Dec 1, 2022·2022 IEEE 24th Int Conf on High Performance Computing & Communications; 8th Int Conf on Data Science & Systems; 20th Int Conf on Smart City; 8th Int Conf on Dependability in Sensor, Cloud & Big Data Systems & Application (HPCC/DSS/SmartCity/DependSys)
Bitcoin, due to its decentralization and anonymity, is more frequently utilized in cybercrimes such as money laundering, darknet market, and blackmail. In order to maintain the development of cryptocurrency communities, it is vital to fight against these cryptocurrency-related (e.g., Bitcoin) cybercrimes. To better monitor cryptocurrency-based cybercrime, it is essential for a deeper understanding of the patterns that exist in Bitcoin transactions. In this paper, we propose a novel framework consisting of empirical analysis and machine learning-based analysis for studying three typical categories of Bitcoin addresses from a dynamic perspective of subgraph evolution. Specifically, we collect 22,001 continuous blocks to build a Bitcoin transaction graph and extract subgraphs from the constructed graph for each address in different periods. In the empirical analysis, we have several important findings from three perspectives. While in the machine learning-based analysis, we propose a 110-dimensional feature set for classification tasks among these three types of Bitcoin addresses, where decision tree, k-nearest neighbor algorithm, and random forest are applied. The experimental results illustrate that metrics of all classifiers can achieve 0.88, and the highest accuracy rate reaches 0.95 in the random forest classifier. In addition, we explore the feature importance in the random forest using the SHAP library and discuss several interesting phenomena that appear in the evolution process of the subgraphs.
Due to the surging popularity of various cryptocurrencies in recent years, a large number of browser extensions have been developed as portals to access relevant services, such as cryptocurrency exchanges and wallets. This has stimulated a wild growth of cryptocurrency themed malicious extensions that cause heavy financial losses to the users and legitimate service providers. They have shown their capability of evading the stringent vetting processes of the extension stores, highlighting a lack of understanding of this emerging type of malware in our community. In this work, we conduct the first systematic study to identify and characterize cryptocurrency-themed malicious extensions. We monitor seven official and third-party extension distribution venues for 18 months (December 2020 to June 2022) and have collected around 3600 unique cryptocurrency-themed extensions. Leveraging a hybrid analysis, we have identified 186 malicious extensions that belong to five categories. We then characterize those extensions from various perspectives including their distribution channels, life cycles, developers, illicit behaviors, and illegal gains. Our work unveils the status quo of the cryptocurrency-themed malicious extensions and reveals their disguises and programmatic features on which detection techniques can be based. Our work serves as a warning to extension users, and an appeal to extension store operators to enact dedicated countermeasures. To facilitate future research in this area, we release our dataset of the identified malicious extensions and open-source our analyzer.
Dec 1, 2022·2022 IEEE 24th Int Conf on High Performance Computing & Communications; 8th Int Conf on Data Science & Systems; 20th Int Conf on Smart City; 8th Int Conf on Dependability in Sensor, Cloud & Big Data Systems & Application (HPCC/DSS/SmartCity/DependSys)
As an innovative technology of great significance, blockchain has been widely used in various walks of life. Meanwhile, scams have experienced rapid growth on the blockchain, the phishing scam is a classic fraud among them. Ethereum is the largest blockchain platform that supports smart contracts, and its ecosystem has been under serious threat due to phishing scams. Consequently, phishing scam detection is particularly critical for Ethereum to avoid economic loss. However, accounts on Ethereum are represented as strings without features, which brings great difficulties for detection. To combat this challenge, we propose an effective method based on Graph Convolutional Network (GCN) with Conditional Random Field (CRF) to detect phishing scams. Firstly, we process accounts and their neighbors with transaction records to build transaction graphs. Due to lack of portrait information, we adopt DeepWalk to provide initial features for each node. Then graph representations are learned through GCN with CRF. The extensive experiments show that the proposed model performs better than comparison methods on both precision and recall, which indicates that our method can effectively identify phishing scams on Ethereum.
