Bitcoin P2P networking is especially vulnerable to networking threats because it is permissionless and does not have the security protections based on the trust in identities, which enables the attackers to manipulate the identities for Sybil and spoofing attacks. The Bitcoin node keeps track of its peer’s networking misbehaviors through ban scores. In this paper, we investigate the security problems of the ban-score mechanism and discover that the ban score is not only ineffective against the Bitcoin Message-based DoS (BM-DoS) attacks but also vulnerable to the Defamation attack as the network adversary can exploit the ban score to defame innocent peers. To defend against these threats, we design an anomaly detection approach that is effective, lightweight, and tailored to the networking threats exploiting Bitcoin’s ban-score mechanism. We prototype our threat discoveries against a real-world Bitcoin node connected to the Bitcoin Mainnet and conduct experiments based on the prototype implementation. The experimental results show that the attacks have devastating impacts on the targeted victim while being cost-effective on the attacker side. For example, an attacker can ban a peer in two milliseconds and reduce the victim’s mining rate by hundreds of thousands of hash computations per second. Furthermore, to counter the threats, we empirically validate our detection countermeasure’s effectiveness and performances against the BM-DoS and Defamation attacks.
Jinho Choi, Jaehan KIM, Minkyoo Song, Hanna KIM · 8 authors
Cryptocurrency abuse has become a critical problem. Due to the anonymous nature of cryptocurrency, criminals commonly adopt cryptocurrency for trading drugs and deceiving people without revealing their identities. Despite its significance and severity, only few works have studied how cryptocurrency has been abused in the real world, and they only provide some limited measurement results. Thus, to provide a more in-depth understanding on the cryptocurrency abuse cases, we present a large-scale analysis on various Bitcoin abuse types using 200,507 real-world reports collected by victims from 214 countries. We scrutinize observable abuse trends, which are closely related to real-world incidents, to understand the causality of the abuses. Furthermore, we investigate the semantics of various cryptocurrency abuse types to show that several abuse types overlap in meaning and to provide valuable insight into the public dataset. In addition, we delve into abuse channels to identify which widely-known platforms can be maliciously deployed by abusers following the COVID-19 pandemic outbreak. Consequently, we demonstrate the polarization property of Bitcoin addresses practically utilized on transactions, and confirm the possible usage of public report data for providing clues to track cyber threats. We expect that this research on Bitcoin abuse can empirically reach victims more effectively than cybercrime, which is subject to professional investigation.
With the evolution of technology, blockchain a swiftly impending phenomenon i.e., "decentralized computing” is observed. The emergence of Smart Contracts (SC) has resulted in advancements in the application of blockchain technology. The Ethereum network’s computing capabilities and functionalities are founded on the basis of SC. A smart contract is a self-executing agreement between buyer and seller with the terms of the settlement between them, written directly as lines of code, existing across a distributed decentralized blockchain network. It is a decentralized software that runs on a blockchain autonomously, consistently, and publicly. Conversely, due to the complex semantics of fundamental domain-specific languages and their testability, constructing reliable and secure SC can be extremely difficult. SC might contain some vulnerabilities. Security vulnerabilities can originate from financial tribulations; there are a number of notorious events that specify blockchain SC could comprise numerous code-security vulnerabilities. Security and privacy of blockchain-based SC are very important, we must first identify their vulnerabilities before implementing them widely. Therefore, the purpose of this paper is to conduct a comprehensive experimental evaluation of two current security testing tools: Remix solidity static analysis plugin and Solium which are used for static analysis of SC. We have conducted an empirical analysis of SC for finding tangible and factual evidence, controlled by the scientific approach. The methodology’s first step is to gather all of the Ethereum SC and store them in a repository. The next step is to use the Remix solidity static analysis plugin and Solium to perform vulnerability assessments. The last step is to analyze the result of both tools and evaluate them on the basis of accuracy and effectiveness. The goal of this empirical analysis is to evaluate the two FOSS tools: Remix solidity static analysis plugin and Solium on the basis of accuracy and effectiveness. Some research questions were considered to reach the stated goal: What automated tools and frameworks are proposed in supporting the state-of-the-art empirical approach to SC vulnerability detection? How accurate are security analysis tools? And which tool has more accuracy rate? How effectively security analysis tools are detecting vulnerabilities in SC? And which is the most effective security analysis tool? We investigated the effectiveness and accuracy of security code analysis tools on Ethereum by testing them on a random sample of vulnerable contracts. The results indicate that the tools have significant discrepancies when it comes to certain security characteristics. In terms of effectiveness and accuracy, the Remix plugin outperformed and beat the other tool.
