A smart public transport system is expected to be an integral part of our human lives to improve our mobility and reduce the effect of our carbon footprint. The safety and ongoing maintenance of the smart public transport system from cyberattacks are vitally important. To provide more comprehensive protection against potential cyberattacks, we propose a novel approach that combines blockchain technology and a deep learning method that can better protect the smart public transport system. By the creation of signed and verified blockchain blocks and chaining of hashed blocks, the blockchain in our proposal can withstand unauthorized integrity attack that tries to forge sensitive transport maintenance data and transactions associated with it. A hybrid deep learning-based method, which combines autoencoder (AE) and multi-layer perceptron (MLP), in our proposal can effectively detect distributed denial of service (DDoS) attempts that can halt or block the urgent and critical exchange of transport maintenance data across the stakeholders. The experimental results of the hybrid deep learning evaluated on three different datasets (i.e., CICDDoS2019, CIC-IDS2017, and BoT-IoT) show that our deep learning model is effective to detect a wide range of DDoS attacks achieving more than 95% F1-score across all three datasets in average. The comparison of our approach with other similar methods confirms that our approach covers a more comprehensive range of security properties for the smart public transport system.
Muneeb Ul Hassan, Mubashir Husain Rehmani, Jinjun Chen
Over the past decade, blockchain technology has attracted a huge attention from both industry and academia because it can be integrated with a large number of everyday applications of modern information and communication technologies (ICT). Peer-to-peer (P2P) architecture of blockchain enhances these applications by providing strong security and trust-oriented guarantees, such as immutability, verifiability, and decentralization. Despite these incredible features that blockchain technology brings to these ICT applications, recent research has indicated that the strong guarantees are not sufficient enough and blockchain networks may still be prone to various security, privacy, and reliability issues. In order to overcome these issues, it is important to identify the anomalous behaviour within the actionable time frame. In this article, we provide an in-depth survey regarding integration of anomaly detection models in blockchain technology. For this, we first discuss how anomaly detection can aid in ensuring security of blockchain based applications. Then, we demonstrate certain fundamental evaluation metrics and key requirements that can play a critical role while developing anomaly detection models for blockchain. Afterwards, we present a thorough survey of various anomaly detection models from the perspective of each layer of blockchain. Finally, we conclude the article by highlighting certain important challenges alongside discussing how they can serve as future research directions for new researchers in the field.
While Bitcoin is legal, hackers, narcotics smugglers, and other dubious persons that have to be prosecuted are still utilizing it. Bitcoin is used in various industries due to its wide range of applications but it is also on the radar of malicious people and they are performing various types of cybercrimes in the dark web. Future conflicts will be cyber wars, with crimes combining cryptography and malware to manipulate information technology and compromise their security. Cyber-attacks are made easier by the rapid development of the Internet. Loss of private information and degradation of customer trust in e-commerce are two examples of web threats. In this paper, the authors have implemented an automated process for investigating the bitcoins balances and wallet addresses. The authors have also highlighted the use of bitcoin in various cybercrimes. The tool used in investigating the Bitcoin balances and the bitcoin wallets is SpiderFoot. The results are generated in our paper are the form of hashes of bitcoin balances and wallet addresses that are investigated properly to check for any cyber fraud in the dark web.
