<p>Cybersecurity is an inherent characteristic that should be addressed before the large deployment of smart city applications. Recently, Blockchain appears as a promising technology to provide several cybersecurity aspects of smart city applications. This paper provides a comprehensive review of the existing blockchain-based solutions for the cybersecurity of the main smart city applications, namely smart healthcare, smart transportation, smart agriculture, supply chain management, smart grid, and smart homes. We describe the existing solutions and we discuss their merits and limits. Moreover, we define the security requirements of each smart city application and we give a mapping of the studied solutions to these defined requirements. Additionally, future directions are given. We believe that the present survey is a good starting point for every researcher in the fields of cybersecurity, blockchain, and smart cities.</p>
The goal of the thesis is to study and perform an analysis of the possible attack vectors on the Iota network 2.0 version of the protocol. In this work, existing attack vectors on Distributed Ledger Technologies are studied and their applicability to the Iota 2.0 protocol is discussed. A specific attack that targets the capability of honest participants to write to the ledger is presented and analyzed in a network of nodes that run a full node software version.
With the rising popularity of Ethereum, there is also an uptick in the number of smart contract based decentralized applications (DApps). Consequently, Ethereum transaction volume is growing steadily over the last few years, but so are the various types of attacks on it. In Ethereum vulnerable smart contracts are always taken advantage of by adversaries. One of the primary ways of exploiting Ethereum with malicious intent is through frontrunning attacks that take advantage of the waiting time of transactions in the pending pool by adjusting the gas price. Attackers willing to execute such attacks constantly monitor the pending transaction pool and try to frontrun transactions. Mitigating such attacks is a critical step for ensuring secure DApp operations in Ethereum. In this paper, we propose a model-based attack detection and prevention scheme. We extract specific features for each transaction and transform each transaction into a feature vector which is then analyzed by a machine learning model to detect if it is a frontrunning attack transaction or not in real time. Extensive experiments on a large dataset of transactions establish the effectiveness of our approach.
Randhir Kumar, Prabhat Kumar, Abhinav Kumar, A. Antony Franklin · 5 authors
The softwarized infrastructure of Software-Defined Industrial Internet of Things (SDIIoT) offers a cost-effective solution to improve flexibility and reliability in network management but faces several critical challenges. First, th Majority of SDIIoT entities operate over wireless channel, which expose them to a variety of attacks (e.g., man-in-the-middle, replay, and impersonation attacks) and also the centralized nature of SDN controller is prone to single point attacks. Second, network traffic in the SDIIoT is associated with large scale, high dimension and redundant data, all of which present significant hurdles in the development of efficient flow analyzer. In this regard, we present a novel blockchain and Deep Learning (DL) integrated framework for protecting confidential information and hunting cyber threats against SDIIoT and their network traffic. First the blockchain module is proposed to securely transmit industrial data from IIoT sensors to controllers of SDN via forwarding nodes (i.e., OpenFLow switches) using Clique Proof-of-Authority (C-PoA) consensus mechanism. A novel flow analyzer based on DL architecture named LSTMSCAE-AGRU is designed by combining Long Short-Term Memory Stacked Contractive AutoEncoder (LSTMSCAE) with Attention-based Gated Recurrent Unit (AGRU) at the control plane. The latter first extracts low-dimensional features in an unsupervised manner, which is then fed to AGRU for hunting anomalous switch requests. The proposed framework can withstand a variety of well-known cyber threats and mitigate the single point of controller failure problem in SDIIoT.
