Blockchain, the technology infrastructure behind the famous cryptocurrency bitcoin, can take away the notion of trust from centralized organizations to a decentralized platform that is mathematically verifiable and cryptographically secure. It is gaining more significant momentum exponentially and disrupts the way businesses function beyond the digital currency aspects. This work presents a text mining literature analysis of research articles published in major digital libraries on blockchain technology and cybersecurity. This literature analysis employs automated text mining approaches such as topic modeling and keyphrase extraction for unearthing the themes from a vast body of literature. This analysis highlights the multidisciplinary nature of blockchain technology within the cybersecurity domain. The findings also show the cyber threats and vulnerabilities that evolve with blockchain technology developments. This analysis also showcases the computer security research community’s vulnerabilities and provides future research dimensions that are crucial for designing secure blockchain applications and platforms.
Bu çalışma, algı yönetiminin Bitcoin fiyatlarına etkisini göstermek amacıyla gerçekleştirilmiştir. Algı yönetimi, çeşitli stratejiler uygulanarak hedeflenen düşüncelerin kitlelere kabul ettirilmesi şeklinde ifade edilmektedir. Küreselleşme ve dijitalleşmenin etkisiyle algı yönetiminin siyasetçiler, gazeteciler ve bireyler tarafından sıklıkla kullanıldığı gözlemlenmektedir. Algı yönetiminin günümüzde dijital medya olanaklarıyla gerçekleştirildiği ve düşüncelerin çeşitli platformlar aracılığı ile ifade edildiği görülmektedir. Kimi mecralarda manipülasyona neden olan algı yönetimi, genellikle kitleler tarafından izlenen kişilerce gerçekleştirilmektedir. Çalışmada, Elon Musk tarafından Twitter platformu üzerinden gerçekleştirilen paylaşımların, Bitcoin fiyatlarına etkisi gösterilmiştir. Çalışmada Musk tarafından gerçekleştirilen üç paylaşım ile o tarihlerde Bitcoin fiyat hareketliliği incelenmiştir. Çalışma sonucunda Musk tarafından gerçekleştirilen paylaşımlar ile Bitcoin fiyatları üzerinde gerçekleştirilen olumlu ve olumsuz algı yönetiminin doğrusal olduğu bulgusu elde edilmiştir. Özellikle belirtmek gerekir ki Bitcoin fiyatının düşüş ya da yükseliş hareketinde tek etkili olan faktör Musk’ın paylaşımları olmamakla beraber, bu paylaşımlar fiyatlara büyük oranda etki etmiştir. Daha sonra gerçekleştirilen çalışmalarda farklı kişilerce gerçekleştirilen algı yönetimi örneklerinin analiz edilmesi önerilmektedir.
M.H. Zafar, Iliyas Karim Khan, Anees ur Rehman, Sadia Zafar
In Pakistan, existing blood control systems or blood information management systems are limited in terms of efficient data retrieval of donor to consumer. There is no communication network in place for extra blood in one location to be demanded from a region if blood is limited, resulting in blood wastage. Due to a lack of accessibility and sufficient blood quality testing, blood contaminated with illnesses such as HIV has been used for transfusion in some cases. This study proposes a ledger blood management system to address these challenges. The trail has been represented as a supply-chain management problem following the blood. By trailing the blood stream and donation a single platform for transferring blood and the problem results among blood groups, the proposed system, built on the hyperledger fabric model, adds more traceability toward the blood transfusion process. It also helps to reduce unjustified blood wastage by providing an integrated system for transferring lifeblood and the thing extracts among lifeblood banks. A web app is also designed for accessing the network for simplicity of usage and security is enhanced by implementing block chain hyperfebric ledger system through Key Value System (KVS) system.
Cross-Chain bridges have become the most popular solution to support asset interoperability between heterogeneous blockchains. However, while providing efficient and flexible cross-chain asset transfer, the complex workflow involving both on-chain smart contracts and off-chain programs causes emerging security issues. In the past year, there have been more than ten severe attacks against cross-chain bridges, causing billions of loss. With few studies focusing on the security of cross-chain bridges, the community still lacks the knowledge and tools to mitigate this significant threat. To bridge the gap, we conduct the first study on the security of cross-chain bridges. We document three new classes of security bugs and propose a set of security properties and patterns to characterize them. Based on those patterns, we design Xscope, an automatic tool to find security violations in cross-chain bridges and detect real-world attacks. We evaluate Xscope on four popular cross-chain bridges. It successfully detects all known attacks and finds suspicious attacks unreported before. A video of Xscope is available at https://youtu.be/vMRO_qOqtXY.
