Data integrity and security protection are needed in the Internet of Things. IOTA technology with a Directed Acyclic Graph (DAG) structure is a solution to realize secure and scalable data transactions. Recent research IOTA is still faced with the issue of being vulnerable to splitting attacks and left-behind transactions. The splitting attack causes the network to confirm conflict transactions. Then, left-behind transactions cause the network to generate transactions that will not be confirmed. The selection tip weighted random walk (WRW) algorithm uses the Markov Chain Monte Carlo (MCMC) to overcome these two issues by applying the appropriate bias parameter (α). However, when the α is too large, it will produce a lot of left-behind transactions. Determining the optimal value of α is still an important research topic today. An E-IOTA study that gives several α values statically with random selection but can still produce more left-behind transactions than pure WRW. This paper proposes an optimization of the tip selection algorithm (DA-IOTA) to determine the optimal alpha (α) using an approach to dynamically determine each WRW step. The experimental results show that DA-IOTA produces fewer left-behind transactions than MCMC (WRW) and E-IOTA which use α parameters statically.
Smart contracts are computer programs running on blockchain platforms to manage large sums of cryptocurrency, govern and carry out transactions of assets between multiple parties. The security of smart contracts has attracted great attention, ever since their adoption in the management of massive cryptocurrency transactions. However, current works mainly rely on the priori security patterns, e.g., reentrancy, delegatecall, gasless send and tainted owner. Although these priori security patterns have been proven effective in finding smart contract vulnerabilities, they are very limited in finding deeper design flaws such as permission bugs, bookkeeping bugs, etc. Moreover, the reliability analysis of smart contracts becomes difficult since most smart contracts have little to no documentation for specifications. Fairness is also an important quality attribute of smart contracts and fairness issues have been proved widely existing in smart contracts such as Ponzi schemes. However, fairness has not yet attracted much research attention. Most security and reliability issues can be detected via conformance checking between software implementation and its specification. As dynamic specification mining has been proven an effective way to learn specifications from software execution traces, in this dissertation, we aim to address the aforementioned challenges by proposing a systematic approach to study the security and reliability of smart contracts based on the learned specifications through dynamic specification mining techniques. In general, contract specifications can be categorized into function-level and contract level specifications. This thesis presents the implementation of InvCon, a dynamic invariant detector for Solidity smart contracts. InvCon analyzes past transac tion histories of a contract to generate likely program invariants, which represent function-level properties that must be maintained during function execution. By combining these invariants with finite event traces from historical transactions, a novel counterexample-guided abstraction refinement algorithm is proposed and implemented in SmCon to mine compact and precise contract-level automata. Additionally, the thesis also presents SPCon that mines the role structures of smart contracts from the past transaction histories for the application of permission bug detection. The thesis demonstrates the applications of program invariants in seman tic bug detection and automated fairness verification. An invariant-based semantic test oracle, implemented in a grey-box fuzzing tool ContraMaster, is developed to enhance vulnerability detection in smart contracts, effectively addressing issues like reentrancy, exception disorder, gasless send, and integer overflow/underflow. For fairness issues, a verification framework FairCon is proposed that treats smart contracts as games and focuses on four fairness properties derived from mechanism design and game theory. Mechanism models are employed for bounded fairness property checking, while program invariants are used to analyze unbounded cases. The thesis also explores the applications of contract-level models in model-based testing and access control bug detection. ModCon is introduced as a tool that allows users to provide test models for smart contracts, specifying state definitions, transition relations, pre/post conditions, invariants, and mapping to the contract code. SPCon leverages the aforementioned role mining to identify permission bugs in smart contracts through conformance testing. The evaluation results demonstrate the high accuracy of permission bug detection, uncovering 11 previously unknown bugs in a well-known smart contract benchmark. Briefly, we have successfully derived various smart contract specifications with dy namic specification mining and studied their applications on security and reliability of smart contracts
Metaverse is expected to rely on massive Internet of Things (IoT) connections so it inherits various security threats from the IoT network and also faces other sophisticated attacks related to virtual reality technology. As traditional security approaches show various limitations in the large-scale distributed metaverse, this paper proposes MetaCIDS, a novel collaborative intrusion detection (CID) framework that leverages metaverse devices to collaboratively protect the metaverse. In MetaCIDS, a federated learning (FL) scheme based on unsupervised au-toencoder and an attention-based supervised classifier enables metaverse users to train a CID model using their local network data, while the blockchain network allows metaverse users to train a machine learning (ML) model to detect intrusion network flows over their monitored local network traffic, then submit verifiable intrusion alerts to the blockchain to earn metaverse tokens. Security analysis shows that MetaCIDS can efficiently detect zero-day attacks, while the training process is resistant to SPoF, data tampering, and up to 33% poisoning nodes. Performance evaluation illustrates the efficiency of MetaCIDS with 96% to 99% detection accuracy on four different network intrusion datasets, supporting both multi-class detection using labeled data and anomaly detection trained on unlabeled data.
Bugs enable security attacks on smart contracts-computer programs operating on the blockchain and managing significant financial assets. In 2022, smart contracts control tens of billions of dollars, forming an entire ecosystem of so-called decentralized financial (DeFi) applications. The ever-increasing popularity of DeFi is largely attributed to its key principles, such as transparency, permissionlessness, and immutability. Unfortunately, the devastating hacks that accompany smart contract adoption demonstrate how these properties can also have adverse effects on the security of decentralized applications, considering that, like any other software, smart contracts can contain bugs or vulnerabilities. A seminal property of smart contracts-immutability-makes sure that all these implementation errors will have a long-lasting effect on the application. Considering that smart contracts also hold large amounts of funds, it is crucial to ensure that they are secure, correct, and free of vulnerabilities.
