Software-defined wide-area network (SD-WAN) is an emerging and advanced networking platform extending software-defined networking (SDN) across multiple networking domains. Because SD-WAN manages the data plane in the networking domains separated by the public Internet, SDWAN provides a distinct environment and challenges from SDN, including greater risks for the security threats injecting control plane communications from attackers residing outside of the SDN domain. We design and build blockchain-coordinating controllers (BCC) to secure control communications of the SD-WAN controller network formed by the distributed controllers spread across multiple domains. BCC provides resiliency against the security threats in the control plane where an attacker compromises controller communications to manipulate the coordination and the operations of the other controllers. More specifically, BCC provides secure control communications even when up to n controllers’ networking credentials are compromised. BCC is also designed for modularity so that it applies generally across the controller implementations. We prototype BCC using Ethereum and smart contract on CloudLab to validate its effectiveness and efficiency. We experiment on geographically separate nodes on CloudLab and show that BCC achieves the distributed consensus at sub-second level for certificate/key distribution and for network-wide control communication synchronization.
Android mobile devices are a prime target for a huge number of cyber-criminals as they aim to create malware for disrupting and damaging the servers, clients, or networks. Android malware are in the form of malicious apps, that get downloaded on mobile devices via the Play Store or third-party app markets. Such malicious apps pose serious threats like system damage, information leakage, financial loss to user, etc. Thus, predicting which apps contain malicious behavior will help in preventing malware attacks on mobile devices. Identifying Android malware has become a major challenge because of the ever-increasing number of permissions that applications ask for, to enhance the experience of the users. And most of the times, permissions and other features defined in normal and malicious apps are generally the same. In this paper, we aim to detect Android malware using machine learning, deep learning, and natural language processing techniques. To delve into the problem, we use the Android manifest files which provide us with features like permissions which become the basis for detecting Android malware. We have used the concept of information value for ranking permissions. Further, we have proposed a consensus-based blockchain framework for making more concrete predictions as blockchain have high reliability and low cost. The experimental results demonstrate that the proposed model gives the detection accuracy of 95.44% with the Random Forest classifier. This accuracy is achieved with top 45 permissions ranked according to Information Value.
With the evolution of the Internet of Things (IoT), smart cities have become the mainstream of urbanization. IoT networks allow distributed smart devices to collect and process data within smart city infrastructure using an open channel, the Internet. Thus, challenges such as centralization, security, privacy (e.g., performing data poisoning and inference attacks), transparency, scalability, and verifiability limits faster adaptations of smart cities. Motivated by the aforementioned discussions, we present a Privacy-Preserving and Secure Framework (PPSF) for IoT-driven smart cities. The proposed PPSF is based on two key mechanisms: a two-level privacy scheme and an intrusion detection scheme. First, in a two-level privacy scheme, a blockchain module is designed to securely transmit the IoT data and Principal Component Analysis (PCA) technique is applied to transform raw IoT information into a new shape. In the intrusion detection scheme, a Gradient Boosting Anomaly Detector (GBAD) is applied for training and evaluating the proposed two-level privacy scheme based on two IoT network datasets, namely ToN-IoT and BoT-IoT. We also suggest a blockchain-InterPlanetary File System (IPFS) integrated Fog-Cloud architecture to deploy the proposed PPSF framework. Experimental results demonstrate the superiority of the PPSF framework over some recent approaches in blockchain and non-blockchain systems.
TeraFlow proposes a new type of secure, cloud-native Software Defined Networking (SDN) controller that will radically advance the state-of-the-art in beyond 5G networks by introducing novel micro-services architecture, and provide revolutionary features for both flow management (service layer) and optical/microwave network equipment integration (infras-tructure layer) by adapting new data models. TeraFlow will also incorporate security using Machine Learning (ML) and forensic evidence for multi-tenancy based on Distributed Ledgers. Finally, this new SDN controller shall be able to integrate with the current Network Function Virtualization (NFV) and Multi-access Edge Computing (MEC) frameworks as well as to other networks. The target pool of TeraFlow stakeholders expands beyond the traditional telecom operators towards edge and hyperscale cloud providers.