Social media has transformed the mode of communication globally by providing an extensive system for exchanging ideas, initiating business contracts, and proposing new professional ideas. However, there are many limitations to the use of social media, such as misinformation, lack of effective content moderation, digital piracy, data breaches, identity fraud, and fake news. In order to address these limitations, several studies have introduced the application of Blockchain technology in social media. Blockchains can provides transparency, traceability, tamper-proofing, confidentiality, security, information control, and supervision. This paper is a systematic literature review of papers covering the application of Blockchain technology in social media. To the best of our knowledge, this is the first systematic literature review that elucidates the combination of Blockchain and social media. Using several electronic databases, 42 related papers were reviewed. Our findings show that previous studies on the applications of Blockchain in social media are focused mainly on blocking fake news and enhancing data privacy. Research in this domain began in 2017. This review additionally discusses several challenges in applying Blockchain technologies in social media contexts, and proposes alternative ideas for future implementation and research.
The spread of deceptive or misleading information, commonly referred to as misinformation, poses a social, economic, and political threat. Such deceptive information spreads quickly and inexpensively. For example, with the hype around blockchain technologies, misinformation on “get rich quick” scams on the Web is rampant, as evidenced by sophisticated Twitter hacks of celebrities and many social media posts that bait unsuspecting users to visit phishing websites. Unfortunately, AI technologies have contributed to the growing pains of misinformation on the Web, with the advances in technologies such as generative adversarial deep learning techniques that can generate “deep fakes” for nefarious purposes. At the same time, researchers are working on a different set of AI technologies to combat misinformation, akin to “fighting fire with fire.” As there is no clear way to win the online “cat-and-mouse” game against fake news generators and spreaders of misinformation, we believe social media platforms could be fortified with blockchain and AI technologies to mitigate the extent of misinformation propagation in various communities worldwide. Tamper-proof blockchain techniques can provide irrefutable evidence of what content is authentic, guaranteeing how the information has evolved with provenance trails. Various AI models that could be used for detecting fake news can be served on a blockchain for the effective and transparent utility of the model. Such a synergistic combination of AI and blockchain is a burgeoning area of research. This paper outlines a proposal for combining blockchain and AI techniques for handling misinformation on the Web and highlights some of the early ongoing work in this space.
Technological advancements in block chain (BC)-based frameworks have empowered scientists to create innovative inventions such as e-casting ballots. The traditional agreement models utilized proof-of-work (PoW) in the Bitcoin that affected energy utilization and bargained the adaptability for the ballot framework. The existing works evaluates the trust basically only on the centralized party as it was not feasible because of the dynamic changes in the pervasive social networking (PSN) topology and their characteristics. The present research work proposes a block chain based trust evaluation model for the PSN based BC. The proposed hybrid proof of stake-trust (PST) BC is based on the proof-of trust (PoT) and also the proof of stake (PoS) overcomes the issues that are occurring in the e-vote casting. The trust evaluation is performed for public verification and becomes transparent for each node of PSN. The advantage of the proposed method is that a new block will be designed for trust evaluation during the block generation. The process of sharding erases the workload when the network works fast for the individual nodes provides the sum of their alternative parts. Therefore, the model utilizes the agreements for generating the safe process that guarantee the precision to vote it from the time of the election results. The present research work utilizes the proof of stake-trust based BC resulted in security improvement. The model improves the adaptability and execution of the BC based on the ballot framework provided a secured voting system for the government. The proposed PST-BC model showed better results in terms of latency as 15/s when compared with the existing models merkle hash tree -bloom filter that obtained 107.3/s and performance constraints based electron of 18/s.
Federico Cernera, Massimo La Morgia, Alessandro Mei, Francesco Sassi
In this work, we perform a longitudinal analysis of the BNB Smart Chain and Ethereum blockchain from their inception to March 2022. We study the ecosystem of the tokens and liquidity pools, highlighting analogies and differences between the two blockchains. We discover that about 60% of tokens are active for less than one day. Moreover, we find that 1% of addresses create an anomalous number of tokens (between 20% and 25%). We discover that these tokens are used as disposable tokens to perform a particular type of rug pull, which we call 1-day rug pull. We quantify the presence of this operation on both blockchains discovering its prevalence on the BNB Smart Chain. We estimate that 1-day rug pulls generated $240 million in profits. Finally, we present sniper bots, a new kind of trader bot involved in these activities, and we detect their presence and quantify their activity in the rug pull operations.
