Blockchain Papers

K. Sahitya Yadav, Smita Naval

No abstract is available for this record.

Wanyi Gu, Guojun Wang, Peiqiang Li, Xubin Li · 7 authors

No abstract is available for this record.

T. Sathya, N Keertika, Sirikonda Shwetha, Deepti Upodhyay · 5 authors

In recent years, ransomware attacks have become a more significant source of computer penetration. Only general-purpose computing systems with sufficient resources have been harmed by ransomware so far. Numerous ransomware prediction strategies have been published, but more practical machine learning ransomware prediction techniques still need to be developed. In order to anticipate ransomware assaults, this study provides a method for obtaining data from artificial intelligence and machine learning systems. A more accurate model for outcome prediction is produced by using the data science methodology. Understanding the data and identifying the variables are essential elements of a successful model. A variety of machine learning algorithms are applied to the pre-processed data, and the accuracy of each technique is compared to determine which approach performed better. Additional performance indicators including recall, accuracy, and f1-score are also taken into account while evaluating the model. It uses machine learning to predict how the ransomware attack would pan out.

Shohei Kakei, Yoshiaki Shiraishi, Shoichi Saito

No abstract is available for this record.

Mohammad Madine, Khaled Salah, Raja Jayaraman, Mohamed Jamal Zemerly

Software licenses are legal agreements of sale and usage among software developers and clients. Such legal agreements are crucial to effectively manage ownership and protect the rights of involved parties. Today’s software licensing mechanisms are mostly centralized and do not address the ever-increasing issues and complexities of modern software that may include multiple licenses, open-source distribution, rewarding other contributors of external software libraries, and utilizing royalty payments for monetization. As a result, developers have lost confidence in the existing software licensing models, and many software projects are failing due to lack of funding and royalty payments. This paper addresses such issues and complexities by proposing a novel decentralized software licensing system based on Non-Fungible Tokens (NFTs) and blockchain. The proposed licensing system is applicable to both commercial and open-source software. We use NFTs as digital tokens that encapsulate software code and their artifacts by minting them as unique valuable assets that allow developers to store and manage them on a blockchain ledger. With NFTs, developers can register and license their code, monetize it on NFT marketplaces, and earn royalties from other software projects that use their code. We present system architecture, relevant sequence diagrams, and develop aggregation algorithms for Ethereum smart contracts with ERC-1155 NFTs. Furthermore, we perform functional validation of our system and analyze the cost of its adoption. We also analyze the security of the solution and show how its applicability can be generalized and extended. We have made our smart contract code and related testing scripts publicly available on GitHub.

Satpal Singh Kushwaha, Sandeep Joshi, Amit Gupta

The technology behind blockchain is quickly becoming one of the most crucial innovations in recent years. The Smart contracts are digital agreements, made in between two untrusted parties. Smart contracts are self-executable small piece of code that gets executed due to some predefined triggering conditions. Smart contracts store cryptocurrencies as their balances and deal in cryptocurrencies on network transactions. Because of this, smart contracts are constantly open to the possibility of being attacked. A single security vulnerability can make the smart contract very much insecure. The immutability property of the blockchain ensures that, once a smart contract has been placed on the blockchain, cannot be modified in any way. So, the smart contract must be analyzed for any kind of security vulnerability before its deployment on the blockchain. Existing analysis approaches detect vulnerabilities with high false positive rates. Our proposed approach analyses the smart contracts using a hybrid combination of pattern matching and symbolic execution, which produces results with a low false positive rate. We have performed a comparative analysis of our proposed approach to prove its efficiency with the existing research approaches on a data set of 453 smart contracts with tagged vulnerabilities.

Satpal Singh Kushwaha, Sandeep Joshi

No abstract is available for this record.

Sthembile Mthethwa

No abstract is available for this record.

Mohamed Amin Hammami, Mariam Lahami, Afef Jmal Maâlej

No abstract is available for this record.

Annabelle Lee, Sri Nikhil Gupta Gourisetti, D. Jonathan Sebastian-Cardenas, Kent Lambert · 15 authors