Ian W. Gray, Jack Cable, Benjamin P. Brown, Vlad Cuiujuclu · 5 authors
Ransomware operations have evolved from relatively unsophisticated threat actors into highly coordinated cybercrime syndicates that regularly extort millions of dollars in a single attack. Despite dominating headlines and crippling businesses across the globe, there is relatively little in-depth research into the modern structure and economics of ransomware operations.In this paper, we leverage leaked chat messages to provide an in-depth empirical analysis of Conti, one of the largest ransomware groups. By analyzing these chat messages, we construct a picture of Conti’s operations as a highly-profitable business, from profit structures to employee recruitment and roles. We present novel methodologies to trace ransom payments, identifying over $80 million in likely ransom payments to Conti and its predecessor – over five times as much as in previous public datasets. As part of our work, we will publish a dataset of 666 labeled Bitcoin addresses related to Conti and an additional 75 Bitcoin addresses of likely ransom payments. Future work can leverage this case study to more effectively trace – and ultimately counteract – ransomware activity.
Selfish mining is a cryptocurrency mining process where a miner keeps a block private for a certain period instead of publishing it to the network. This process allows dishonest miners to create a different blockchain while others keep building on the previous one. When the private block gets published, the honest miners may find the private block higher than the actual one and start building on it. It can lead dishonest miners to have more revenue than their fair share. This research work proposes a selfish mining prevention mechanism, especially for public and permissionless blockchain by using three unique concepts: (i) Threshold Time, (ii) Alarming Block, and (iii) Block Interval Time. Our technique utilizes the timestamp of block generation time and publication time, which are used to calculate the Block Interval Time for every single block. Moreover, a new type of block named Alarming Block, which does not contain any transactions except the block header, is exploited along with the Block Interval Time to discard the selfish blocks, which are kept private for a certain amount of time.
Muhammad Rehman, Ibrahim Tariq Javed, Kashif Naseer Qureshi, Tiziana Margaria · 5 authors
In the pharmaceutical industry, problems like counterfeit drugs, including vaccines, and their supply chain management problems like transparency, immutability, and traceability exist. In the case of vaccines, it becomes more difficult to standardize and detect fake vaccines because the public has less awareness and knowledge about vaccines. Moreover, the increase in online pharmacies gives more opportunities for counterfeiting vaccines to enter the authentic supply chain management system. We present transparent, immutable and secure vaccine supply chain (TISVSchain), a framework based on blockchain to handle the issues of counterfeited vaccines and vaccine supply chain problems like transparency, immutability, and traceability. Our proposed framework can run both on the private and public blockchain. We have implemented the framework on public blockchain by using remix ide and the smart contracts designed by solidity language run on very low gas cost. We also carried out several experiments by changing the number of nodes and their block time to evaluate the performance of our framework in terms of transaction per second (TPS), gas cost, and propagation delay. Our proposed framework improves the security by using offline unique account addresses in blockchain-based frameworks and improves the overall efficiency of the framework by keeping the gas cost low, finding a way to decrease the number of lost blocks to keep low propagation delay, and keeping high TPS value. TISVSchain shows us promising results to improve vaccine supply chain management’s overall performance, security, and efficiency.
Malware detection approaches have been extensively studied for traditional software systems. However, the development of blockchain technology has promoted the birth of a new type of software system–decentralized applications. Composed of smart contracts, a type of application that implements the Ponzi scheme logic (called smart Ponzi schemes) has caused irreversible loss and hindered the development of blockchain technology. These smart contracts generally had a short life but involved a large amount of money. Whereas identification of these Ponzi schemes before causing financial loss has been significantly important, existing methods suffer from three main deficiencies, i.e., the insufficient dataset, the reliance on the transaction records, and the low accuracy. In this study, we first build a larger dataset. Then, a large number of features from multiple views, including bytecode, semantic, and developers, are extracted. These features are independent of the transaction records. Furthermore, we leveraged machine learning methods to build our identification model, i.e., Mul ti-view Cas cade Ensemble model (MulCas). The experiment results show that MulCas can achieve higher performance and robustness in the scope of our dataset. Most importantly, the proposed method can identify smart Ponzi scheme at the creation time.