Individual mental feelings and reactions are getting more significant as they help researchers, domain experts, businesses, companies, and other individuals understand the overall response of every individual in specific situations or circumstances. Every pure and compound sentiment can be classified using a dataset, which can be in the form of Twitter text by various Twitter users. Twitter is one of the vital platforms for individuals to participate and share their ideas about different topics; it is also considered to be one of the most famous and the biggest website for micro-blogging on the Internet. One of the key purposes of this study is to classify pure and compound sentiments based on text related to cryptocurrencies, an innovative way of trading and flourishing daily. The cryptocurrency market incurs many fluctuations in the coins’ value. A small positive or negative piece of news can sensate the whole scenario about the specific cryptocurrencies. In this paper, individuals’ pure and compound sentiments based on cryptocurrency-related Twitter text are classified. The dataset is collected through the Twitter API. In WEKA, the two deployment schemes are compared; firstly, straight with single feature selection technique (Tweet to lexicon feature vector), and secondly, a tetrad of feature selection techniques (Tweet to lexicon feature vector, Tweet to input lexicon feature vector, Tweet to SentiStrength feature vector, and Tweet to embedding feature vector) are used to purify the data LibLINEAR (LL) classifier, which contains fast algorithms for linear classification using L2-regularization L2-loss support vector machines (Dual SVM). The LL classifier differs in that it can potentially alleviate the sum of the absolute values of errors rather than the sum of the squared errors and is typically much speedier. Based on the overall performance parameters, the deployment scheme containing the tetrad of feature selection techniques with the LL classifier is considered the best choice for the purpose of classification. Among machine learning techniques, LL produces effective results and gives an efficient performance compared to other prevailing techniques. The findings of this research would be beneficial for Twitter users as well as cryptocurrency traders.
Traditional sentiment analysis methods are based on text-, visual- or audio-processing using different machine learning and/or deep learning architecture, depending on the data type. This situation comes with technical processing diversity and cultural temperament effect on analysis of the results, which means the results can change according to the cultural diversities. This study integrates a blockchain layer with an LSTM architecture. This approach can be regarded as a machine learning application that enables the transfer of the metadata of the ledger to the learning database by establishing a cryptographic connection, which is created by adding the next sentiment with the same value to the ledger as a smart contract. Thus, a "Proof of Learning" consensus blockchain layer integrity framework, which constitutes the confirmation mechanism of the machine learning process and handles data management, is provided. The proposed method is applied to a Twitter dataset with the emotions of negative, neutral and positive. Previous sentiment analysis methods on the same data achieved accuracy rates of 14% in a specific culture and 63% in a the culture that has appealed to a wider audience in the past. This study puts forth a very promising improvement by increasing the accuracy to 92.85%.
Blockchains emerged in the past decade with applications across a myriad of domains, however this nascent field has so far been commonly associated with cryptocurrencies. The secure and decentralized nature of blockchains offers benefits across a wide range of industries, including healthcare which remains the largest focus of cyber crimes today. In this work, we demonstrate a Blockchain implementation as a proof of concept for the storage of electronic Protected Health Information (ePHI) related to the COVID-19 pandemic. We use two Amazon Managed Blockchain services, Hyperledger Fabric and Ethereum, to store medical data in Amazon Web Services (AWS). While the two frameworks provide a secure resource for medical data, depending on the chosen implementation, the cost can grow quickly based on the number of requests, which may make them prohibitive for applications such as COVID-19 vaccine passports.
Ellie Rennie, Michael Zargham, Joshua Tan, Luke E. Miller · 7 authors
Blockchain governance occurs through a combination of social and technical activities, involving smart contracts, deliberation within a group, and voting. These processes are significant as they demonstrate how governance of distributed infrastructures is evolving. While typologies of blockchain governance can be constructed by gathering on-chain interactions and formal rules, other aspects are more difficult to observe, including governance interactions occurring inside discussion forums. In this article, we discuss a participatory digital ethnography technique, whereby participants and researchers use a bespoke bot to identify governance interactions occurring within project forums (on Discord). The technique is designed to be used in conjunction with the analysis of software for the purpose of mapping and understanding the “governance surface” of different protocols. We describe our tools and methods for understanding automated futures through a case study of the SourceCred community, an organization using, developing, and maintaining open source software called SourceCred. The SourceCred codebase is also used by other decentralized communities for various organizational functions, including reputation and compensation.