Proof-of-Work (PoW) is a Sybil control mechanism adopted in blockchain-based cryptocurrencies. It prevents the attempt of malicious actors to manipulate distributed ledgers. Bitcoin has successfully suppressed double-spending by accepting the longest PoW chain. Nevertheless, PoW encountered several major security issues surrounding mining competition. One of them is a Block WithHolding (BWH) attack that can exploit a widespread and cooperative environment called a mining pool. This attack takes advantage of untrustworthy relationships between mining pools and participating agents. Moreover, detecting or responding to attacks is challenging due to the nature of mining pools. In this paper, however, we suggest that BWH attacks also have a comparable trust problem. Because a BWH attacker cannot have complete control over BWH agents, they can betray the belonging mining pool and seek further benefits by trading with victims. We prove that this betrayal is not only valid in all attack parameters but also provides double benefits; finally, it is the best strategy for BWH agents. Furthermore, our study implies that BWH attacks may encounter self-destruction of their own revenue, contrary to their intention.
Along with the advancements in blockchain technology, many blockchain-based successful projects have been done mainly on the ethereum platform, most of which deal with transactions.Still, it also carries various risks when it comes to security, as evident from past attacks.Most big projects like uniswap, decentraland, and others use smart contracts, deployed on the ethereum platform, leading to similar projects via code reuse.Code reuse practice is quite frequent as a survey suggests 26% of contract code deployed is via code reuse.Smart contract code obfuscation techniques can be used on solidity code that is publicly verified, published (in the case of Ethereum), and on the deployment address.All the above techniques work by replacing characters with their random counterpart, known as statistical substitution.A statistical substitution is a process of transforming an input string into a new string where each character has been replaced by a random character drawn from a stock of all possible 'random' characters.Therefore, we proposed numerous methods in this paper to solve the above problems using various smart contract code obfuscation techniques.These techniques can be really useful in blockchain projects and can save millions of dollars to investors & companies by enhancing code security and preventing code reusability.Techniques mentioned in this paper when compared with other techniques.Our methods are not expensive to implement, very easy to use, and provide a developer-friendly selective increment in code complexity.
Recently, Decentralized Finance (DeFi) platforms on Ethereum are booming, and numerous traders are trying to capitalize on the opportunity for maximizing their benefits by launching front-running attacks and extracting Miner Extractable Values (MEVs) based on information in the public mempool. To protect end users from being harmed and hide transactions from the mempool, private transactions, a special type of transactions that are sent directly to miners, were invented. Private transactions have a high probability of being packed to the front positions of a block and being added to the blockchain by the target miner, without going through the public mempool, thus reducing the risk of being attacked by malicious entities. Despite the good intention of inventing private transactions, due to their stealthy nature, private transactions have also been used by attackers to launch attacks, which has a negative impact on the Ethereum ecosystem. However, existing works only touch upon private transactions as by-products when studying MEV, while a systematic study on private transactions is still missing. To fill this gap and paint a complete picture of private transactions, we take the first step towards investigating the private transactions on Ethereum. In particular, we collect large-scale private transaction datasets and perform analysis on their characteristics, transaction costs and miner profits, as well as security impacts. This work provides deep insights on different aspects of private transactions.
Qihao Zhou, Kan Zheng, Kuan Zhang, Lu Hou · 5 authors
With the emergence of Blockchain-based Internet of Things (BIoT) applications, smart contracts have become one of the most appealing aspects because they reduce the cost and complexity of distributed administration. However, the immaturity of smart contracts may result in significant financial losses or the leakage of sensitive information. This article first investigates the taxonomy of security issues associated with smart contracts considering BIoT scenarios. To address these security concerns and overcome the limitations of existing methods, a tree-based machine learning vulnerability detection (TMLVD) method is proposed to perform the vulnerability analysis of smart contracts. TMLVD feeds the intermediate representations of smart contracts derived from abstract syntax trees (AST) into a tree-based training network for building the prediction model. Multidimensional features are captured by this model to identify smart contracts as vulnerable. The detection phase can be implemented quickly with limited computing resources and the accuracy of the detection results is guaranteed. The experimental evaluation demonstrated the effectiveness and efficiency of TMLVD on a data set comprised of Ethereum smart contracts.