DDoS attacks have plagued the Internet for more than 20 years, and it is becoming even violent with the development of IoT. Therefore, it is an essential defense method to trace back DDoS sources. Traditional IP traceback methods have different limitations in a large storage space, increasing marking cost, and low credibility. To solve these problems, a lightweight DDoS attack blockchain-based tracing scheme (LDBT) is proposed, which can deny malicious traffic access to the LAN. First, to avoid secondary DDoS attacks caused by excessive recording information, a digest method is presented and installed on all routers in the LAN. It is used to transfer a huge number of packets to a fixed format, which can keep the scheme lightweight regardless of whether DDoS occurs or not. Second, we present a trusted fuzzy tracing method that searches for DDoS sources efficiently. Under the proposed scheme, the digest data are reliable owing to the decentralization and immutability of the blockchain platform. It also overcomes the problem that edge routers cannot provide precise detection information because the digest is only used to track. Experimental results show that the scheme searches the sources of malicious traffic with high accuracy, and the communication overhead constantly remains at a low level of 80 KB/s. Furthermore, the tracing time of our scheme increases linearly instead of an exponential growth by the hop count.
Tsuyoshi Taniguchi, Harm Griffioen, Christian Doerr
Malware, like all products and services, evolves with bursts of innovation. These advances usually happen whenever security controls get ''good enough'' to significantly impact the revenue stream of malicious actors, and in the past we have seen the malware ecosystem to adopt concepts such as code obfuscation, polymorphism, domain-generation algorithms (DGAs), as well as virtual machine and sandbox evasion whenever defenses were able to perform consistent and pervasive suppression of these threats.
Swarna Madhuri Pichikala, G Rachana, H Sanjanapatel, Saumya Shanu · 5 authors
Any software or file that we download from the internet has no way to verify if it is legit and does not contain a malware. An anti-virus just uses a centralised database. Building a blockchain solution around this which allows people who download any file from the internet to verify and approve that it is malicious or not is the need of the hour.In recent years, blockchain technology stands as some solution to everything due to its features like decentralization, persistency, anonymity, and auditability. The antivirus softwares detects whether a file is malicious or not and removes whichever file found malicious. These softwares try to be effective as much as their virus database allows them to be. These virus databases usually will have signatures of malicious behaviour. When a file is checked for maliciousness, its signature is checked if it matches or not with any of the existing signatures. If it is, then it is declared malicious and not allowed to download else file is quarantine or sent to lab analysis. Regarding the lab analysis and report, it depends on that particular antivirus software. Whatever can be the method of deciding whether a file is malicious or not but it takes time to analyse it, decide and add that particular file's signature to antivirus software's database within which any person would have downloaded that file. Here is where distributed and decentralized feature of blockchain is used to update the blockchain with the new malicious file's signature. By doing this every node in the network will be able to decide on whether the particular file from internet is malicious or not.
Jose Eduardo A. Sousa, Vinícius Cunha Oliveira, Júlia Almeida Valadares, Alex Borges Vieira · 7 authors
Ethereum is one of the most popular cryptocurrency currently and it has been facing security threats and attacks. As a consequence, Ethereum users may experience long periods to validate transactions. Despite the maintenance on the Ethereum mechanisms, there are still indications that it remains susceptible to a sort of attacks. In this work, we analyze the Ethereum network behavior during an under-priced DoS attack, where malicious users try to perform denial-of-service attacks that exploit flaws in the fee mechanism of this cryptocurrency. We propose the application of machine learning techniques and ensemble methods to detect this attack, using the available transaction attributes. The proposals present notable performance as the Decision Tree models, with AUC-ROC, F-score and recall larger than 0.94, 0.82, and 0.98, respectively.
Abstract Due to using less secured and movable devices in Internet of Things (IoT) platform, cyber‐attacks have been a major issue nowadays. Different researches have been conducted to detect the probable security attacks, but faced constraints like storage, computation cost, system failure and high latency. Existing systems require continuous monitoring, controlling, and collecting the data in entire network for delivering services with the maximum security and defense mechanism against cyber‐attacks. In this context, a decentralized mechanism of security has been presented in this article using a software‐defined network (SDN) integrated with blockchain for IoT in mobile edge and fog computing. The SDN continuously monitors and analyzes the system traffic for providing an attack identification model. The blockchain has been used to overcome the failure issues addressed in the existing models by delivering decentralized attack identification scheme which detects attacks in fog and reduces it in the edge node.
Enclave applications that rely on blockchains for integrity and availability are vulnerable to eclipse attacks. In this paper, we present an approach for reliably detecting extended eclipse attacks, even when the adversary controls all network connectivity. By monitoring changes to the difficulty parameter in Proof-of-Work (PoW) protocols, our algorithm detects suppression of new blocks, as well as difficulty-lowering attacks that attempt to force an enclave client onto a malicious fork mined solely by an attacker. We present analysis that attackers have negligible probability of evading our block monitoring algorithm, and demonstrate its robustness to most historical fluctuations in difficulty on the Ethereum blockchain, resulting in a very low false-positive rate.