Mariam Alnaqbi, Mariam Mohamed Al-Ali, Mahra Alremeithi, Maryam Yaqoub Al Ali · 5 authors
The emergence of Bitcoin has continued to grow both in value and fame, as it was introduced as the first decentralized cryptocurrency. Many studies have shown that criminals are exploiting bitcoin by using it to launder their money, which originates from illegal activities or cybercrime. This paper aims at providing a comparison of detection techniques for preventing money laundering in bitcoin through various methods including graph theory, prevention of mixing services, and machine learning techniques including Random Forest, Shallow Neural Networks, optimizable Decision Trees, Bagging, Boosting algorithms, and Ensemble learning combining Random Forest, Bagging and Extra Tree.
Sameer Al-Jeshi, Ahmed Tarfa, Hasan Al-Aswad, Wael Elmedany · 5 authors
The Financial Technologies (Fintech) plays a major role in transforming traditional financial institutions. Although it disrupts them, fintech enables these traditional financial institutions to reduce costs, introduce innovative solutions and gain a competitive edge over rivals and develop new digital technology and infrastructure, which increase the dependency on digital systems. The stronger dependence on these new technologies widens the cyber threat landscape towards digital systems/assets and these institutions. This landscape is rapidly increasing and getting more complex. Threat actors are becoming more organized, sophisticated, and cyber-crime has been commercialized. WannaCry, one of the recent large-scale cyber-attacks with global impact was an example of how vulnerabilities can be used in attacks for financial gains. This paper aims to critically analyze the spectrum of cyber threats facing the digital financial sector and illustrate the distributed ledger as an appealing solution which protects the database with its immutable property, as one of the most important assets to digital banking and its’ data. A blockchain model is illustrated to show how the technology can lead to safer implementation, enhanced operations, and to reduced exposure to cyber threats.
Cryptocurrencies, such as Bitcoin and Ethereum, are becoming increasingly prevalent mainly due to their anonymity, decentralization, transparency, and security. However, the completely public ledger makes the trace and analysis of each account possible as long as the identity behind the public address is revealed. Theoretically, social networks could make that happen when addresses are posted on social network platforms using accounts containing personal information. To verify such a possibility, we have collected public data from two major platforms, i.e. Twitter and Reddit, aiming to find potential privacy leakage behind the ETH public address. In the end, an easy-to-use retrieval application is also built for a better illustration.
Jiho Choi, Junghoon Park, Woocheol Kim, Jin‐Hyeok Park · 6 authors
The recent advent of play-to-earn (P2E) systems in massively multiplayer online role-playing games (MMORPGs) has made in-game goods interchangeable with real-world values more than ever before. The goods in the P2E MMORPGs can be directly exchanged with cryptocurrencies such as Bitcoin, Ethereum, or Klaytn via blockchain networks. Unlike traditional in-game goods, once they had been written to the blockchains, P2E goods cannot be restored by the game operation teams even with chargeback fraud such as payment fraud, cancellation, or refund. To tackle the problem, we propose a novel chargeback fraud prediction method, PU GNN, which leverages graph attention networks with PU loss to capture both the players' in-game behavior with P2E token transaction patterns. With the adoption of modified GraphSMOTE, the proposed model handles the imbalanced distribution of labels in chargeback fraud datasets. The conducted experiments on three real-world P2E MMORPG datasets demonstrate that PU GNN achieves superior performances over previously suggested methods.
E. Padmalatha, Sailekya Sheral, K Dhanush, S. Samveeth · 6 authors
Bitcoin, as one of the most popular cryptocurrencies, is notorious for its concerning volatility on any given day, which leads to people having mixed feelings about it. This paper examines the opinions of people all over the world using data gathered from the social media platform Twitter, to decide if investing in bitcoin is a good idea for future. The opinions are analyzed and classified using the Bernoulli and Multinomial Naive Bayes model through sentiment analysis, the models implemented yielded 87 and 86 percent of accuracies respectively. Furthermore, the variation in sentiment over time is comparedto the variation in bitcoin price over the same period.