The growing popularity of Ethereum and Solidity smart contracts makes them attractive targets for security threats and attacks. Even though researchers have been dedicating substantial efforts in developing machine learning-based vulnerability detection models for Solidity smart contracts, the models achieved considerably lower accuracy due to shallow coverage of the feature space. In this paper, we introduce SmartMixModel, an improved vulnerability detection model considering an expanded feature space covering both the source- and byte-codes of the Solidity smart contracts. In particular, our contribution in this paper is threefold. First, we collect close to seventy thousand real-world Solidity smart contracts deployed on the Ethereum mainnet and employ the SmartCheck tool to label them considering ten types of vulnerabilities. Next, we generate a mixed-level embedding feature space considering both the high-level syntactic features of the source codes and the low-level features extracted from the compiled byte codes. Finally, we train various Machine Learning and Deep Learning models on our dataset balanced with SMOTETomek. We observe an improved detection performance compared to the state-of-the-art models, achieving the highest Micro-F1 of 98.34%, Macro-F1 of 98.20%, maximum F1-score rate of 99%, and maximum AUROC of 99.60% in the case of XGBoost classifier.
Gopal Gurung, Gueltoum Bendiab, Maria Shiaele, Stavros Shiaeles
Due to the colossal advancement of cyber security threats and attacks, intrusion detection system (IDS) seems to shift their culture toward more collaborative working methods. An aggressor can exploit these vulnerabilities and penetrate the network organisation. There is a tremendous demand for larger networking set-ups to be secured in order to protect from malicious activities. Collaborative Intrusion Detection Networks (CIDN) techniques have been deployed in pragmatic scenarios to maximise the realistic detection performance, allowing a collection of IDS nodes to share and communicate mandatory information, such as signature-based IDS and attack alerts. Due to the distributed system of CIDN, there is an immense likelihood of insider security threats presenting the susceptibility of the system. In this paper, we examine the potential of Blockchain technology to enhance the robustness and efficiency of CIDSs in terms of trust management by proposing a CIDSs architecture based on Hyperledger Fabric and Snort IDS.
Blockchain is making a big impact in various applications, but it is also attracting a variety of cybercrimes. In blockchain, phishing transfers the victim’s virtual currency to make huge profits through fraud, which poses a threat to the blockchain ecosystem. To avoid greater losses, Ethereum, one of the blockchain platforms, can provide information to detect phishing fraud. In this study, to effectively detect phishing nodes, we propose a phishing node detection approach as message passing based graph convolution network. We first form a transaction network through the transaction records of Ethereum and then extract the information of nodes effectively via message passing. Finally, we use a graph convolution network to classify the normal and phishing nodes. Experiments show that our method is effective and superior to other existing methods.
With the increasing popularity of blockchain, automatically detecting vulnerabilities in smart contracts is becoming a significant problem. Prior research mainly identifies smart contract vulnerabilities without considering the interactions between multiple contracts. Due to the lack of analyzing the fine-grained contextual information during cross-contract invocations, existing approaches often produced a large number of false positives and false negatives. This paper proposes SmartDagger, a new framework for detecting cross-contract vulnerability through static analysis at the bytecode level. SmartDagger integrates a set of novel mechanisms to ensure its effectiveness and efficiency for cross-contract vulnerability detection. Particularly, SmartDagger effectively recovers the contract attribute information from the smart contract bytecode, which is critical for accurately identifying cross-contract vulnerabilities. Besides, instead of performing the typical whole-program analysis which is heavy-weight and time-consuming, SmartDagger selectively analyzes a subset of functions and reuses the data-flow results, which helps to improve its efficiency. Our further evaluation over a manually labelled dataset showed that SmartDagger significantly outperforms other state-of-the-art tools (i.e., Oyente, Slither, Osiris, and Mythril) for detecting cross-contract vulnerabilities. In addition, running SmartDagger over a randomly selected dataset of 250 smart contracts in the real-world, SmartDagger detects 11 cross-contract vulnerabilities, all of which are missed by prior tools.