While the blockchain technology provides strong cryptographic protection on the ledger and the system operations, the underlying blockchain networking remains vulnerable due to potential threats such as denial of service (DoS), Eclipse, spoofing, and Sybil attacks. Effectively detecting such malicious events should thus be an essential task for securing blockchain networks and services. Due to its importance, several studies investigated anomaly detection in Bitcoin and blockchain networks, but their analyses mainly focused on the blockchain ledger in the application context (e.g., transactions) and targets specific types of attacks (e.g., double-spending, deanonymization, etc). In this study, we present a security mechanism based on the analysis of blockchain network traffic statistics (rather than ledger data) to detect malicious events, through the functions of data collection and anomaly detection. The data collection engine senses the underlying blockchain traffic and generates multi-dimensional data streams in a periodic manner. The anomaly detection engine then detects anomalies from the created data instances based on semi-supervised learning, which is capable of detecting previously unseen patterns, and we introduce our profiling-based detection engine implemented on top of AutoEncoder (AE). Our experimental results support the effectiveness of the presented security mechanism for accurate, online detection of malicious events from blockchain networking traffic data. We also show further reduction in time complexity (up to 66.8% for training and 85.7% for testing), without any performance degradation using feature prioritization compared to the utilization of the entire features.
Cryptocurrencies do not only allow for money transfers in the absence of a trusted third party but also enable the execution of distributed applications. Due to the rapid pace of development of cryptocurrencies, the foundations of such applications have not been rigorously studied. This is particularly problematic since in these applications, real money is at stake, and security breaches regularly cause severe financial losses.In this thesis, we present two systematic approaches to reliably verify the security of distributed blockchain applications based on formal foundations. To this end, we focus on the cryptocurrencies with the highest market capitalization, Bitcoin and Ethereum. In Ethereum, distributed applications are realized as smart contracts, reactive programs written in Ethereum’s expressive scripting language. In contrast, Bitcoin supports only a basic scripting language, and advanced applications are realized as peer-to-peer cryptographic protocols that resort to the execution of simple smart contracts in case of disputes among peers. As a result, the challenge in verifying distributed applications on the Ethereum blockchain lies in the study and abstraction of the semantics of Ethereum’s evolved scripting language, whereas Bitcoin, the study of distributed applications, requires a systematic analysis of the cryptographic protocols.In the thesis, we first formalize the formerly under-specified semantics of Ethereum’s native smart contract language EVM bytecode and implement the semantics in the proof assistant F*. In this context, we formally characterize relevant generic properties for smart contract security, which capture real-world attack scenarios.We then survey existing automated static analyzers for Ethereum smart contracts unveiling the weaknesses in the semantic foundations of these tools and the practical impact of these weaknesses on the analysis results. Based on these findings, we propose our own automatic static analysis tool for Ethereum smart contracts, which comes with a rigorous soundness proof while still showing competitive performance. In this course, we also propose a general framework for the modular and semantic-driven development of automatic static analyzers. Finally, we study the security of payment channel networks for Bitcoin. Payment channel networks are distributed protocols that allow for efficient and cheap payments between Bitcoin users and offer a promising solution to Bitcoin’s scalability problems. We unveil a security issue in Bitcoin’s existing payment channel network implementation and formally characterize the relevant security and privacy notions in this context. We further develop a cryptographic primitive for the construction of payment channel networks with formal security guarantees
The field of Cryptocurrency has seen tremendous growth and expansion in the last few years. Almost a decade ago the invention of Bitcoin marked a new era of innovation in the financial sector. In our literature survey we take you through the concepts of cryptocurrency outlining its fundamental concepts, the underlying technology like Blockchain and subsequently the viability of this new financial asset. Post examining the knowledge of cryptocurrency we try to predict the price of this volatile asset. Post pricing data and the likelihood of these currencies, specifically Bitcoin. We first examine the price of cryptocurrency or rather try to examine the prices before introducing the Cryptocurrency Analyzer and Predictor web application, as discussed in our project. The research, planning methodologies, technologies, and design and evaluation of this application are described in detail in the later part of this paper followed by a concluding word on this process as a whole.