Emotions form an essential and fundamental aspect of our lives. What we do and say reflects some of our feelings in some way, though not directly. We must examine these feelings using emotional data, also known as affect data, to comprehend a person's basic behavior. Text, voice, facial expressions, and other data types can be included. Since social networking websites have become so popular, many individuals have started reading the material on these numerous sites.Twitter is one of these social networking sites. People's feelings and thoughts about a subject reveal positive, negative, and neutral emotional values. Doing sentiment analysis on Twitter is a very important and challenging task. In this study, we aim to investigate the sentiments of Bitcoin and provide an overview of its effect on the value of Bitcoin by utilizing the power of deep learning architectures and machine learning methods. The study collected tweets in English shared on Twitter between December 12, 2021, and March 13, 2022. First, people's feelings about Bitcoin were assessed using TextBlob, a natural language processing (NLP) tool. Then, it was done using basic machine learning algorithms for sentiment classification and CNN, LSTM, and BiLSTM deep learning architectures that we modeled. However, deep learning models were tested separately with the TF-IDF and Glove word embedding approaches. Experimental results prove the success of deep learning architectures using the Glove word embedding approach.
With the blooming of blockchain-based smart contracts in decentralized applications, the security problem of smart contracts has become a critical issue, as vulnerable contracts have resulted in severe financial losses. Existing research works have explored vulnerability detection methods based on fuzzing, symbolic execution, formal verification, and static analysis. In this paper, we propose two static analysis approaches called ASGVulDetector and BASGVulDetector for detecting vulnerabilities in Ethereum smart contacts from source-code and bytecode perspectives, respectively. First, we design a novel intermediate representation called abstract semantic graph (ASG) to capture both syntactic and semantic features from the program. ASG is based on syntax information but enriched by code structures, such as control flow and data flow. Then, we apply two different training models, i.e., graph neural network (GNN) and graph matching network (GMN), to learn the embedding of ASG and measure the similarity of the contract pairs. In this way, vulnerable smart contracts can be identified by calculating the similarity to labeled ones. We conduct extensive experiments to evaluate the superiority of our approaches to state-of-the-art competitors. Specifically, ASGVulDetector improves the best of three source-code-only static analysis tools (i.e., SmartCheck, Slither, and DR-GCN) regarding the F1 score by 12.6% on average, while BASGVulDetector improves that of the three detection tools supporting bytecode (i.e., ContractFuzzer, Oyente, and Securify) regarding the F1 score by 25.6% on average. We also investigate the effectiveness and advantages of the GMN model for detecting vulnerabilities in smart contracts.
Prof. Sumit Shevtekar, Ajay Raut, Pranit Chaudhari
People no longer trust charities as a result of the lack of openness, which has caused social investment to stagnate. The donor is unaware of how his money is being used legally. Mistrust of the donor is increased by corruption. In this study, a decentralised network named Charity-Chain that is based on the Ethereum blockchain is proposed. By employing smart contract-based incentives to ensure that their impact is independently validated and available to everyone, it aids social organisations in managing initiatives transparently. For funders (philanthropic organisations, impact investors, and small donors), this makes it much simpler for them to monitor their transactions and, as a result, restore their trust in funding these types of social organisations.
Smart contracts publicly deployed on blockchain have been shown to contain several vulnerabilities that users can maliciously exploit. To detect smart contract vulnerabilities as categorized in the Smart Contract Weakness Classification (SWC) standard, we propose the SWC-based Analysis Tool (SWAT). It operates by matching patterns in Solidity codes, making it easy to use and allowing any Solidity developers to conveniently check their smart contracts before deploying. We conducted experiments to compare the proposed solution against state-of-the-art tools in identifying 46 SWC registries. SWAT outperformed the existing tools in terms of the number of SWC vulnerabilities supported. Moreover, our solution is memory-efficient as it uses 44.58% less memory than other tools.