Matheus V. X. Ferreira, Ye Lin Sally Hahn, S. Matthew Weinberg, Catherine Yu
Cryptographic Self-Selection is a subroutine used to select a leader for modern proof-of-stake consensus protocols, such as Algorand. In cryptographic self-selection, each round $r$ has a seed $Q_r$. In round $r$, each account owner is asked to digitally sign $Q_r$, hash their digital signature to produce a credential, and then broadcast this credential to the entire network. A publicly-known function scores each credential in a manner so that the distribution of the lowest scoring credential is identical to the distribution of stake owned by each account. The user who broadcasts the lowest-scoring credential is the leader for round $r$, and their credential becomes the seed $Q_{r+1}$. Such protocols leave open the possibility of a selfish-mining style attack: a user who owns multiple accounts that each produce low-scoring credentials in round $r$ can selectively choose which ones to broadcast in order to influence the seed for round $r+1$. Indeed, the user can pre-compute their credentials for round $r+1$ for each potential seed, and broadcast only the credential (among those with a low enough score to be the leader) that produces the most favorable seed. We consider an adversary who wishes to maximize the expected fraction of rounds in which an account they own is the leader. We show such an adversary always benefits from deviating from the intended protocol, regardless of the fraction of the stake controlled. We characterize the optimal strategy; first by proving the existence of optimal positive recurrent strategies whenever the adversary owns last than $38\%$ of the stake. Then, we provide a Markov Decision Process formulation to compute the optimal strategy.
Traceability and trustiness are two critical issues in the logistics sector. Blockchain provides a potential way for logistics tracking systems due to its traits of tamper resistance. However, it is non-trivial to apply blockchain on logistics because of firstly, the binding relationship between virtue data and physical location cannot be guaranteed so that frauds may exist. Secondly, it is neither practical to upload complete data on the blockchain due to the limited storage resources nor convincing to trust the digest of the data. This paper proposes a traceable and trustable consortium blockchain for logistics T2L to provide an efficient solution to the mentioned problems. Specifically, the authenticated geocoding data from telecom operators’ base stations are adopted to ensure the location credibility of the data before being uploaded to the blockchain for the purpose of reliable traceability of the logistics. Moreover, we propose a scheme based on Zero Knowledge Proof of Retrievability (ZK BLS-PoR) to ensure the trustiness of the data digest and the proofs to the blockchain. Any user in the system can check the data completeness by verifying the proofs instead of downloading and examining the whole data based on the proposed ZK BLS- PoR scheme, which can provide solid theoretical verification. In all, the proposed T2L framework is a traceable and trustable logistics system with a high level of security.
It has long been difficult to create a safe electronic voting system that provides the transparency and flexibility provided by electronic systems, while maintaining the fairness and privacy of present voting methods. Voting, especially during elections, is a technique where participants do not trust one another since the system might be attacked not just by an outsider but also by participants themselves (voters and organizers). The traditional methods of voting systems find it challenging to maintain the characteristics of an ideal voting system since there is a chance of tampering with results and disturbing the process itself. As a result, the effectiveness of the voting system is increased by translating the characteristics of an ideal voting system into digital space. It greatly lowers the expense of the elections and the work of the inspectors. In this essay, we'll use the open-source Blockchain technology to suggest a new electronic voting system's architecture. New chances to create new kinds of digital services are being provided by Blockchain. Numerous elements of our life have been altered by Blockchain technology, including the ability to save digital transactions via the Internet, confirm their legitimacy, license them, and provide the greatest level of security and encryption. This system offers a distributed architecture for storing the data, which distributes the data among many servers. In addition to maintaining voter identity outside of the vote count, this technology makes the voting process transparent.
Blockchain has become one of the key techniques for the security of the industrial internet. However, the blockchain is vulnerable to FAW (Fork after Withholding) attacks. To protect the industrial internet from FAW attacks, this paper proposes a novel FAW attack protection algorithm (FAWPA) based on the behavior of blockchain miners. Firstly, FAWPA performs miner data preprocessing based on the behavior of the miners. Then, FAWPA proposes a behavioral reward and punishment mechanism and a credit scoring model to obtain cumulative credit value with the processed data. Moreover, we propose a miner's credit classification mechanism based on fuzzy C-means (FCM), which combines the improved Aquila optimizer (AO) with strong solving ability. That is, FAWPA combines the miner's accumulated credit value and multiple attack features as the basis for classification, and optimizes cluster center selection by simulating Aquila's predation behavior. It can improve the solution update mechanism in different optimization stages. FAWPA can realize the rapid classification of miners' credit levels by improving the speed of identifying malicious miners. To evaluate the protective effect of the target mining pool, FAWPA finally establishes a mining pool and miner revenue model under FAW attack. The simulation results show that FAWPA can thoroughly and efficiently detect malicious miners in the target mining pool. FAWPA also improves the recall rate and precision rate of malicious miner detection, and it improves the cumulative revenue of the target mining pool. The proposed algorithm performs better than ND, RSCM, AWRS, and ICRDS.