Yasheng Zhang, Chengcheng Li, Ning Chen, Peiying Zhang
Through the programmable control of the network, the distributed and discrete service equipment is managed uniformly, and the software-defined network (SDN) effectively improves the overall management and control capabilities of the centralized management model. Each service node in SDN is connected by the service function chain (SFC) and completes network services in a specified order. However, there are still the following challenges in service request orchestration of SDN: (1) The tightly coupled characteristic of SFC bring management problems, e.g., deployment difficulties, service collisions, and poor scalability, etc., to frequent user service requests. (2) The complicated technologies in SDN, e.g., interference of wireless communication, cause potential safety hazards between service nodes, which may cause devastating effects on the controller. Correspondingly, we propose the following solutions: (1) Meaningfully transform the service request orchestration in SDN into the Microservice Management problem, and further combine Artificial Intelligence (AI) technology to provide a flexible, autonomous, and scalable intelligent service orchestration model. (2) Combine the Diffie-Hellman algorithm to establish a shared key for the communication node, and combine the characteristics of the distributed ledger in the consortium blockchain, e.g., immutable, privacy, credibility, and high security, etc., for identity authentication to further improve the security of the shared key. Eventually, we have proved through theory and practice that the proposed algorithm can provide efficient intelligent request orchestration extremely safely in SDN.
Rana Faisal Hayat, Sana Aurangzeb, Muhammad Aleem, Gautam Srivastava · 5 authors
Distributed denial of service (DDoS) attacks as well as botnet-based attacks are among the most important security vulnerabilities in Internet of Things (IoT) environments. Most of the existing research approaches use centralized defense mechanisms to prevent DDoS attacks in IoT environments. However, it is important to provide a reliable and scalable solution to prevent DDoS attacks. Combining technologies such as distributed blockchain-based mechanisms and smart contracts facilitates the construction of a trusted distributed framework that can defend against DDoS attacks in IoT. In this article, we have proposed a multilevel DDoS mitigation approach (ML-DDoS) to protect IoT devices and other computing resources or machines using the blockchain-based framework. The core concept of the proposed system is to use a device-based verification mechanism using blockchain and exclude malicious devices from IoT environments. The proposed framework was developed using Hyperledger Caliper (a blockchain benchmark tool) and its performance was evaluated using three benchmark applications. Compared to the state of the art, the results show that the proposed framework achieves up to 35% improvement in throughput, up to 40% improvement in latency, and up to 25% better utilization of CPU.
Victor Chang, Karl Hall, Qianwen Xu, Le Minh Thao Doan · 5 authors
This paper applies social network analysis in two experiments. In the first experiment, social network analysis is conducted on student friendship networks to find relational patterns. Then, three community detection methods are used to divide the student network. The RSiena package is used to illustrate the coevolution of friendship networks with smoking and drinking behavior. In this experiment, it was determined that in the closed network, same-sex reciprocated relationships are preferred. The second experiment analyzes a weighted trust network that involves users trading with Bitcoin on the BTC-Alpha platform. Since the dealers of Bitcoin are anonymous, there is an urgent need to record every dealer’s credit history to prevent fraud and other security problems. The second experiment aims to improve security problems within the Bitcoin trust network by applying social network analysis.
While blockchain technology provides strong cryptographic protection on the ledger and the system operations, the underlying blockchain networking remains vulnerable due to potential threats such as denial of service (DoS), Eclipse, spoofing, and Sybil attacks. Effectively detecting such malicious events should thus be an essential task for securing blockchain networks and services. Due to its importance, several studies investigated anomaly detection in Bitcoin and blockchain networks, but their analyses mainly focused on the blockchain ledger in the application context (e.g., transactions) and targets specific types of attacks (e.g., double-spending, deanonymization, etc). In this study, we present a security mechanism based on the analysis of blockchain network traffic statistics (rather than ledger data) to detect malicious events, through the functions of data collection and anomaly detection. The data collection engine senses the underlying blockchain traffic and generates multi-dimensional data streams in a periodic, real-time manner. The anomaly detection engine then detects anomalies from the created data instances based on semi-supervised learning, which is capable of detecting previously unseen patterns, and we introduce our profiling-based detection engine implemented on top of AutoEncoder (AE). Our experimental results evaluated with real and simulated traffic data support the effectiveness of our security mechanism and design choices based on the AE structure, with the approximate detection performance to the supervised learning methods only through the profiling of normal instances. The measured time complexity is sufficiently cheap to perform real-time analysis, with less than 1.4 msec for per-instance testing on a single core setting.