With the prosperous development of blockchain technologies in the past few years, some cybercrimes have emerged in the blockchain ecosystem, such as the phishing scams on Ethereum. To alleviate these security problems, a few anomaly detection frameworks were proposed. Specifically, previous studies usually model the transfer relationship between accounts in the blockchain ecosystem as a transaction network, where nodes represent accounts and edges represent the corresponding transaction records. Inspired by the adversarial attacks on graph data, we believe the robustness of existing detection frameworks still needs to be further verified even though they have achieved good performance. In this paper, a phishing detection framework based on feature learning and a phishing hidden framework based on inserting transaction records are proposed, respectively. Experimental results show the effectiveness of our phishing detection framework and the superiority of the phishing hidden strategies, which indicate that existing phishing detection frameworks are lack of robustness and still need further improvement against malicious attacks.
Bandwidth depletion Denial-of-Service (DoS) attack can impact the propagation of a mined block in the Bitcoin blockchain network. On Bitcoin Proof-of-Work (PoW) consensus several machines try to resolve an expensive cryptographic puzzle faster than anyone else and succeed to mine a valid block. Despite a DoS attack impedes one machine to propagate its mined block allowing it to become valid for most peers, there will be several other peers to resolve the puzzle in time, hence the blockchain will continue to grow. However, from the perspective of the owner of the attacked machine, this can be critical because it will not receive a mining reward. This chapter covers such an attack in the Lisk blockchain that utilizes the Delegated Proof of Stake (DPoS) consensus mechanism. A mitigation strategy was created based on two tools that I have created allowing a delegate account to be configured in more than one node, allowing to forge a block even when one of its nodes is under DoS attack. Also, the transaction flood DoS attack is explored, and a mitigation strategy was created for a specific sidechain in the Lisk ecosystem. The mitigation strategy identifies spam transactions and rejects them to be included on the Lisk nodes transaction pool, hence they will not be propagated into the blockchain. Towards the end, I evaluated scenarios and mitigation strategies created for each attack demonstrating solutions for several scenarios.
Xi He, Ketai He, Shenwen Lin, Jinglin Yang · 5 authors
Abstract Single heuristic method and incomplete heuristic conditions were difficult to cluster a large number of addresses comprehensively and accurately. Therefore, this paper analysed the associations between Bitcoin transactions and addresses and used six heuristic conditions to cluster addresses and entities. We proposed an improved change address detection algorithm and compared it with the original change address algorithm to prove the effectiveness of the improved algorithm. By adding conditional constraints, the identified change address was more accurate, and the convergence speed of the algorithm was accelerated. Our work presented the pseudo‐anonymity mechanism of the Bitcoin system, which could be used by the law enforcement agencies to track and crack down illegal transactions.
Senthilselvi Ayothi, Shiny Duela Johnson, Ramesh Sekaran, Senthil Pandi Sankareshwaran · 6 authors
Abstract Over the last decade, blockchain has been considered an encouraging solution to secure distributed ledgers. Moreover, with the introduction of a pseudonymous payment method without a centralized database or authoritative person, blockchain has also evolved as the future generation for online payment system. However, with the eruption of a large scale database, scalability has also become a demanding issue. In addition to the obstacle mentioned above, challenges like security and scalability stop accelerated adjustments for the development of smart cities. Without directing this essential scalability and privacy issue, such an encouraging method may not help develop smart cities. This paper bestows a measure to analyze both scalability and security aspects of existing blockchain methods with applications of smart city networks. The proposed method is known as Gradient Smart Load Balancer and Blockchain Dempster Shafer Reputation (GSLB-BDSR). Gradient Smart Load Balancer is designed so that even though with the increase in the number of participating sensors, the load is said to balance by applying gradient function, therefore ensuring scalability. Next, to cover the security aspect, with the aid of scalable blocks in the blockchain network, a Blockchain Dempster Shafer Reputation model is proposed. Evaluation outcomes of proposed security solutions outperform conventional solutions.
The security of data propagation is a critical challengefor the widespread use of networked control systems (NCSs), while the conventional strategies based on estimation techniques cannot solve this issue well. Furthermore, the contradiction between the security and the real-time nature of the control method has not been settled yet. The aim of this article is to propose a novel real-time control method empowered by blockchain technologies to resolve the security problems of NCSs under potential cyberattacks. To facilitate the analysis of blockchain-assisted NCSs, a cyber-authentic-physical system (CAPS) framework is proposed. One of the significant features of the CAPS is that the defense of NCSs against attacks is built by introducing a blockchain protocol. Theoretical analysis reveals the relationship among the scale of the peer-to-peer network, the security of the CAPS, and the latency of NCSs, as well as clarifies the impact of the introduction of the blockchain mechanism on the performance of NCSs. With the networked secure control mechanism designed in this article, the security and stability of NCSs can be achieved simultaneously, and their sufficient conditions are also given. Finally, simulations and practical experiments are presented to show the efficacy of the suggested secure control strategy.