In recent times, Distributed Ledger Technology (DLT) has gained significant attention for its potential application in the energy sector. Utilizing blockchain and DLT has demonstrated the ability to enhance the resilience of the electric infrastructure, which will support a more flexible infrastructure and advance grid modernization. However, the deployment of these technologies increases the overall attack surface. The MITRE ATT&CK® matrices have been developed to document an adversary’s tactics and techniques based on real-world observations. The MITRE ATT&CK® matrices provide a common taxonomy for offense and defense and have become a valuable conceptual tool across multiple cybersecurity disciplines for conveying threat intelligence, performing testing through red teaming or adversary emulation, and enhancing network and system defenses against intrusions. The MITRE ATT&CK® for Industrial Control Systems (ICS) matrix was created to provide knowledge about adversary behavior in the ICS technology domain. This study analyzes the relevance of various tactics and techniques across a seven-layer DLT engineering and cybersecurity stack, known as the DLT stack, designed by the Cybersecurity Taskforce under IEEE P2418.5 - Standard for Blockchain in Energy working group sponsored by Power and Energy Systems - Smart Buildings, Loads and Customer Systems (PES/SBLC) Technical Committee. Additionally, this paper identifies specific mitigation strategies tailored to the energy ICS environment.

Synim Selimi, Blerim Rexha, Kamer Vishi

The rapid evolution of the Internet, particularly the emergence of Web3, has transformed the ways people interact and share data. Web3, although still not well defined, is thought to be a return to the decentralization of corporations' power over user data. Despite the obsolescence of the idea of building systems to detect and prevent cyber intrusions, this is still a topic of interest. This paper proposes a novel conceptual approach for implementing decentralized collaborative intrusion detection networks (CIDN) through a proof-of-concept. The study employs an analytical and comparative methodology, examining the synergy between cutting-edge Web3 technologies and information security. The proposed model incorporates blockchain concepts, cyber non-fungible token (cyberNFT) rewards, machine learning algorithms, and publish/subscribe architectures. Finally, the paper discusses the strengths and limitations of the proposed system, offering insights into the potential of decentralized cybersecurity models.

Guangxia Xu, Lei Liu, Jingnan Dong

In recent years, with the great success of pre-trained language models, the pre-trained BERT model has been gradually applied to the field of source code understanding. However, the time cost of training a language model from... | Find, read and cite all the research you need on Tech Science Press

Rita Melo, Pedro Pinto, António Pinto

No abstract is available for this record.

Zhenguang Liu, Peng Qian, Jiaxu Yang, Lingfeng Liu · 7 authors

Blockchain smart contracts have given rise to a variety of interesting and compelling applications and emerged as a revolutionary force for the Internet. Smart contracts from various fields now hold over one trillion dollars worth of virtual coins, attracting numerous attacks. Quite a few practitioners have devoted themselves to developing tools for detecting bugs in smart contracts. One line of efforts revolve around static analysis techniques, which heavily suffer from high false positive rates. Another line of works concentrate on fuzzing techniques. Unfortunately, current fuzzing approaches for smart contracts tend to conduct fuzzing starting from the initial state of the contract, which expends too much energy revolving around the initial state of the contract and thus is usually unable to unearth bugs triggered by other states. Moreover, most existing methods treat each branch equally, failing to take care of the branches that are rare or more likely to possess bugs. This might lead to resources wasted on normal branches. In this paper, we try to tackle these challenges from three aspects: 1) generating function invocation sequences, we explicitly consider data dependencies between functions to facilitate exploring richer states. We further prolong a function invocation sequence$\mathcal {S}_{1}$by appending a new sequence$\mathcal {S}_{2}$, so that the appended sequence$\mathcal {S}_{2}$can start fuzzing from states that are different from the initial state; 2) we incorporate a branch distance-based measure to evolve test cases iteratively towards a target branch; 3) we engage a branch search algorithm to discover rare and vulnerable branches, and design an energy allocation mechanism to take care of exercising these crucial branches. We implement IR-Fuzz and extensively evaluate it over 12K real-world contracts. Empirical results show that: (i) IR-Fuzz achieves 28% higher branch coverage than state-of-the-art fuzzing approaches, (ii) IR-Fuzz detects more vulnerabilities and increases the average accuracy of vulnerability detection by 7% over current methods, and (iii) IR-Fuzz is fast, generating an average of 350 test cases per second. Our implementation and dataset are released athttps://github.com/Messi-Q/IR-Fuzz, hoping to facilitate future research.

Aniruddha Chatterjee, Sanah Sidhu, R. Jebakumar

The right to vote is one of the fundamental tenets upon which democracies are built. The voting process has several difficulties in the modern day due to the prevalence of digital technology. By developing a prototype application that makes use of the idea of a ledger-based data store on a blockchain and a graph database, the purpose of this paper is to search for a workable answer to the problems of security, accessibility, and transparency in the electoral process, in an effort to identify an answer that is best suited and adaptable on a large scale. A distributed ledger uses linked nodes to store data in such a way that once a block is written, it cannot be modified on the chain without compromising the chain's integrity and the trust that users have placed in it. This property of blockchain is utilised by us in developing a secure data store for the application.