Elections are an integral part of democracy. With democracy being the most popular government type in today’s world, the need for the use of free and fair elections to elect a presidential candidate or a party has increased. Elections allow everyone in the country above a certain age group (Age limit as per a country or state’s norms) irrespective of their gender, caste, color, religion, etc., to take part in election and vote for the candidate or party of their choice. The most popular methods of conducting elections are using ballot paper and electronic voting machines (EVM’s). These methods come with their own set of challenges such as lack of security, inefficiency, bogus voting, increased expenditure and ease of manipulation of the props used for voting. In order to tackle these challenges, we are proposing an implementation of elections by making use of permissioned blockchain technology. We aim to make a decentralized voting system using Hyperledger Fabric framework to establish a permissioned blockchain network which would negate the disadvantages of previously used voting mechanisms out there and restrengthen the true meaning of free, fair and sovereign election. In this paper we have described several use cases explaining the various security measures that could be added in order to improve security of the voting systems. Also, we have made use of Hyperledger Caliper to benchmark our blockchain based voting system and test out the system performance with respect to different chaincodes.
By nature, a traditional attack method, denial-of-service (DDoS) attack poses a considerable threat to the security of the blockchain network layer. This paper proposes a distributed DDoS-attack traffic detection method based on a cross multilayer convolutional neural network model in the blockchain network layer. The method resolves the low generalisation, high misreporting rate, and low detection efficiency problems of the existing detection methods, which are caused by nondistinctive core features and the high complexity of robust features when detecting DDoS attacks transmitted by mixed protocols on a blockchain network layer. First, the model performs a convolution operation on preprocessed traffic on the blockchain network layer using a cross-layer method based on L2 regularisation. After this operation, the model can perceive the detailed features of attack traffic from multiple levels while enhancing the representational performance of key features; specifically, the parameters with high-variance terms are penalised to limit changes in the model’s weight parameters. The highly robust abstract features of attack traffic are extracted, thereby increasing the generalisation ability and reducing the misreporting rate of the model. Second, parametric encoding of the abstract features is performed by a stacked sparse autoencoder based on Kullback–Leibler divergence, and the sparsity of the model is adjusted to reduce the redundant data and the coupling between abstract features. The outputs of the encoded features are then effectively categorised. Finally, the global optimisation of parameters is performed by an improved random gradient-descent algorithm, which prevents oscillation of the training parameters and accelerates the model convergence. In an experimental evaluation, the proposed method achieved satisfactory binary- and multiclass detection of DDoS-attack traffic on both CSE-CIC-IDS 2018 on the AWS dataset and on the real mixed data of a blockchain network layer.
D. Jonathan Sebastian-Cardenas, Sri Nikhil Gupta Gourisetti, Annabelle Lee, Michael Mylrea · 5 authors
Transactive Energy Systems (TES) are expected to improve upon existing grid operations and capabilities by enabling the integration of traditional grid resources with distributed energy resources (DER). Distributed Ledger Technology or DLT (e.g., blockchain) presents itself as a viable instrument to support decentralized, autonomous, and tamper-evident applications, which can be leveraged within TES’s ecosystem. DLTs can provide pertinent security controls including access controls, data immutability, and traceability in addition to other well-known advantages such as decentralization and scalability. This work demonstrates the DLT cybersecurity stack and its applicability to TES-based use-cases/applications. The seven-layer DLT cybersecurity stack is a DLT-agnostic framework that can quickly be used to classify and group the individual needs of an application into the different processing and cybersecurity layers offered by a DLT using a common taxonomy and an architectural mapping framework. This enables application engineers to demystify and strengthen the overall security aspects of their systems while maintaining an open perspective towards features and drawbacks that may hinder their performance in real-world scenarios. The paper leverages the work performed by the IEEE P2418.5 Blockchain for Energy Standards working group.
