Cyber Threat Intelligence (CTI) is the knowledge of cyber and physical threats that help mitigate potential cyber attacks. The rapid evolution of the current threat landscape has seen many organisations share CTI to strengthen their security posture for mutual benefit. However, in many cases, CTI data contains attributes (e.g., software versions) that have the potential to leak sensitive information or cause reputational damage to the sharing organisation. While current approaches allow restricting CTI sharing to trusted organisations, they lack solutions where the shared data can be verified and disseminated `differentially' (i.e., selective information sharing) with policies and metrics flexibly defined by an organisation. In this paper, we propose a blockchain-based CTI sharing framework that allows organisations to share sensitive CTI data in a trusted, verifiable and differential manner. We discuss the limitations associated with existing approaches and highlight the advantages of the proposed CTI sharing framework. We further present a detailed proof of concept using the Ethereum blockchain network. Our experimental results show that the proposed framework can facilitate the exchange of CTI without creating significant additional overheads.
Blockchain, the latest distributed ledger technology, has brought paradigmatic shift to the mode of transaction and communication recently. None of the arenas/sectors/organisations is untouched of the technology globally. Recently, the appliance of the distributed ledger technology into digital currency astonished the global community. The applications, apprehension, risks and prospective of technology, thus, have been analysed periodically. In this article, the authors try to understand the potential scope, complexity and legal dynamics of blockchain in the Indian scenario, intermittently. The basic sources such as reports and documents of NITI Aayog, Working Paper of Ministry of Information and Technology as well as reports of Finance Ministry are taken to start with. Moreover, guidelines and press-releases of the Reserve Bank of India, various judgements of the Indian Supreme Court and Ministers’ statements in the Indian Parliament and various initiatives of states have also been taken as references to critically comprehend the convolution of blockchain in the Indian context.
Cross-Chain bridges have become the most popular solution to support asset interoperability between heterogeneous blockchains. However, while providing efficient and flexible cross-chain asset transfer, the complex workflow involving both on-chain smart contracts and off-chain programs causes emerging security issues. In the past year, there have been more than ten severe attacks against cross-chain bridges, causing billions of loss. With few studies focusing on the security of cross-chain bridges, the community still lacks the knowledge and tools to mitigate this significant threat. To bridge the gap, we conduct the first study on the security of cross-chain bridges. We document three new classes of security bugs and propose a set of security properties and patterns to characterize them. Based on those patterns, we design Xscope, an automatic tool to find security violations in cross-chain bridges and detect real-world attacks. We evaluate Xscope on four popular cross-chain bridges. It successfully detects all known attacks and finds suspicious attacks unreported before. A video of Xscope is available at https://youtu.be/vMRO_qOqtXY.
The core of many cryptocurrencies is the decentralised validation network operating on proof-of-work technology. In these systems, validation is done by so-called miners who can digitally sign blocks once they solve a computationally-hard problem. Conventional wisdom generally considers this protocol as secure and stable as miners are incentivised to follow the behaviour of the majority. However, whether some strategic mining behaviours occur in practice is still a major concern. In this paper we target this question by focusing on a security threat: a selfish mining attack in which malicious miners deviate from protocol by not immediately revealing their newly mined blocks. We propose a statistical test to analyse each miner's behaviour in five popular cryptocurrencies: Bitcoin, Litecoin, Monacoin, Ethereum and Bitcoin Cash. Our method is based on the realisation that selfish mining behaviour will cause identifiable anomalies in the statistics of miner's successive blocks discovery. Secondly, we apply heuristics-based address clustering to improve the detectability of this kind of behaviour. We find a marked presence of abnormal miners in Monacoin and Bitcoin Cash, and, to a lesser extent, in Ethereum. Finally, we extend our method to detect coordinated selfish mining attacks, finding mining cartels in Monacoin where miners might secretly share information about newly mined blocks in advance. Our analysis contributes to the research on security in cryptocurrency systems by providing the first empirical evidence that the aforementioned strategic mining behaviours do take place in practice.
Nowadays, with the massive development of technologies, documents are usually made, modified and published digitally. Unlike paper documents, digital documents are easily falsified, and it is difficult to verify the authenticity of these advanced documents in effective and fast ways. Mushaf Al-Quran is one of the most sensitive digital documents that deserves to be preserved due to the divine messages it carries. There is no way to maintain an immutable document, as today's blockchain technology has proven. Therefore, to take advantage of blockchain technology, this article presents a decentralized web application (dApp) to authenticate and verify the digital Mushaf based on smart contracts and the Ethereum network. The results show the efficiency of the blockchain technology in preserving immutable documents and its effectiveness in protecting and proving the authenticity of the digital Mushaf Al-Quran.