Rihab Habeeb Sahib, Prof. Dr. Eman Salih Al-Shamery
Regular E-voting systems for elections may count the votes in less time,less cost,save the privacy of citizens,but still considered risky as votes can be tampered.E-voting systems based on a network distributed ledger show fast results,more trusted,save privacy,cannot be tampered,and distributed in which no central organization controls the system.This paper illustrate an e-voting system to solve the challenge of a massive ledger that is distributed among network-nodes using a data reduction technique as a security-matching-tool,singular value decomposition(SVD) that handle a copy of election results in another form and matched with the SQL-database results to announce a successful election-event representing a transparency-powerful-secured-system
The development of electronic voting applications remains an active area of research and this has led to the proposal and implementation of many models based on blockchains. However, most of the proposed models are partially decentralized solutions, in which the blockchain is used as a storage media for votes while the application is written in programming tools such as HTML, CSS, and JavaScript. This makes them vulnerable to attacks such as Denial of Service (DoS) attacks, Single Point of Failure (SPF), and fraudulent record modification. In this paper, we propose a fully decentralized electronic voting application, SEVA, in which we placed the whole application (code and data) in Ethereum to protect the application from vulnerabilities. Additionally, we propose a new consensus algorithm, Proof of Smart Vote (PoSV) for SEVA, as a viable energy-saving alternative to the energy-intensive Proof of Work (PoW). We implemented and evaluated SEVA with PoSV and compared it with a partially decentralized model of the application.
Recently, phishing scams have posed a significant threat to blockchains. Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses’ transaction behavior features by random walking or constructing static subgraphs. The random walking methods, unfortunately, usually miss structural information due to limited sampling sequence length, while the static subgraph methods tend to ignore temporal features lying in the evolving transaction behaviors. More importantly, their performance undergoes severe degradation when the malicious users intentionally hide phishing behaviors. To address these challenges, we propose TEGDetector, a dynamic graph classifier that learns the evolving behavior features from transaction evolution graphs (TEGs). First, we cast the transaction series into multiple time slices, capturing the target address’s transaction behaviors in different periods. Then, we provide a fast nonparametric phishing detector (FD) to narrow down the search space of suspicious addresses. Finally, TEGDetector considers both the spatial and temporal evolutions toward a complete characterization of the evolving transaction behaviors. Moreover, TEGDetector utilizes adaptively learned time coefficient to pay distinct attention to different periods, which provides several novel insights. Extensive experiments on the large-scale Ethereum transaction dataset demonstrate that the proposed method achieves state-of-the-art (SOTA) detection performance. The code of TEGDetector is open sourced at https://github.com/Seaocn/TEGDetector.
On an Ethereum node, txpool (a.k.a. mempool) is a buffer storing unconfirmed transactions and controls what downstream services can see, such as mining and transaction propagation. This work presents the first security study on Ethereum txpool designs.
Xiong Yang, Yuling Chen, Xiaobin Qian, Tao Li · 5 authors
The distributed deployment of wireless sensor networks (WSNs) makes the network more convenient, but it also causes more hidden security hazards that are difficult to be solved. For example, the unprotected deployment of sensors makes distributed anomaly detection systems for WSNs more vulnerable to internal attacks, and the limited computing resources of WSNs hinder the construction of a trusted environment. In recent years, the widely observed blockchain technology has shown the potential to strengthen the security of the Internet of Things. Therefore, we propose a blockchain-based ensemble anomaly detection (BCEAD), which stores the model of a typical anomaly detection algorithm (isolated forest) in the blockchain for distributed anomaly detection in WSNs. By constructing a suitable block structure and consensus mechanism, the global model for detection can iteratively update to enhance detection performance. Moreover, the blockchain guarantees the trust environment of the network, making the detection algorithm resistant to internal attacks. Finally, compared with similar schemes, in terms of performance, cost, etc., the results prove that BCEAD performs better.
Damir Dautov, Rinat Khayretdinov, Alexey Vulfin, Konstantin Mironov
Software-defined networks are becoming more popular as the number of devices in large enterprise networks continues to grow. However, this technology has vulnerabilities that can be very dangerous for company. An algorithm of implementation of the distributed ledgers in software-defined networks for security purposes is proposed in this paper.