Gibran Gómez, Pedro Moreno-Sánchez, Juan Caballero
Cybercriminals often leverage Bitcoin for their illicit activities. In this work, we propose back-and-forth exploration, a novel automated Bitcoin transaction tracing technique to identify cybercrime financial relationships. Given seed addresses belonging to a cybercrime campaign, it outputs a transaction graph, and identifies paths corresponding to relationships between the campaign under study and external services and other cybercrime campaigns. Back-and-forth exploration provides two key contributions. First, it explores both forward and backwards, instead of only forward as done by prior work, enabling the discovery of relationships that cannot be found by only exploring forward (e.g., deposits from clients of a mixer). Second, it prevents graph explosion by combining a tagging database with a machine learning classifier for identifying addresses belonging to exchanges.
Smart contracts are increasingly used with blockchain systems for high-value applications. It is highly desired to ensure the quality of smart contract source code before they are deployed. This paper proposes a new deep learning-based tool, MANDO-GURU, that aims to accurately detect vulnerabilities in smart contracts at both coarse-grained contract-level and fine-grained line-level. Using a combination of control-flow graphs and call graphs of Solidity code, we design new heterogeneous graph attention neural networks to encode more structural and potentially semantic relations among different types of nodes and edges of such graphs and use the encoded embeddings of the graphs and nodes to detect vulnerabilities. Our validation of real-world smart contract datasets shows that MANDO-GURU can significantly improve many other vulnerability detection techniques by up to 24% in terms of the F1-score at the contract level, depending on vulnerability types. It is the first learning-based tool for Ethereum smart contracts that identify vulnerabilities at the line level and significantly improves the traditional code analysis-based techniques by up to 63.4%. Our tool is publicly available at https://github.com/MANDO-Project/ge-sc-machine. A test version is currently deployed at http://mandoguru.com, and a demo video of our tool is available at http://mandoguru.com/demo-video.
Cryptocurrencies have the potential to enable socioeconomic growth throughout the world by offering easier access to capital and financial services. However, many virtual asset service providers (VASPs) that offer cryptocurrency services lack identity management and can be accessed anonymously, which has led to their services being exploited by criminal activities such as money laundering and illegal foreign exchange. Such crimes have a negative impact on socioeconomic sustainability. Building identity systems on blockchains can help VASPs improve their identity management to combat cryptocurrency-based crimes so VASPs can better serve the social economy and achieve their sustainability goals. However, existing solutions have privacy problems because the identity provider can associate users’ identities with their wallet accounts. In addition, there is currently no solution that can support all public blockchains unconditionally, as current solutions can only support EVM-compliant blockchains or require additional work to support new blockchains. This article proposes a KYC (know your customer)-compliant identity scheme based on Ethereum using Merkle trees and smart contracts. The identity and wallet accounts are linked by the user rather than the KYC provider so, in general, no one but the user knows the association between the wallet accounts and the identity, which protects privacy. For suspicious accounts, supervisors can trace their identities and thus achieve supervision. In addition, the scheme supports identifying accounts on all public blockchains by using Merkle trees and smart contracts to bind accounts on multiple blockchains to one identity and no extra work is required. Moreover, the scheme supports users to prove that their attributes meet the requirements of VASPs by adopting the BBS+ signature and the Sigma protocol.
In the recent development of the online cryptocurrency mining platform, Coinhive, numerous websites have employed “Cryptojacking.” They may need the unauthorized use of CPU resources to mine cryptocurrency and replace advertising income. Web cryptojacking technologies are the most recent attack in information security. Security teams have suggested blocking Cryptojacking scripts by using a blacklist as a strategy. However, the updating procedure of the static blacklist has not been able to promptly safeguard consumers because of the sharp rise in “Cryptojacking kidnapping”. Therefore, we propose a Cryptojacking identification technique based on analyzing the user's computer resources to combat the assault technology known as “Cryptojacking kidnapping.” Machine learning techniques are used to monitor changes in computer resources such as CPU changes. The experiment results indicate that this method is more accurate than the blacklist system and, in contrast to the blacklist system, manually updates the blacklist regularly. The misuse of online Cryptojacking programs and the unlawful hijacking of users' machines for Cryptojacking are becoming worse. In the future, information security undoubtedly addresses the issue of how to prevent Cryptojacking and abduction. The result of this study helps to save individuals from unintentionally becoming miners.