In blockchain, ensuring integrity of data when updating distributed ledgers is a challenging and very fundamental process. Most of blockchain networks use Merkle tree to verify the authenticity of data received from other peers on the network. However, creating Merkle tree for each block in the network and composing Merkle branch for every transaction verification request are time-consuming process requiring heavy computations. Moreover, sending these data through the network generates a lot of traffic. Therefore, we proposed an updated mechanism that uses incremental hash chain with probabilistic filter to verify block data, provide a proof of data integrity and efficiently update blockchain light nodes. In this article, we prove that our model provides better performance and less required computations than Merkle tree while maintaining the same security level.
Abstract The technology of Ethereum blockchain enables the implementation of smart contracts. Nowadays smart contracts are one of the most successful applications of blockchain technology, which are widely used in many fields, such as finance, energy and services. The decentralization and immutability properties of Ethereum blockchain provide security for transactions from smart contracts. However, these properties are possible to lead to unfixable vulnerabilities of smart contracts. In recent years, vulnerability detection on smart contracts has attracted more attention from researchers and many related tools have emerged. Nevertheless, the existing vulnerability detection tools have not yet been put into formal use. Due to the lack of suitable smart contract sets and fair metrics with other factors, it remains complex work to conduct authoritative performance tests on these tools. In this paper, we first summarize eight common vulnerabilities of smart contracts, and then divide them into call-related and call-irrelated vulnerabilities according to whether they involve caller functions or not. In addition, we propose a detection framework called SuperDetector, which combines a variety of vulnerability detection tools based on static analysis technology. And the framework mainly measures the detection performance, which contains vulnerability coverage, detection accuracy, usability and execution time on the two types of vulnerabilities. The results indicate that the framework can analyze the performance from different perspectives, and the performance of vulnerability coverage and detection accuracy on call-related vulnerabilities is much better than that on call-irrelated vulnerabilities. Finally, we design a selector based on the detection results in the framework for improving the vulnerability coverage and detection accuracy.
Ethereum, a blockchain-based platform, provides a suitable environment for coding and executing smart contracts among trustless parties. However, smart contracts are exposed to inherent security risks due to manipulating digital units of value on a public decentralized blockchain. Even worse, vulnerabilities can hardly be fixed as the contracts are stored on the blockchain. Hence, there is a significant need to write secure and well-performing contracts and ensure their high reliability. To overcome these challenges, we propose an automated static framework SolChecker, for vulnerability detection on Solidity smart contracts. It works by analyzing information extracted from constructed abstract syntax tree of Solidity smart contracts, and developers can use the analyzed results to design detectors for specific vulnerabilities according to their needs. In this paper, we present an overview of SolChecker, provide the detailed design of each component, and evaluate the capabilities of the designed detectors on 47,037 real-world contracts. Furthermore, we clarify the effect of each extracted information by performing a comparative experiment on 500 contracts sampled from the dataset. Our tool reflects the current state of knowledge on Solidity vulnerabilities.
A smart contract that is deployed to a blockchain system like Ethereum is, under reasonable circumstances, expected to be immutable and tamper-proof. This is both a feature (promoting integrity and transparency) and a bug (preventing security patches and feature updates). Modern smart contracts use software tricks to enable upgradeability, raising the research questions of how upgradeability is achieved and who is authorized to make changes. In this paper, we summarize and evaluate six upgradeability patterns. We develop a measurement framework for finding how many upgradeable contracts are on Ethereum that use certain prominent upgrade patters. We find 1.4 million proxy contracts which 8,225 of them are unique upgradeable proxy contracts. We also measure how they implement access control over their upgradeability: about 50% are controlled by a single Externally Owned Address (EOA), and about 14% are controlled by multi-signature wallets in which a limited number of persons can change the whole logic of the contract.
Fake News has become a huge alarming issue since the previous few years.It can be used to influence people on any political, economical or social topics and change people’s thoughts on a particular subject. We’re using a blockchain based technique to overcome this problem. More specifically the proposed approach uses concepts of customized proof of authority and proof of truthfulness consensus algorithm serving as an incentive mechanism to determine the integrity of fake news. As Blockchain is a decentralized system no one will be able to tamper with the original news. Also, we are maintaining the reputation score of each organization. Due to fear of lowering credibility score, no one will produce fake news and the probability of fake news getting viral will be reduced. This platform which is a blockchain based Decentralized application can provide normal readers on the platform with a reliable way of verifying the content and the source by which it gets published. Our work demonstrates that the solutions proposed in this paper ensure data integrity, data security, data transparency, and data traceability by consideration of such a blockchain-based framework for tackling fake news. Key Words: Decentralized Applications, Decentralised Autonomous Organisation, Decentralized Exchange, Peer To Peer, Ethereum Virtual Machine
This paper investigates the cryptocurrency giveaway scam with the YouTube live stream carried out on 5/15/2022 and 5/16/2022. In this scam scheme, the scammer plays a recorded video of a famous person in a YouTube live stream annotated with a cryptocurrency giveaway announcement. In the annotated announcement, the victims are directed to the scammer's webpage. The scammer's webpage is designed intelligently to deceive victims such that they believe the legitimacy of the giveaway. The scammer claims that whatever donation the victim sends to a cryptocurrency wallet address, the giveaway scheme will double the donated amount and immediately send it back to the victim. By analyzing the scammers' wallet addresses, it can be seen that scammers could steal a significant amount of money in a short time. After analyzing the attackers' techniques, tactics, and procedures, this paper discusses the countermeasures that can be applied to mitigate such a fraudulent activity in the future.