Wuqi Zhang, Lili Wei, Shing-Chi Cheung, Yepang Liu · 7 authors

Front-running attacks have been a major concern on the blockchain. Attackers launch front-running attacks by inserting additional transactions before upcoming victim transactions to manipulate victim transaction executions and make profits. Recent studies have shown that front-running attacks are prevalent on the Ethereum blockchain and have caused millions of US dollars loss. It is the vulnerabilities in smart contracts, which are blockchain programs invoked by transactions, that enable the front-running attack opportunities. Although techniques to detect front-running vulnerabilities have been proposed, their performance on real-world vulnerable contracts is unclear. There is no large-scale benchmark based on real attacks to evaluate their capabilities. We make four contributions in this paper. First, we design an effective algorithm to mine real-world attacks in the blockchain history. The evaluation shows that our mining algorithm is more effective and comprehensive, achieving higher recall in finding real attacks than the previous study. Second, we propose an automated and scalable vulnerability localization approach to localize code snippets in smart contracts that enable front-running attacks. The evaluation also shows that our localization approaches are effective in achieving higher precision in pinpointing vulnerabilities compared to the baseline technique. Third, we build a benchmark consisting of 513 real-world attacks with vulnerable code labeled in 235 distinct smart contracts, which is useful to help understand the nature of front-running attacks, vulnerabilities in smart contracts, and evaluate vulnerability detection techniques. Last but not least, we conduct an empirical evaluation of seven state-of-the-art vulnerability detection techniques on our benchmark. The evaluation experiment reveals the inadequacy of existing techniques in detecting front-running vulnerabilities, with a low recall of$\leq$6.04%. Our further analysis identifies four common limitations in existing techniques: lack of support for inter-contract analysis, inefficient constraint solving for cryptographic operations, improper vulnerability patterns, and lack of token support.

Gaurav Sharma, Deepak Kumar Sharma, Adarsh Kumar

The Internet of Things is an essential component in the growth of an ecosystem that enables quick and precise judgments to be made for communication on the battleground. The usage of the battlefield of things (BoT) is, however, subject to several restrictions for a variety of reasons. There is a potential for instances of replay, data manipulation, breaches of privacy, and other similar occurrences. As a direct result of this, the implementation of a security mechanism to protect the communication that occurs within BoT has turned into an absolute requirement. To this aim, we propose a blockchain-based solution that is both safe and private for use in communications inside the BoT ecosystem. In addition, research is conducted on the benefits of integrating blockchain technology and cybersecurity into BoT application implementations. This work elaborates on the importance of integrating cybersecurity and blockchain-based tools, techniques and methodologies for BoT.

Hala Strohmier Berry

Cryptocurrencies characteristics facilitated ran-somware attacks extorting payments in the form of Bitcoin, Mon-ero, Ethereum and others from individuals and organizations. The open cyber boarders allowed anyone to own cryptocurrency without revealing their identities. This research investigates the role of cryptocurrency in the increase of cyber attacks and creating the new phenomenon of crypto-ransomware and answer two fundamental questions: (1) Is there a correlation between the increase use of cryptocurrency and the spread of cyber attacks? And (2) Would ransomware attacks exist if cryptocurrency did not exist?.

Ahlam Fakieh, Aymen Akremi

Social engineering (SE) attacks (also called social hacking) refer to various methods used by cybercriminals to exploit the weak nature of human beings rather than the logical and physical security measures used by organizations. This research paper studies the various methods of SE used by criminals to exploit the psychological vulnerabilities of human beings. On this basis, the paper proposes a new defense categorization of SE attacks based on two security principles: dual control (i.e., more than one entity to complete the task) and split knowledge (i.e., dual controlling of the knowledge to complete the task). We describe how those measures could stop SE attacks and avoid human weaknesses. Then, we propose an original new SE defense model that implements the security principles using blockchain technology to both dual control the transactions and record them safely for organizations. The proposed model’s first aim is to avoid the dependence on the cognitive or psychological status of the victim and enable more verification steps to be taken in a fast and flexible manner. The paper demonstrates the quick and easy adoption of the existing private blockchain platform to implement the proposed SE defense model.

