract a broad spectrum of new users and ignite further innovation in DApps. In this paper, we elucidate the underlying operating mechanisms of this new concept, as well as provide a review of concurrent advancements in accounts, wallets, and standards related to its development. We step further by conducting a preliminary security evaluation to qualitatively assess the extent of security enhancements achieved through AA updates.