The Internet has become one of the most important technologies in the world, and hackers use various methods to launch cyber attacks to profit from it. Phishing is one of famous social engineering attacks, it is often used to steal user data, including login credentials and credit card numbers. Although the Transport Layer Security certificate is used to verify the trust of websites, there are still a series of vulnerabilities. The demand for trusted IP addresses has led a lot of research, including IP whitelisting, DNS filtering and so on. However, these technologies still have many shortcomings. In view of this, we proposed a novel mechanism for verifying websites using blockchain technology. The URL and IP address of a permissioned website are recorded in blockchain through a specific smart contract. A DNS query is executed through a smart contract designed to avoid URL redirection attacks. With the help of immutable nature of blockchian, phishing websites can be detected. The mechanism will not add any load to users and provides tamper-proof functions based on the characteristics of blockchain. The comparison of related works shows that the proposed mechanism is more secure. We also provided a reference implementation of the proposed mechanism on Ethereum Quorum simulation platform, which proves the effectiveness and practicability of the mechanism.
In today's era, internet-connected things provide immense opportunities to the world for enhancing the quality of lives through better data processing and intelligent decision making. Since the last decade, IoT brought numerous changes in people's personal as well as professional lives. With the enhancement in quality of lives, IoT also comes up with challenges such as security and privacy of data and devices. Every day, the attacker generates new zero-day attacks for IoT devices and data, and it's important to detect and protect the IoT eco-system from this type of attacks. Numerous researchers have proposed security schemes and methods to protect the IoT eco-system through either cryptography way or learning technique based way. AI and ML learning techniques have got immense popularity in handling the IoT security challenges as they are automatic in nature and can outperform provided the sufficient quality and quantity of data. Moreover, the AI techniques, including ML, DL and FL helps in intelligent decision-making and can also generate knowledge through its learning techniques. AI needs data to process, and IoT supplies the necessary data to process. In this paper, we provide a state-of-the-art survey for IoT security solutions proposed based on learning techniques. We provide an in-depth review of available learning techniques to solve critical security challenges such as IoT authentication, access control, anomaly detection and malware analysis. At the end, we also highlighted various futuristic technologies that can invigorate IoT research and help in the design of full proof IoT eco-system.
Internet technologies, new era of advancements, have changed inter-connectivity among people at an incredible scale over the last decade. The next revolution is projected towards creation of connectivity among diverse things, resulting in a smart environment. The need for data-on- demand continues to rise as we advance from World Wide Web to web2 i.e. social networking web. The world has now advanced to web3 i.e. ubiquitous computing or web of things. There is no doubt that IoT is progressing more and more, while offering a wide range of smart solutions and innovative applications. However, with such advancements in IoT, some vulnerabilities are also there. The expanding trend of cyber assaults such as DoS, sniffing attack, port scanning etc., on systems core, along with system underlying flaws, is a subject of worry for both the companies as well as customers. The goal of this research is to quantify the category of various system related flaws that compromise IoT infrastructure and leads to cybercrime, as well as to create a justification for more research into this developing technology. This paper also presents a detailed overview of attacks in IoT along with security requirements that will be helpful for securing IoT from threats and attacks.
Abbas Yazdinejad, Ali Dehghantanha, Reza M. Parizi, Mohammad Hammoudeh · 6 authors
Nowadays, blockchain-based technologies are being developed in various industries to improve data security. In the context of the Industrial Internet of Things (IIoT), a chain-based network is one of the most notable applications of blockchain technology. IIoT devices have become increasingly prevalent in our digital world, especially in support of developing smart factories. Although blockchain is a powerful tool, it is vulnerable to cyber attacks. Detecting anomalies in blockchain-based IIoT networks in smart factories is crucial in protecting networks and systems from unexpected attacks. In this paper, we use Federated Learning (FL) to build a threat hunting framework called Block Hunter to automatically hunt for attacks in blockchain-based IIoT networks. Block Hunter utilizes a cluster-based architecture for anomaly detection combined with several machine learning models in a federated environment. To the best of our knowledge, Block Hunter is the first federated threat hunting model in IIoT networks that identifies anomalous behavior while preserving privacy. Our results prove the efficiency of the Block Hunter in detecting anomalous activities with high accuracy and minimum required bandwidth.