A good amount of effort has been dedicated to surveying and systematizing Ethereum smart contract security bug classes. There is, however, a gap in literature when it comes to surveying implementation-level security bugs that commonly occur in basic PoW blockchain node implementations, discovered during the first decade of Bitcoin's existence. This paper attempts to fill this void. In particular, if software which participates in a network by validating and generating new blocks is developed from scratch, WCGW - What Could Go Wrong? Ten broad bug type categories are listed and for each category, known examples are linked. Blockchain, as designed by the Satoshi's paper is exciting and introduces several novel bug classes which are interesting to security researchers. The paper is aimed at security testers aiming to start out in blockchain security reviews and blockchain developers as a reference on common pitfalls.
Nowadays, Bitcoin is the most popular cryptocurrency. With the proliferation of smartphones and the high-speed mobile Internet, more and more users have started accessing their Bitcoin wallets on their smartphones. Users can download and install a variety of Bitcoin wallet applications (e.g., Coinbase, Luno, Bitcoin Wallet) on their smartphones and access their Bitcoin wallets anytime and anywhere. However, it is still unknown whether these Bitcoin wallet smartphone applications are secure or if they are new attack surfaces for adversaries to attack these application users. In this work, we explored the insecurity of the 10 most popular Bitcoin wallet smartphone applications and discovered three security vulnerabilities. By exploiting them, adversaries can launch various attacks including Bitcoin deanonymization, reflection and amplification spamming, and wallet fraud attacks. To address the identified security vulnerabilities, we developed a phone-side Bitcoin Security Rectifier to secure Bitcoin wallet smartphone application users. The developed rectifier does not require any modifications to current wallet applications and is compliant with Bitcoin standards.
Sajjad Asefi, Yash Madhwal, Yury Yanovich, Elena Gryazina
The application of renewable energy sources in the power grid increases the necessity of tracking the system's state, especially in smart grids, where there is a bidirectional transfer of data and power. The complexity of coupling between communication and the electrical infrastructure in a smart grid will create a higher chance for security breach. Increasing the state estimation accuracy will help the smart grid operator efficiently manage the system. The paper proposes an integration of distributed state estimation with a blockchain designed communication platform. Additionally, the asynchronous manner for data transmission, which is more likely to happen in the real world, has been considered as the second task of this research. Finally, a detailed analysis of the blockchain-based application in distributed state estimation is provided. The numerical analysis shows that the proposed method meets real-world performance requirements and brings high security and reliability to the distributed state estimation process.
With the wide application deployment of software defined networks, the security problems faced by software defined networks have become increasingly prominent. Nowadays, the security of SDN is gradually becoming an important factor restricting its development. At the application level, the main security problem faced by SDN lies in the imperfection of application mechanism and authority management; In the control layer, because the controller is the core node of the whole network, its main security problem is the single point failure of the controller. At the data forwarding layer, the main problem is that there is no good guarantee mechanism for the integrity of the flow rule information issued by the controller.[1] As a result, hackers can tamper with the flow table information of the AC machine. Yes, SDN traffic flows according to the attacker's intention, which leads to network function failure. In this paper, the main security problems faced by SDN will be solved from multiple dimensions based on the decentralized, trustworthy and self-willed characteristics of blockchain, which is a distributed database.
Abstract The wireless sensor network (WSN) with fluctuating environs might be susceptible to diverse types of malicious cyber‐attacks, and they are mostly dependent on the authentication and encryption algorithm to astound this challenge. Most predominant routing schemes in literature are fall backs in characterizing the malicious nodes on networks due to the real time variation of routing information. Therefore, a reliable and trustworthy inter‐correlated routing scheme based on Block chain, Meta‐heuristic, and Deep Learning Algorithms are presented in this paper. The disseminated routing info in the WSN is handled by Block chain strategy, in which the optimal routing is accomplished with the help of Salp Swarm Optimization algorithm. The routing info variations between the nodes are envisaged and the optimal routing decisions are done by using the Deep Convolutional Neural network algorithm. The proposed routing scheme is implemented in NS2 and its performance is evaluated based on latency, energy consumption, and throughput metrics are analyzed. The efficiency of the method is improved as 97% and the evaluation is done for the malicious attacks, latency, and the delay. The comparison is made for the existing methods as particle swarm optimization, Markov decision process, security disjoint routing‐based verified message, trusted‐cluster–based routing, and reinforcement learning‐based neural network (RLNN) with the proposed method for the delay ratio.