Phan The Duy, Hien Do Hoang, Do Thi Thu Hien, Anh Gia-Tuan Nguyen · 5 authors
Software-Defined Network (SDN) is a new arising terminology of network architecture with outstanding features of orchestration by decoupling the control plane and the data plane in each network element. Even though it brings several benefits, SDN is vulnerable to a diversity of attacks. Abusing the single point of failure in the SDN controller component, hackers can shut down all network operations. More specifics, a malicious OpenFlow application can access to SDN controller to carry out harmful actions without any limitation owing to the lack of the access control mechanism as a standard in the Northbound. The sensitive information about the whole network such as network topology, flow information, and statistics can be gathered and leaked out. Even worse, the entire network can be taken over by the compromised controller. Hence, it is vital to build a scheme of access control for SDN's Northbound. Furthermore, it must also protect the data integrity and availability during data exchange between application and controller. To address such limitations, we introduce B-DAC, a blockchain-based framework for decentralized authentication and fine-grained access control for the Northbound interface to assist administrators in managing and protecting critical resources. With strict policy enforcement, B-DAC can perform decentralized access control for each request to keep network applications under surveillance for preventing over-privileged activities or security policy conflicts. To demonstrate the feasibility of our approach, we also implement a prototype of this framework to evaluate the security impact, effectiveness, and performance through typical use cases.
Cryptocurrency nowadays is in most demand and many people are investing in these currencies to get high returns. Its is more frequently used as it is theft proof, accessible anywhere and anytime. By using crypto currency the settlement of money is instant. Many websites and applications provide us information about the rates of different crypto currencies available in the Crypto Market. So we will be building an application in which we will be displaying the real time rates of different crypto currencies inside our application.
Since the birth and open source of Bitcoin, there are more than 10,000 kinds of virtual cryptocurrencies in the market. Every day, virtual cryptocurrencies are born, but also virtual cryptocurrencies die out. In the life cycle of virtual cryptocurrencies, different periods of abnormal transactions will occur. However, there are still deficiencies in the definition and related studies of the life cycle of virtual cryptocurrencies in existing researches. Machine learning (ML) can dig out the hidden rules from a large amount of data. We use unsupervised learning in machine learning to detect the life cycle of virtual cryptocurrencies. In this work, we divide and define each stage of the life cycle of virtual cryptocurrencies in detail. Based on the popularity value system of virtual cryptocurrencies and the similarity comparison algorithm, we establish a virtual cryptocurrencies life cycle detection tool to detect the life cycle stage of virtual cryptocurrencies. Experimental results demonstrate the effectiveness of the proposed unsupervised learning based virtual cryptocurrency life cycle detection tool.
Blockchain technology has recently gained high popularity in data security, primarily to mitigate against data breach and manipulation. Since its inception in 2008, it has been applied in different areas mainly to maintain data integrity and consistency. Blockchain has been tailored to secure data due to its data immutability and distributive technology. Despite the high success rate in data security, the inability to identify compromised insider nodes is one of the significant problems encountered in blockchain architectures. A Blockchain network is made up of nodes that initiate, verify and validate transactions. If compromised, these nodes can manipulate submitted transactions, inject fake transactions, or retrieve unauthorized information that might eventually compromise the stored data’s integrity and consistency. This paper proposes a novel method of detecting these compromised blockchain nodes using a server-side authentication process and thwart their activities before getting updated in the blockchain ledger. In evaluating the proposed system, we perform four common insider attacks, which fall under the following three categories: (1) Those attacks targeting the Blockchain to bring it down. (2) the attacks that attempt to inject fake data into the database. (3) The attacks that attempt to hijack or retrieve unauthorized data. We described how we implement the attacks and how our architecture detects them before they impact the network. Finally, we displayed the attack detection time for each attack and compared our approach with other existing methods.