Giuseppe Crincoli, Giacomo Iadarola, Piera Elena La Rocca, Fabio Martinelli · 6 authors
We are recently witnessing an exponential use of blockchain technology since information infrastructures are increasingly moving from the concept of centralisation to the decentralization ones. Blockchain technology is strictly related to the exchange of sensitive information, and its massive adoption is corresponding to interest from attackers. In this paper, we propose a method to automatically detect whether a Smart Contract (i.e. a contract between two parties concerning the exchange of goods and services, it is executed automatically and is governed by a source code written by a developer, contains clearly conditions accepted by both parties and resides on a distributed and decentralised network of computers) exhibits vulnerability. The proposed method relies on model checking and, through the adoption of μ-Calculus rules, is aimed to detect four different vulnerabilities on Smart Contracts modeled as automata. We preliminary evaluate the proposed method on a dataset composed by 40 (vulnerable and legitimate) contracts, by obtaining a precision ranging from 0.98 to 1 and a recall equal to 1, confirming that the proposed method can be promising in vulnerable Smart Contract detection.
With the rising popularity of Ethereum, there is also an uptick in the number of smart contract based decentralized applications (DApps). Consequently, Ethereum transaction volume is growing steadily over the last few years, but so are the various types of attacks on it. In Ethereum vulnerable smart contracts are always taken advantage of by adversaries. One of the primary ways of exploiting Ethereum with malicious intent is through frontrunning attacks that take advantage of the waiting time of transactions in the pending pool by adjusting the gas price. Attackers willing to execute such attacks constantly monitor the pending transaction pool and try to frontrun transactions. Mitigating such attacks is a critical step for ensuring secure DApp operations in Ethereum. In this paper, we propose a model-based attack detection and prevention scheme. We extract specific features for each transaction and transform each transaction into a feature vector which is then analyzed by a machine learning model to detect if it is a frontrunning attack transaction or not in real time. Extensive experiments on a large dataset of transactions establish the effectiveness of our approach.
Ethereum is the most popular blockchain platform that supports smart contracts. Smart contracts are computing programs that constitute the building blocks of decentralized applications (DApps). DApps are revolutionary and have led to the creation of entirely new businesses (e.g., marketplaces for digital collectibles). Nonetheless, developing and maintaining DApps lead to entirely new research challenges. Empirical research demands high-quality data, which can be obtained by carefully mining Ethereum. In this tutorial, I will discuss best practices and pitfalls associated with mining Ethereum. The tutorial will be organized into three main parts: (i) a brief introduction to Ethereum and its fundamental concepts, (ii) a hands-on mining session, and (iii) a final Q&A session.
Microblogging has become an extremely popular communication tool among Internet users worldwide. Millions of users daily share a huge amount of information related to various aspects of their lives, which makes the respective sites a very important source of data for analysis. Bitcoin (BTC) is a decentralized cryptographic currency and is equivalent to most recurrently known currencies in the way that it is influenced by socially developed conclusions, regardless of whether those conclusions are considered valid. This work aims to assess the importance of Twitter users’ profiles in predicting a cryptocurrency’s popularity. More specifically, our analysis focused on the user influence, captured by different Twitter features (such as the number of followers, retweets, lists) and tweet sentiment scores as the main components of measuring popularity. Moreover, the Spearman, Pearson, and Kendall Correlation Coefficients are applied as post-hoc procedures to support hypotheses about the correlation between a user influence and the aforementioned features. Tweets sentiment scoring (as positive or negative) was performed with the aid of Valence Aware Dictionary and Sentiment Reasoner (VADER) for a number of tweets fetched within a concrete time period. Finally, the Granger causality test was employed to evaluate the statistical significance of various features time series in popularity prediction to identify the most influential variable for predicting future values of the cryptocurrency popularity.