Qihao Zhou, Kan Zheng, Kuan Zhang, Lu Hou · 5 authors
With the emergence of Blockchain-based Internet of Things (BIoT) applications, smart contracts have become one of the most appealing aspects because they reduce the cost and complexity of distributed administration. However, the immaturity of smart contracts may result in significant financial losses or the leakage of sensitive information. This article first investigates the taxonomy of security issues associated with smart contracts considering BIoT scenarios. To address these security concerns and overcome the limitations of existing methods, a tree-based machine learning vulnerability detection (TMLVD) method is proposed to perform the vulnerability analysis of smart contracts. TMLVD feeds the intermediate representations of smart contracts derived from abstract syntax trees (AST) into a tree-based training network for building the prediction model. Multidimensional features are captured by this model to identify smart contracts as vulnerable. The detection phase can be implemented quickly with limited computing resources and the accuracy of the detection results is guaranteed. The experimental evaluation demonstrated the effectiveness and efficiency of TMLVD on a data set comprised of Ethereum smart contracts.
Blockchain's technological characteristics, such as decentralization, robustness, and anti-modification, represent a significant challenge to the regulation of existing networks and data security. Effective regulation of blockchain applications is one of the keys to maintain the healthy and sustainable development of the blockchain ecology. We analyze the merits and demerits of the existing technologies in the research directions of tracking and visualization of blockchain nodes, consortium blockchain penetration regulation technology, public chain active discovery and exploration disposition techniques, and chain governance. In the end, we present the future research directions in respect of blockchain traceability and compliance regulation.
Aug 1, 2022·2022 IEEE International Conferences on Internet of Things (iThings) and IEEE Green Computing & Communications (GreenCom) and IEEE Cyber, Physical & Social Computing (CPSCom) and IEEE Smart Data (SmartData) and IEEE Congress on Cybermatics (Cybermatics)
Zhirong Zhu, Jianzhong Su, Zigui Jiang, Mingxi Ye · 5 authors
Nowadays, as an emerging and powerful technology, smart contract supports decentralized trusted computing and is widely used in various business fields such as finance, exchange and game. Although smart contracts provide a convenient way to manage funds in the business, they also bring economic loss to users. Particularly, there are a huge number of malicious smart contracts running on blockchain, which defraud users of money. Therefore, identifying the intention of smart contracts is of great significance, which will help users have a better understanding of smart contracts and reduce their financial losses. In this paper, we purpose a supervised classification method to detect the intention of smart contracts. Specifically, we extract the features of smart contracts from codes and transactions, and then use XGBoost to classify smart contracts. We conduct extensive experiments on on-chain smart contracts. The experimental results demonstrate that our features and model are capable of effectively identifying the types of smart contracts.
Blockchain is making a big impact in various applications, but it is also attracting a variety of cybercrimes. In blockchain, phishing transfers the victim’s virtual currency to make huge profits through fraud, which poses a threat to the blockchain ecosystem. To avoid greater losses, Ethereum, one of the blockchain platforms, can provide information to detect phishing fraud. In this study, to effectively detect phishing nodes, we propose a phishing node detection approach as message passing based graph convolution network. We first form a transaction network through the transaction records of Ethereum and then extract the information of nodes effectively via message passing. Finally, we use a graph convolution network to classify the normal and phishing nodes. Experiments show that our method is effective and superior to other existing methods.
Ningyu He, Haoyu Wang, Lei Wu, Xiapu Luo · 6 authors
EOSIO, as one of the most representative blockchain 3.0 platforms, involves lots of new features, e.g., delegated proof of stake consensus algorithm and updatable smart contracts, enabling a much higher transaction per second and the prosperous decentralized applications (DApps) ecosystem. According to the statistics, it has reached nearly 18 billion USD, taking the third place of the whole cryptocurrency market, following Bitcoin and Ethereum. Loopholes, however, are hiding in the shadows. EOSBet, a famous gambling DApp, was attacked twice within a month and lost more than 1 million USD. No existing work has surveyed the EOSIO from a security researcher perspective. To fill this gap, in this paper, we collected all occurred attack events against EOSIO, and systematically studied their root causes, i.e., vulnerabilities lurked in all relying components for EOSIO, as well as the corresponding attacks and mitigations. We also summarized some best practices for DApp developers, EOSIO official team, and security researchers for future directions.