Henry Vargas, Carlos Lozano-Garzón, Germán A. Montoya, Yezid Donoso
Internet of Things (IoT) networks have been integrated into industrial infrastructure schemes, positioning themselves as devices that communicate highly classified information for the most critical companies of world nations. Currently, and in order to look for alternatives to mitigate this risk, solutions based on Blockchain algorithms and Machine Learning techniques have been implemented separately with the aim of mitigating potential threats in IIoT networks. In this paper, we sought to integrate the previous solutions to create an integral protection mechanism for IoT device networks, which would allow the identification of threats, activate secure information transfer mechanisms, and it would be adapted to the computational capabilities of industrial IoT. The proposed solution achieved the proposed objectives and is presented as a viable mechanism for detecting and containing intruders in an IoT network. In some cases, it overcomes traditional detection mechanisms such as an IDS.
Detection of unknown malware and its variants remains both an operational and a research challenge in the Internet of Things (IoT). The Internet of Medical Things (IoMT) is a particular type of IoT network which deals with communication through smart healthcare (medical) devices. One of the prevailing problems currently facing IoMT solutions is security and privacy vulnerability. Previous malware detection methods have failed to provide security and privacy. In order to overcome this issue, the current study introduces a novel technique called biserial correlative Miyaguchi-Preneel blockchain-based Ruzicka-index deep multilayer perceptive learning (BCMPB-RIDMPL). The present research aims to improve the accuracy of malware detection and minimizes time consumption. The current study combines the advantages of machine-learning techniques and blockchain technology. The BCMPB-RIDMPL technique consists of one input layer, three hidden layers, and one output layer to detect the malware. The input layer receives the number of applications and malware features as input. After that, the malware features are sent to the hidden layer 1, in which feature selection is carried out using point biserial correlation, which reduces the time required to detect the malware. Then, the selected features and applications are sent to the hidden layer 2. In that layer, Miyaguchi-Preneel cryptographic hash-based blockchain is applied to generate the hash value for each selected feature. The generated hash values are stored in the blockchain, after which the classification is performed in the third hidden layer. The BCMPB-RIDMPL technique uses the Ruzicka index to verify the hash values of the training and testing malware features. If the hash is valid, then the application is classified as malware, otherwise it is classified as benign. This method improves the accuracy of malware detection. Experiments have been carried out on factors such as malware detection accuracy, Matthews's correlation coefficient, and malware detection time with respect to a number of applications. The observed quantitative results show that our proposed BCMPB-RIDMPL method provides superior performance compared with state-of-the-art methods.
Blockchain, as a distributed ledger technology, becomes increasingly popular, especially for enabling valuable cryptocurrencies and smart contracts. However, the blockchain software systems inevitably have many bugs. Although bugs in smart contracts have been extensively investigated, security bugs of the underlying blockchain systems are much less explored. In this paper, we conduct an empirical study on blockchain's system vulnerabilities from four representative blockchains, Bitcoin, Ethereum, Monero, and Stellar. Specifically, we first design a systematic filtering process to effectively identify 1,037 vulnerabilities and their 2,317 patches from 34,245 issues/PRs (pull requests) and 85,164 commits on GitHub. We thus build the first blockchain vulnerability dataset. We then perform unique analyses of this dataset at three levels, including (i) file-level vulnerable module categorization by identifying and correlating module paths across projects, (ii) text-level vulnerability type clustering by natural language processing and similarity-based sentence clustering, and (iii) code-level vulnerability pattern analysis by generating and clustering code change signatures that capture both syntactic and semantic information of patch code fragments. Our analyses reveal three key findings: (i) some blockchain modules are more susceptible than the others; notably, each of the modules related to consensus, wallet, and networking has over 200 issues; (ii) about 70% of blockchain vulnerabilities are of traditional types, but we also identify four new types specific to blockchains; and (iii) we obtain 21 blockchain-specific vulnerability patterns that capture unique blockchain attributes and statuses, and demonstrate that they can be used to detect similar vulnerabilities in other popular blockchains, such as Dogecoin, Bitcoin SV, and Zcash.