Supply chain traceability has become a prime requirement for industries to ensure product quality. Existing solutions often rely on trusted third parties to track the provenance and journey of products in a centralized manner. Blockchain provides a decentralized solution that can achieve immutability and auditability for digital records of supply chain transactions without the need of third parties. However, existing blockchain-based methods do not carefully consider the tracing process, which often needs to retrieve transaction logs related to the target product from a large number of irrelevant logs, resulting in unsatisfactory space overhead and slow query time. Moreover, current smart contracts often ignore the time spent on Ethereum calls, which consume a lot of time when fetching logs. In this paper, we propose a space-saving blockchain-based mechanism to efficiently explore the transaction logs for supply chain traceability. The mechanism introduces a new filter to identify relevant logs fast while using little space, and we propose a new token that extends the data structure in existing smart contracts, reducing the number of Ethereum calls. The experimental results show that our scheme achieves 49% improvement on space consumption and 400ms speed-up in time consumption compared with the state-of-art methods.
With the development of Web 3.0 which emphasizes decentralization, blockchain technology ushers in its revolution and also brings numerous challenges, particularly in the field of cryptocurrency. Recently, a large number of criminal behaviors continuously emerge on blockchain, such as Ponzi schemes and phishing scams, which severely endanger decentralized finance. Existing graph-based abnormal behavior detection methods on blockchain usually focus on constructing homogeneous transaction graphs without distinguishing the heterogeneity of nodes and edges, resulting in partial loss of transaction pattern information. Although existing heterogeneous modeling methods can depict richer information through metapaths, the extracted metapaths generally neglect temporal dependencies between entities and do not reflect real behavior. In this paper, we introduce Time-aware Metapath Feature Augmentation (TMFAug) as a plug-and-play module to capture the real metapath-based transaction patterns during Ponzi scheme detection on Ethereum. The proposed module can be adaptively combined with existing graph-based Ponzi detection methods. Extensive experimental results show that our TMFAug can help existing Ponzi detection methods achieve significant performance improvements on the Ethereum dataset, indicating the effectiveness of heterogeneous temporal information for Ponzi scheme detection.
P. R. Agbedanu, Faiza Umar Bawah, V. Akoto-Adjepong, N. S. Awarayi · 8 authors
The global impact of the COVID-19 pandemic has been felt in diverse ways. Although the death rate in Africa has not been as devastating as predicted by the World Health Organization (WHO), its economic and social impact has been fully felt by the African continent. As the world goes through the vaccination process to achieve herd immunity, Africa has not only faced problems like the inability to produce and procure vaccines, but some countries in the west are doubting the authenticity of the vaccination process and even vaccine certificates coming from various countries on the continent. The approach of using centralized systems to validate COVID-19 vaccine certificates makes these systems susceptible to Denial of Service (DoS), modification, and Man-in-the-Middle (MiTM) attacks. To curb this problem, we proposed a blockchain-based digital COVID-19 vaccination certificate verification system called BLOCOVID. The proposed system uses the decentralized approach of distributed ledgers to ensure that vaccine certificates are secured, immutable, and verifiable. Our proposed system stores vaccine serial numbers and their corresponding certificates as hash values. These hash values are stored on the blockchain network as transaction values. The authenticity of a vaccine certificate is determined by the availability of the hash values of the certificate and its corresponding vaccine serial number on the blockchain network. The proposed system was simulated using the BlockSim simulator. To begin with, the simulation results show that the proposed system can ensure system availability, thereby minimizing DoS attacks. Secondly, the proposed system can ensure the integrity of vaccine certificates by allowing third parties to verify the authenticity of these certificates. The simulation results show that even with 10240 nodes, the average transaction time was 137.2ms, with a total transaction rate of 9911.034 transactions per second.