U ovom radu predstavljeno je potencijalno rešenje za decentralizovanu aplikaciju za sportsku kladionicu u okviru Ethereum blockchain mreže. Objašnjenje su teorijske osnove i navedeni izazovi koji se susreću u ovom domenu. Opisane su terminologije vezane za ovu decentralizovanu aplikaciju kao što su blockchain tehnologija, Ethereum blockchain, koncept pametnih ugovora, Oracle entiteti i Solidity jezik. Na kraju je prikazan model i opis implementacije sistema, kao i završna zaključena zapažanja.
Xintong Ling, Pengcheng Chen, Yuwei Le, Jiaheng Wang · 5 authors
Clients, service providers (SPs), and manufacturers lay the foundation for 6G networking, and thus the direct relationships between them are abstracted as the trust triangle of telecommunications. As one component among three, manufacturers are facing considerable criticism from SPs and clients regarding cybersecurity and privacy, which compromises the whole trust triangle. Therefore, we aim to develop a block-chain-based framework to rebuild and maintain the trust triangle in this study. The introduction of blockchain sheds light on building a decentralized digital forensics model for the trust triangle. After analyzing the potential threats and vulnerabilities, we first design the Blockchain-based Network Hawkeye Function (BNHF) to provide an open and privacy-preserving way for clients watching SPs, SPs monitoring manufacturers, and manufacturers proving themselves trustworthy. We offer a practical BNHF solution compatible with 5G and envision its evolution for 6G. Furthermore, we propose two BNHF-aided mechanisms in clients' interests to help construct a complete trust triangle. Comprehensive test results under experimental networking setups illustrate the effectiveness of the proposed framework.
In recent years, cryptocurrencies have increasingly been used in cybercrime and have become the key means of payment in darknet marketplaces, partly due to their alleged anonymity. Furthermore, the research attacking the anonymity of even those cryptocurrencies that claim to offer anonymity by design is growing and is being applied by law enforcement agencies in the fight against cybercrime. Their investigative measures require a certain degree of suspicion and it is unclear whether findings resulting from attacks on cryptocurrencies’ anonymity can indeed establish that required degree of suspicion. The reason for this is that these attacks are partly based upon uncertain assumptions which are often not properly addressed in the corresponding papers. To close this gap, we extract the assumptions in papers that are attacking Bitcoin, Monero and Zcash, major cryptocurrencies used in darknet markets which have also received the most attention from researchers. We develop a taxonomy to capture the different nature of those assumptions in order to help investigators to better assess whether the required degree of suspicion for specific investigative measures could be established. We found that assumptions based on user behaviour are in general the most unreliable and thus any findings of attacks based on them might not allow for intense investigative measures such as pre-trial detention. We hope to raise awareness of the problem so that in the future there will be fewer unlawful investigations based upon uncertain assumptions and thus fewer human rights violations.
Jinho Choi, Jaehan KIM, Minkyoo Song, Hanna KIM · 8 authors
Cryptocurrency abuse has become a critical problem. Due to the anonymous nature of cryptocurrency, criminals commonly adopt cryptocurrency for trading drugs and deceiving people without revealing their identities. Despite its significance and severity, only few works have studied how cryptocurrency has been abused in the real world, and they only provide some limited measurement results. Thus, to provide a more in-depth understanding on the cryptocurrency abuse cases, we present a large-scale analysis on various Bitcoin abuse types using 200,507 real-world reports collected by victims from 214 countries. We scrutinize observable abuse trends, which are closely related to real-world incidents, to understand the causality of the abuses. Furthermore, we investigate the semantics of various cryptocurrency abuse types to show that several abuse types overlap in meaning and to provide valuable insight into the public dataset. In addition, we delve into abuse channels to identify which widely-known platforms can be maliciously deployed by abusers following the COVID-19 pandemic outbreak. Consequently, we demonstrate the polarization property of Bitcoin addresses practically utilized on transactions, and confirm the possible usage of public report data for providing clues to track cyber threats. We expect that this research on Bitcoin abuse can empirically reach victims more effectively than cybercrime, which is subject to professional investigation.