Intrusion Detection Systems (IDS) have been the industry standard for securing IoT networks against known attacks. To increase the capability of an IDS, researchers proposed the concept of blockchain-based Collaborative-IDS (CIDS), wherein blockchain acts as a decentralised platform allowing collaboration between CIDS nodes to share intrusion related information, such as intrusion alarms and detection rules. However, proposals in blockchain-based CIDS overlook the importance of continuous evaluation of the trustworthiness of each node and generally work based on the assumption that the nodes are always honest. In this paper, we propose a decentralised CIDS that emphasises the importance of building trust between CIDS nodes. In our proposed solution, each CIDS node exchanges detection rules to help other nodes detect new types of intrusion. Our architecture offloads the trust computation to the blockchain and utilises a decentralised storage to host the shared trustworthy detection rules, ensuring scalability. Our implementation in a lab-scale testbed shows that the our solution is feasible and performs within the expected benchmarks of the Ethereum platform.
Mohamed Ali, Ibrahim A. Abd El-Moghith, Mohamed N. El-Derini, Saad M. Darwish
Routing is a key function in Wireless Sensor Networks (WSNs) since it facilitates data transfer to base stations. Routing attacks have the potential to destroy and degrade the functionality of WSNs. A trustworthy routing system is essential for routing security and WSN efficiency. Numerous methods have been implemented to build trust between routing nodes, including the use of cryptographic methods and centralized routing. Nonetheless, the majority of routing techniques are unworkable in reality due to the difficulty of properly identifying untrusted routing node activities. At the moment, there is no effective way to avoid malicious node attacks. As a consequence of these concerns, this paper proposes a trusted routing technique that combines blockchain infrastructure, deep neural networks, and Markov Decision Processes (MDPs) to improve the security and efficiency of WSN routing. To authenticate the transmission process, the suggested methodology makes use of a Proof of Authority (PoA) mechanism inside the blockchain network. The validation group required for proofing is chosen using a deep learning approach that prioritizes each node's characteristics. MDPs are then utilized to determine the suitable next-hop as a forwarding node capable of securely transmitting messages. According to testing data, our routing system outperforms current routing algorithms in a 50% malicious node routing scenario.
With the recent developments in many technologies, a novel concept “blockchain” was introduced in 2009 as a cryptocurrency application by some anonymous name or group of people. Today, this concept “blockchain” is changing every possible application. The future world will belong to a decentralized structure (Blockchain 4.0), i.e. everything is moving toward decentralized structures like decentralized network, decentralized web, etc. Apart from that, when we talk about the Internet network, then we look at mitigating several cyberthreats on many web applications. Note that, over 80% of web applications and websites are being attacked (facing breaches of information) everyday by third-party attackers (internally and/or externally). By and large, attackers work or take data from within an association or work inside the victim’s framework, which is undetected for quite a long time or even years. For this, several attempts are being made by many researchers to avoid such dangerous attacks on the cyber world. Indeed, even constant checking and real-time alerting is not sufficient alone to reduce hazards (i.e. these attacks). We additionally require proficient and smoothed out work processes to quickly get alerts, analyze root causes (foundations of an attack), remediate dangers, and proactively search for new ones (probability of new attack on a framework or organization). In this chapter, we will provide complete information about how blockchain technology can be useful in digital forensics and threat hunting over the Internet/cyberspace. Also, this research work provides an in-depth view of threat hunting in memory, file systems, and network data, and an introductory analysis of malicious programs. In continuation of this, this article will also discuss several useful components like asset management, risk and vulnerability management, threat detection, and response, threat hunting using live box forensics, cyberthreat hunting, and digital forensics, etc., for hunting threats using blockchain technology (in various useful application like e-healthcare, defense, etc.). In summary, this research work provides descriptions about applications of blockchain technology in digital forensics (or computer forensics, an application of scientific investigatory techniques into digital crimes and attacks), and the threat hunting (identification of threats) process (i.e., in many applications) in detail.