Software-Defined Networking (SDN) enhances the flexibility and programmability of networks by separating control plane and data plane. The logically centralized control mechanism makes the control plane vulnerable in both single and multiple controller scenarios. Malicious third parties can exploit vulnerabilities of reactive forwarding mode to launch distributed denial-of-service (DDoS) attacks against SDN controllers. Unfortunately, existing DoS/DDoS solutions under single controller can not afford effective performance under multiple controllers due to the absence of cooperative detection and mitigation. To solve the above problem, we propose a blockchain-based SDN-targeted DDoS defense framework (BSD-Guard) that can provide cooperative detection and mitigation mechanism to protect SDN controllers. BSD-Guard introduces a blockchain-based secure middle plane between control plane and data plane. The secure middle plane calculates the suspect rate of new flows based on the collected packets’ information and reports suspect lists to blockchain for immutably storing and sharing. Besides, the smart contract deployed on blockchain in advance constitutes collaborative defense strategies based on the suspect lists reported from multiple SDN domains. When receiving defense strategies, the secure middle plane converts them to specific flow table actions and installs actions into relevant switches. The experimental results indicate that BSD-Guard can efficiently detect DoS/DDoS attacks in multiple controllers scenario and issue precise defensive strategies near the source of attack by identifying the attack path.
Yeison Isaac LLanten Lucio, Katerine Márceles Villalba, Siler Amador Donado
This article presents the problem regarding the assurance of the information that circulates in the devices that are connected to the internet, due to the multiple threats to which they are exposed, running the risk of losing or leaking information; However, with the passage of time, new technologies are emerging that encourage organizations to maintain continuous improvement of their applications and tools, but at the same time the emergence of new technologies brings with it cybersecurity risks that organizations must face when carrying out an integration with them. Therefore, through the action research methodology, two phases were defined, one of them reviewing Blockchain technologies and the second comparing Blockchain technologies to finally determine the most adaptable technology to a cybersecurity Framework focused on IIoT, capable of managing the integrity of the information and achieving a consensus among all the nodes belonging to a certain network.
Path validation assures operational integrity in 5G networks with various network infrastructures where nodes en route are operated by multiple untrusted network slicing authorities. However, in order to correctly validate a path, traditional solutions require the entire path to be revealed to all parties involved, which may potentially expose the network structure to malicious attackers. In this work, we propose a decentralized privacy-preserving path validation protocol utilizing XOR, hashing and Non-interactive zero-knowledge proof (NIZK) that guarantees security and privacy but circumvents performance compromise. We tested our protocols in a simulated multi-authority network to show how the privacy-preserving path validation can protect node privacy without significantly degrading performance.
Although the traditional P2P botnet has significant resilience against termination, its dependence on neighbor lists (NL) has left it vulnerable to infiltration and destruction. In addition, it is not sufficient in protecting the botmaster’s identity. To overcome these weaknesses, we proposed BlockchainBot, a botnet model that leveraged IoT devices as maintainers, and integrated blockchain, also known as distributed ledger technology (DLT). The BlockchainBot was able to fully deploy bots on public blockchains. It was versatile for multiple botnet applications and eliminated the dependence on NL. In addition, we further introduced a novel method, the forking of a channel, to kick out spy nodes that infiltrate a botnet. To further enforce the resistance against a single point of failure (SPoF), we introduced bot-cluster dispersing to prevent clustering around full nodes and more evenly scatter bots to prevent hostile takeovers. The analysis of the security of BlockchainBot indicated that it had strong resilience against DDoS attacks, Sybil attacks, and forensic investigations. Furthermore, the security of the forking of the channel and bot-cluster dispersing were also shown to be effective. The robustness of the BlockchainBot against the Sybil attack was also briefly discussed. Experimental results authenticated the effectiveness and performance of the BlockchainBot, as compared to previous models.