This study looks into the current, and potential uses of Blockchain technology in business, specifically in security system of enterprise. The goal of this study is to use modern blockchain technology to address the problem of enhancing the degree of cybersecurity in huge corporations. Enterprises that have seen examples of cyber fraud perpetrated not only by hackers but also by business personnel have evaluated the urgency of the matter. The authors have developed a blockchain-based system dynamic model of the company's cybersecurity system. The use of this modeling tool enables the creation of a computer model of a complicated cybersecurity system, which can then be used to design the suggested update more effectively. We show how Blockchain affects auditing in a variety of ways that will fundamentally alter the profession. We also believe that blockchain technology should be integrated into other parts of cybersecurity, including auditing and general accounting operations. The findings have allowed researchers to draw conclusions about the increased system response in cases of employee fraud in the context of a company's automated information system that uses blockchain technology.
Social media has transformed the mode of communication globally by providing an extensive system for exchanging ideas, initiating business contracts, and proposing new professional ideas. However, there are many limitations to the use of social media, such as misinformation, lack of effective content moderation, digital piracy, data breaches, identity fraud, and fake news. In order to address these limitations, several studies have introduced the application of Blockchain technology in social media. Blockchains can provides transparency, traceability, tamper-proofing, confidentiality, security, information control, and supervision. This paper is a systematic literature review of papers covering the application of Blockchain technology in social media. To the best of our knowledge, this is the first systematic literature review that elucidates the combination of Blockchain and social media. Using several electronic databases, 42 related papers were reviewed. Our findings show that previous studies on the applications of Blockchain in social media are focused mainly on blocking fake news and enhancing data privacy. Research in this domain began in 2017. This review additionally discusses several challenges in applying Blockchain technologies in social media contexts, and proposes alternative ideas for future implementation and research.
Bitcoin plays a major role in digital online transactions with decentralized scattered Peer-to-Peer systems. Cryptocurrency framework permits individuals to exchange with proxy addresses in Fraternize services. Nowadays, Bitcoin users have been increasing rapidly due to various Fraternize services. Due to this, some illicit activities were happening by creating unknown addresses. We surveyed machine learning algorithms like Decision Tree and Random Forest to classify illicit transactions in the Bitcoin network which helps to improve True Positive rate (TPR), and also reviewed various Fraternize services to identify proxy addresses and trace the ownership of Bitcoin transactions. Furthermore, examines the challenges of tracing the proxy addresses in the Bitcoin ecosystem after fund transaction. For further implementation, Bitcoin Transaction Datasets were acquired from Kaggle.
With countless devices connected to the Internet of Things, trust mechanisms are especially important. IoT devices are more deeply embedded in the privacy of people's lives, and their security issues cannot be ignored. Smart contracts backed by blockchain technology have the potential to solve these problems. Therefore, the security of smart contracts cannot be ignored. We propose a flexible and systematic hybrid model, which we call the Serial-Parallel Convolutional Bidirectional Gated Recurrent Network Model incorporating Ensemble Classifiers (SPCBIG-EC). The model showed excellent performance benefits in smart contract vulnerability detection. In addition, we propose a serial-parallel convolution (SPCNN) suitable for our hybrid model. It can extract features from the input sequence for multivariate combinations while retaining temporal structure and location information. The Ensemble Classifier is used in the classification phase of the model to enhance its robustness. In addition, we focused on six typical smart contract vulnerabilities and constructed two datasets, CESC and UCESC, for multi-task vulnerability detection in our experiments. Numerous experiments showed that SPCBIG-EC is better than most existing methods. It is worth mentioning that SPCBIG-EC can achieve F1-scores of 96.74%, 91.62%, and 95.00% for reentrancy, timestamp dependency, and infinite loop vulnerability detection.
Newton Chinyamunjiko, Forbes Makudza, Lucia Mandongwe
Abstract: Purpose: The study sought to uncover the effect of blockchain digital ledger technology (BCDLT) on financial crimes. The study was driven by the need to promote blockchain technology in a bid to enhance financial sanity through elimination of financial delinquency. Research methodology: The study followed a quantitative paradigm using an explanatory research design. The study targeted financial executives, senior staff members at the Zimbabwe stock exchange, bankers and officials from the financial regulators. Data was collected using a structured questionnaire. Results: The study found out that of the four independent BCDLT antecedents, manual audit costs were insignificant, whereas the other three had strong positive associations with financial crime reduction. Limitations: The study targeted a specific group of financiers; hence the results may not be universal to other excluded categories Contribution: The study significantly guides policy formulation and laws in line with the adoption of the blockchain technology in the global financial system to guard against the possibility of new forms of financial crimes that could emanate from the use of technology. Keywords: 1. Blockchain digital ledger technology 2. Financial crime 3. Financial performance