With more devices being inter- or intra-connected, Internet of Things (IoT) has gradually been adopted in many disciplines, such as healthcare industry, coined as Internet of Medical Things (IoMT). The purpose of IoMT is to facilitate the efficiency and effectiveness of medical operations, i.e., remotely monitoring the status of patients. In such healthcare environments, smartphones have become an important device to communicate with others and update the information of patients, resulting in a special type of IoMT called Medical Smartphone Networks (MSNs). To reinforce the distributed architecture, trust management schemes are often implemented to defend against insider attacks. However, how to maintain the robustness of trust management in heavy traffic networks still remains a challenge, i.e., COVID-19 incident would cause excessive traffic for healthcare organizations and increase the difficulty of validating trustworthiness among MSN nodes. In this work, we focus on this issue and propose a blockchain-enabled adaptive traffic sampling method to help enhance the robustness of trust management under high traffic environments. The use of blockchain technology aims to build a verified database of malicious traffic among all nodes. The evaluation in a real healthcare environment demonstrates the viability and effectiveness of our approach.
Binary Attestation (BA) ist ein Sicherheitsmechanismus, der schon lange zur Sicherstellung der Integrität der auszuführenden Software auf einem Computerssystem verwendet wird. Dies wird durch die Anwendung der Konzepte von Trusted Computing Technologie erreicht. Die Konzepte der Trusted Computing Technologie sind: Trusted Platform Module (TPM), measured/trusted boot und Linux Integrity Measurement Architecture (IMA). Damit die Vertrauenswürdigkeit des Betriebszustandes des Systems überprüft werden kann, wird eine Logdatei erstellt. Diese enthält den Dateinamen und die Hash-Summe der Softwarekomponenten, welche an das TPM gebunden wird. Zu einem späteren Zeitpunkt kann eine entfernte Partei (Verifier) die Evidenz verifizieren, um zu sehen, ob der Betriebszustand des Systems vertrauenswürdig ist. Dies wird als Remote Attestation (RA) bezeichnet.Auf den Systemen im Bereich der Cyber-physische Systeme (z. B.: Energie Netze und Kernkraftwerke) und im Bereich der Verkehrsmittel (z. B.: Züge und Automobil Fahrzeuge) laufen mehrere Anwendungen von verschiedenen Herstellern. Bei bisherigen Ansätzen der BA, werden alle Einträge der Logdatei von allen laufenden Anwendungen aller Hersteller während der RA an die entfernte Partei preisgegeben. Daher gewährleistet die Binary Remote Attestation keine Privatheit. Diese Masterarbeit adressiert die genannte Schwäche von der Binary Remote Attestation indem es eine Privacy-Preserving Remote Attestation Ansatz erstellt. Im Kern der Arbeitsteht die Konzeptionierung eines Ansatzes, welches den Trusted Computing Sektor mit Privacy-Enhancing Technologie verknüpft. Der Ansatz bewahrt die Privatheit, indem alle Logeinträge verschleiert werden. Dabei werden dem Verifier nur die jeweilig zugehörigen Einträge offengelegt. Dadurch kann der Attester dem Verifier durch die Anwendung des Schnorr Non-Interactive Zero-Knowledge Proofs über eine elliptische Kurve (Schnorr-Signatur) beweisen, dass es sich bei den ausgeblendeten Einträgen um die tatsächlich laufende Anwendung auf dem System des Attesters handelt, ohne die anderen Einträge preiszugeben. Dieser Ansatz wird in dieser Arbeit als Proof-of-Concept umgesetzt. Die Leistung und die Privatheit des Proof-of-Concepts wurden in dieser Arbeit analysiert. Hierdruch wird gezeigt, dass die Privatheit gegenüber der entfernten Partei gewährleistet wird, während die Integrität und Authentizität des Betriebszustands des Systems vom Attester sichergestellt wird. Die Gewährleistung der Privatheit geht allerdings mit einem Anstieg der benötigten Ressourcen einher.