Miner malware has been steadily increasing in recent years as the value of cryptocurrency rises, which poses a considerable threat to users’ device security. Miner malware has obvious behavior patterns in order to participate in blockchain computing. However, most miner malware detection methods use raw bytes feature and sequential opcode as detection features. It is difficult for these methods to obtain better detection results due to not modeling robust features. In this paper, a miner malware identification method based on graph classification network is designed by analyzing the features of function call graph and control flow graph of miner malware, called MBGINet. MBGINet can model the behavior graph relationship of miner malware by extracting the connection features of critical nodes in the behavior graph. Finally, MBGINet transforms these node features into the feature vectors of the graph for miner malware identification. In the test experiments, datasets with different volumes are used for simulating real-world scenarios. The experimental results show that the MBGINet method achieves a leading and stable performance compared to the dedicated opcode detection method and obtains an accuracy improvement of 3.08% on the simulated in-the-wild dataset. Meanwhile, MBGINet gains an advantage over the general malware detection method Malconv. These experimental results demonstrate the superiority of the MBGINet method, which has excellent characteristics in adapting to realistic scenarios.
Network slicing in a 6G environment is an important research area in the current years. However, satisfying the demands of network slice requests is a challenging task. Energy-efficient, secure, and Quality of Service (QoS) aware network slicing is important since network slices must share fewer amounts of resources. Further, implementing secure network slicing for software-defined networks (SDNs)/network function virtualization (NFV) is crucial. In this article, we tackle the issues, such as security, QoS, and resource consumption issues through network slicing and load balancing mechanisms in SDN/NFV assisted 6G environments. First, deep network slicing is implemented using generative adversarial network (GAN) for network slicing and management. Based on the slice capacity, slice priority, and QoS demands of network slices, GAN predicts the appropriate slice and links for data transmission. For each slice, the directed acyclic graph (DAG)-based blockchain technology is used in which traditional consensus is replaced by the Proof of Space (PoS) algorithm. A limitation of scalability and high resource consumption in the traditional blockchain is addressed in DAG-blockchain. To improve security, context-based authentication, and secure handover schemes are presented using the Markov decision making (MDM) and weighted product model, respectively. Then, higher load faced at the SDN controllers and switches are addressed by intruder packets classification and packets migration through hybrid neural decision tree (HyDNT) and Hybrid Political optimizer with a Heap-based Optimizer (HPoHO), respectively. To predict the load accurately, environment learning is implemented using the soft actor-critic (SAC) algorithm. Finally, the performance of the proposed SliceBlock model is evaluated.
Tran Viet Khoa, Do Hai Son, Dinh Thai Hoang, Nguyen Linh Trung · 8 authors
This article aims to study intrusion attacks and then develop a novel cyberattack detection framework to detect cyberattacks at the network layer (e.g., Brute Password and Flooding of Transactions) of blockchain networks. Specifically, we first design and implement a blockchain network in our laboratory. This blockchain network will serve two purposes, i.e., to generate the real traffic data (including both normal data and attack data) for our learning models and to implement real-time experiments to evaluate the performance of our proposed intrusion detection framework. To the best of our knowledge, this is the first dataset that is synthesized in a laboratory for cyberattacks in a blockchain network. We then propose a novel collaborative learning model that allows efficient deployment in the blockchain network to detect attacks. The main idea of the proposed learning model is to enable blockchain nodes to actively collect data, learn the knowledge from data using the Deep Belief Network, and then share the knowledge learned from its data with other blockchain nodes in the network. In this way, we can not only leverage the knowledge from all the nodes in the network but also do not need to gather all raw data for training at a centralized node like conventional centralized learning solutions. Such a framework can also avoid the risk of exposing local data's privacy as well as excessive network overhead/congestion. Both intensive simulations and real-time experiments clearly show that our proposed intrusion detection framework can achieve an accuracy of up to 98.6% in detecting attacks.