Liqun Chen, Changyu Dong, Nada El Kassem, Christopher J. P. Newton · 5 authors
Direct Anonymous Attestation (DAA) was designed for the Trusted Platform Module (TPM) and versions using RSA and elliptic curve cryptography have been included in the TPM specifications and in ISO/IEC standards. These standardised DAA schemes have their security based on the factoring or discrete logarithm problems and are therefore insecure against quantum attackers. Research into quantum-resistant DAA has resulted in several lattice-based schemes. Now in this paper, we propose the first post-quantum DAA scheme from symmetric primitives. We make use of a hash-based signature scheme, which is a slight modification of SPHINCS+, as a DAA credential. A DAA signature, proving the possession of such a credential, is a multiparty computation-based non-interactive zero-knowledge proof. The security of our scheme is proved under the Universal Composability (UC) model. While maintaining all the security properties required for a DAA scheme, we try to make the TPM’s workload as low as possible. Our DAA scheme can handle a large group size (up to 2 60 group members), which meets the requirements of rapidly developing TPM applications.
Rexford Nii Ayitey Sosu, Jinfu Chen, Edward Kwadwo Boahen, Zikang Zhang
Smart contracts have gained immense popularity in recent years as self‐executing programs that operate on a blockchain. However, they are not immune to security flaws, which can result in significant financial losses. These flaws can be detected using dynamic analysis methods that extract various aspects from smart contract bytecode. Methods currently used for identifying vulnerabilities in smart contracts mostly rely on static analysis methods that search for predefined vulnerability patterns. However, these patterns often fail to capture complex vulnerabilities, leading to a high rate of false negatives. To overcome this limitation, researchers have explored machine learning‐based methods. However, the accurate interpretation of complex logic and structural information in smart contract code remains a challenge. In this study, we present a technique that combines real‐time runtime batch normalization and data augmentation for data preprocessing, along with n‐grams and one‐hot encoding for feature extraction of opcode sequence information from the bytecode. We then combined bidirectional long short‐term memory (BiLSTM), convolutional neural network, and the attention mechanism for vulnerability detection and classification. Additionally, our model includes a gated recurrent units memory module that enhances efficiency using historical execution data from the contract. Our results demonstrate that our proposed model effectively identifies smart contract vulnerabilities.
The year 2020 saw remarkable domination of Android devices. Android’s large share of the global market (85%) places it first in the list of preferred targets for mobile cybercrime. Computer attacks try to control and access confidential user information by exploiting the various vulnerabilities present in the various components of the Android ecosystem. This thesis aims to propose a new Framework named ANDROSCANREG (Android Permissions Scan Registry) which incorporates an extensible approach for analyzing Android applications initially based on permissions and deployed in a decentralized and distributed system. The mentioned framework is based on the emerging technology called "Blockchain" whose potential is approved for transparency, availability, security, and reliability without resorting to a central trusted entity. Furthermore, in our efforts to improve the implementation of this Framework, we have proposed a new consensus algorithm called "Proof of Conformity -PoC-" in order to improve the reliability of consensus algorithms whose node weight calculation is based on one (or more) distinctive measurable criterion (stake, power, etc.). This improvement relates to the addition of a new impact factor called "Node Security Metric (NSM)" in the calculation of the node weight. NSM is primarily based on the weight recalculation of each network node based on the security and stability of its respective software and hardware environment. PoC weight recalculation is based on Common Vulnerability Scoring System (CVSS) vulnerabilities, our new approach aims to strengthen the node security index and encourage participants, respecting the recommended security requirements, to take advantage of their proactivity, vigilance, and compliance by increasing their chance of being selected as a Leader (validator) and winning rewards corresponding to the effort deployed. Besides, PoC has been theoretically evaluated via simulation scenarios through which significant results have been obtained showing that our approach ensures more likelihood for the more secure participating nodes to be designated as a validator based on their compliance rates represented by their NSM scores. Moreover, we thought as part of our research axis to equitably reward active participants. Indeed, we have presented a new approach for calculating rewards and penalties for systems based on Blockchain technology. The objective of our proposal is to ensure a new source of income in order to retain participants by guaranteeing them permanent profitability in exchange for their active participation in the stability and security of the Blockchain network to which they belong. We have studied and analyzed existing systems that, in general, favor the monopoly of rewards by attributing them either only to the Leader node (elected by a consensus algorithm) or benefit the Leader from a large part of the rewards and distributing the rest to a shortlist of participants. The result of our study shows that our approach offers more benefits by ensuring permanent, dynamic, and proportional rewards for all participating nodes according to their scores and compliance rate, the latter impacts the gradual penalty system put in place, which verifies the compliance of each node to the Blockchain protocol rules. A new innovative concept of operations execution in a Blockchain network was also proposed in this thesis. Indeed, the new approach improves the traditional data validation processes opted by Blockchain-based systems by allowing their nodes to adopt different and modifiable environments at any time in order to reduce the false positive rate and help identify polymorphic treatments and thus improve the reliability of the final results.