Yao Yao, Hui Li, Yang Xin, Yiwang Le

Smart contracts emerged as programs running on the blockchain. Security is one of the major concerns against smart contracts which also exist various vulnerabilities as for any other traditional programs. What was worse, security vulnerabilities in smart contracts may lead to irreversible economic losses. Hence, there is an apparent demand for security audits of contracts before deployment. In recent years, a large number of smart contract vulnerability detection tools have emerged. The methods used by these tools include formal verification, symbolic execution, machine learning, and fuzz testing. These methods can well analyze vulnerabilities, but there are still limitations. In this paper, we optimized and extended the Mythril symbolic execution tool. The optimized pruning algorithm improves the speed of symbolic execution, while the proposed detection algorithm for Transaction Order Dependence vulnerability expands the range of detecting vulnerability. In addition, a machine learning vulnerability detection model is introduced as an auxiliary detection method, which is used to build the complete smart contract vulnerability detection system. The experimental results show that the proposed system reduces the execution time, and improves the accuracy as well as the recall of vulnerability detection compared with the original Mythril tool.

Zhiju Yang, Gaoyuan Man, Songqing Yue

Hacks on blockchains are prevalent nowadays because a wide range of vulnerabilities exists in smart contracts. To deal with the vulnerabilities, security auditing has been emerging and widely adopted for manual code inspection. However, little is known about how manual security auditing impacts the blockchain community. In this work, we investigated security audits on blockchain by answering three research questions covering the type, severity, and resolve status of issues in the audit reports. We in total collected 2,421 security audit reports consisting of the details of 28,782 security issues. We found that manual security auditing has superior merit over static analysis tools in identifying logic-related issues, considering 27.65% of all findings are logical issues. We also found that 87.28% of 2,421 projects have at least one centralization issue that breaks the decentralization primitive of blockchain. Moreover, while 21.17% of issues are of major or critical severity, we surprisingly found that 61.83% of all issues were unresolved or partially resolved. We concluded that while manual security auditing can help identify security vulnerabilities uniquely, project developers need to take serious actions to address and secure their smart contracts.

Gang Tian, Xiaojin Wang, Hongjuan Yang, Rui Wang

The classification of the smart contract can effectively reduce the search space and improve retrieval efficiency. The existing classification methods are based on natural language processing technologies. Because the processing of source code by these technologies lacks extraction and processing in the software engineering field, there is still a lot of room for improvement in their methods of feature extraction. Therefore, this paper proposes a multi-feature fusion method for smart contract classification (MFF-SC) based on the code processing technology. From the source code perspective, source code processing method and attention mechanism are used to extract local code features. Structure-based traversal method are used to extract global code features from abstract syntax tree. Local and global code features introduce attention mechanism to generate code semantic features. From the perspective of account transaction, the feature of account transaction is extracted by using TransR. Next, the code semantic features and account transaction features generate smart contract semantic features by an attention mechanism. Finally, the smart contract semantic features are fed into a stacked denoising autoencoder and a softmax classifier for classification. Compared with other baselines and variants, experimental results on a real-world dataset show that MFF-SC achieves an accuracy rate of 83.9%.

Kuldeep Gupta, Niraj Kumar Srivastava

Cryptocurrencies are the new emerging and important financial software systems. Digital forms of money are advanced monetary standards that depend on cryptographic monetary forms. Clients can't track down the entire information in one place and every other website shows some different stats which mislead the user to invest in the correct time and do some good investments. The investor is not getting the proper stats for a long period of time. In Cryptophyle we are fetching the data from multiple resources of cryptocurrency news and track some of the latest cryptocurrencies. Our website will give the In-depth information about the crypto world. Cryptophyle will keep you updated with the latest news and the latest data of the crypto world to make beneficial transactions and take more advantages from the app. It also provides past data which makes investors analyze the data and make success in their investments. The growth and ubiquity of exchanging in this new market are rapidly increasing due to the invention of digital kinds of money. Due to these resources' high degree of volatility, it is important to comprehend and forecast their price in a constantly shifting market.

Huma Jamshed, Ansha Zahid, Rizwan Ul Hassan, Ahmad Hussain · 5 authors

Trustworthy smart contracts is usually challenging due to the multifaceted semantics of essential domain-specific languages and their testability. A vulnerability in smart contracts possibly comprises numerous code-security and may allow an attacker to gain control of a system resulting in financial tribulations. Therefore, it is very essential to design safe and secure smart contracts in blockchain’s immutable environment by applying numerous techniques for assessing flaws before deployment. Application programmers building smart contracts must test their code for vulnerabilities. Security and privacy is top in the list. The objective of this research is to explore: 1) the emerging landscape of smart contracts, 2) identifies the vulnerabilities faced by the developers and 3) What tools are available to address these issues? Our study showed: 1) comprehensive realistic studies in the smart contract security are at present lagging as related to primary studies. 2) 73% of contracts implemented in Solidity had security vulnerabilities. 3) Poor programming technique and 4) Slack programming activity.