Anamika Singh, Md. Akkas Ali, B. Balamurugan, Vandana Sharma
Ransomware is a malware practice which cyber criminals usually inject through phishing practices to make money as their priority. With the high rise in the use of the internet amid the COVID phase, the cyber world is also reaching its peak as well. The attacker is also getting smarter with technology. We in this paper are taking blockchain technology as a weapon to fight against the terror of ransomware attacks, as this is the most notorious and devastating attack of all, and there is no doubt that it is going to be with us in the future too. Detection of ransomware attacks before they infect and decode the data is a complex thing. Several algorithms exist to detect attacks at their early stages, but the lack of information about the pre and post behavior similarities is proving to be an obstacle to accurately observing and detecting ransomware at its very first stage rather than making sense of paying the ransom and even not being sure of getting back the confidentialities. With the use of blockchain technology, we focus on making a record of the pre-encryption and post-encryption behaviour of ransomware attacks so that it is not going to be complex to track the nature, similarities, and behaviour of ransomware attacks. With inaccurate availability of data about pre and post behaviour of attacks and also weak design of detection models, both have a negative impact on selecting the features and similarities of the attack and thus developing a design model for the same. The paper is focusing on one of the most challenging variations of ransomware attacks, i.e., the crypto ransomware. Many researches before proposed solutions as performing regular backup of files but this measure has a significant overhead too as key backup schemes results in high computational cost as well. Thus, with the use of blockchain for gathering and maintaining records, we expect to be prepared for every unexpected attack.
The flourishing development of blockchain and cryptocurrency has made it a hotbed for cyber-criminals to implement virtually untraceable scams. Consequently, the blockchain ecosystem urgently needs an effective method to help users stay away from scams in order to create an enticing investment environment. Despite the massive deployment of blocklist query APIs for malicious and scam domains/URLs in the industry, we identify two core reasons why existing blocklist services find it difficult to thrive in the cryptocurrency paradigm: 1) the compelling need to protect a user query due to sensitivity and high value of query content, i.e., payment addresses; 2) the thorny issue of evaluating the quality of blocklists effectively, in the face of common practices of incompetent providers.To this end, we first provide a private and highly efficient blocklist query scheme as a basic design, which conveniently achieves backward compatibility with current blockchain payment systems at a considerably low cost. Based on this design, we propose a new framework for shareholders to evaluate the quality of blocklists. Our framework provides stronger security guarantees than other similar works, as it is capable of suppressing both individual biasing and coercive manipulation at the same time. We provide a complete game-theoretic analysis and demonstrate comprehensive evaluation results to confirm the effectiveness and efficiency of our solutions, under the settings of a practical number of shareholders.
Amer A. Sallam, Taha H. Rassem, Hanadi Abdu, Haneen Abdulkareem · 6 authors
On the Ethereum network, users communicate with one another through a variety of different accounts. Pseudo-anonymity was enforced over the network to provide the highest level of privacy. By using accounts that engage in fraudulent activity across the network, such privacy may be exploited. Like other cryptocurrencies, Ethereum blockchain may exploited with several fraudulent activities such as Ponzi schemes, phishing, or Initial Coin Offering (ICO) exits, etc. However, the identification of parameters with abnormal account characteristics is not an easy task and requires an intelligent approach to distinguish between normal and fraudulent activities. Therefore, this paper has attempted to solve this a problem by using machine learning techniques to introduce a robust approach that can detect fraudulent accounts on Ethereum. We have used a K-Nearest Neighbor, Random Forest and XGBoost over a collected dataset of 4,681 instances along with 2,179 fraudulent accounts associated and 2,502 regular accounts. The XGBoost, RF, and KNN techniques achieved average accuracies of 96.80 %, 94.8 8%, and 87.85% and an average AUC of 0.995, 0.99 and 0.93, respectively.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques