In many machine learning scenarios, training occurs outside the control of the model sponsor or the entity using the model. A growing concern in such settings revolves around model poisoning and data poisoning-how training is conducted and which data contributes to the process. This paper introduces a protective scheme against model and data poisoning attacks. Leveraging cryptographic primitives such as hashes, signature schemes, and zero-knowledge proofs, the scheme ensures the integrity of the training process. Hashing maintains the continuity of data from authenticated sensors, while signatures validate the data. In the end, zero-knowledge proofs verify the correct model computation by the entity carrying out the training process. By adopting this approach, model sponsors can securely delegate training tasks, guaranteeing the authenticity of the results. Implementation and testing demonstrate the scheme's feasibility, effectively countering data and model poisoning threats.
The Industrial Internet of Things (IIoT) refers to a structure where multiple devices and sensors communicate with each other over a network. As the number of internet-connected devices increases, so does the number of attacks on these devices. Therefore, it has become important to secure the data and prevent potential threats to the data in factories or workplaces. In this study, a deep learning-based architecture was used to determine whether the data collected from IIoT sensors was under attack by looking at network traffic. The data that was not exposed to attacks was stored on the Ethereum Blockchain network. The Ethereum blockchain network ensured that sensor data was stored securely without relying on any central authority and prevented data loss in case of any attack. Thanks to the communication process over the blockchain network, updating and sharing data was facilitated. The proposed deep learning-based intrusion detection system separated normal and anomaly data with 100% accuracy. The anomaly data were identified with an average of 95% accuracy for which attack type they belonged to. The data that was not exposed to attacks was processed on the blockchain network, and an alert system was implemented for the detected attack data. This study presents a method that companies can use to secure IIoT sensor data.
This publication focuses on the use of the artificial intelligence for detecting anomalies, especially in the blockchain network. The research methodology includes the selection of anomalies to be detected and the processing of blockchain data. Various artificial intelligence methods were implemented for anomaly detection as part of the tests, and one new solution—a Fuzzy Neural Network—was presented. The findings indicate the possibility of detecting selected anomalies in the blockchain using artificial intelligence, which is of significant importance for the security of this technology. The conclusions present a discussion on limitations, future research prospects, and guidelines for future work.
Jimmy Cheung, Smruthi Rangarajan, Amelia Maddocks, Rohitash Chandra
Uncertainty quantification is crucial in time series prediction, and quantile regression offers a valuable mechanism for uncertainty quantification which is useful for extreme value forecasting. Although deep learning models have been prominent in multi-step ahead prediction, the development and evaluation of quantile deep learning models have been limited. We present a novel quantile regression deep learning framework for multi-step time series prediction. In this way, we elevate the capabilities of deep learning models by incorporating quantile regression, thus providing a more nuanced understanding of predictive values. We provide an implementation of prominent deep learning models for multi-step ahead time series prediction and evaluate their performance under high volatility and extreme conditions. We include multivariate and univariate modelling, strategies and provide a comparison with conventional deep learning models from the literature. Our models are tested on two cryptocurrencies: Bitcoin and Ethereum, using daily close-price data and selected benchmark time series datasets. The results show that integrating a quantile loss function with deep learning provides additional predictions for selected quantiles without a loss in the prediction accuracy when compared to the literature. Our quantile model has the ability to handle volatility more effectively and provides additional information for decision-making and uncertainty quantification through the use of quantiles when compared to conventional deep learning models.
The proposed work builds upon the Random Forest machine learning algorithm to improve the process of digit forensic investigation in case of NFT. The following structure of this framework is aimed at identifying and disabling fraudulent or suspicious activities in NFT transactions by comparing different parameters like the Detection Time, False Positive Rate, the Total Transaction Volume Analyzed, the Anomalous Transaction Ratio, Clustering Accuracy, Data Utilization Efficiency, and Detection Sensitivity. Through using Random Forest, a solid ensemble learning technique that is well known for its on high accuracy as well as off overfitting tendency, it optimistically improves the identifying abilities of the framework in isolation of the false positives. The ability of the proposed system to deliver optimal results is further explained by line plots, area charts, histograms, and stem plots which all provide the variation of these metrics as the time proceeds. Not only does it enhance the effectiveness of detecting the fraudulent transactions, but it also enhances the application of data in the forensic analysis that creates a great advantage in the increasing realm of digital assets for investigators.
Mimouna Abdullah Alkhonaini, Manal Abdullah Alohali, Mohammed Aljebreen, Majdy M. Eltahir · 8 authors
Intrusion detection in the Internet of Things (IoTs) is a vital unit of IoT safety. IoT devices face diverse kinds of attacks, and intrusion detection systems (IDSs) play a significant role in detecting and responding to these threats. A typical IDS solution can be utilized from the IoT networks for monitoring traffic, device behaviour, and system logs for signs of intrusion or abnormal movement. Deep learning (DL) approaches are exposed to promise in enhancing the accuracy and effectiveness of IDS for IoT devices. Blockchain (BC) aided intrusion detection from IoT platforms provides many benefits, including better data integrity, transparency, and resistance to tampering. This paper projects a novel sandpiper optimizer with hybrid deep learning-based intrusion detection (SPOHDL-ID) from the BC-assisted IoT platform. The key contribution of the SPOHDL-ID model is to accomplish security via the intrusion detection and classification process from the IoT platform. In this case, the BC technology can be used for a secure data-sharing process. In the presented SPOHDL-ID technique, the selection of features from the network traffic data takes place using the SPO model. Besides, the SPOHDL-ID technique employs the HDL model for intrusion detection, which involves the design of a convolutional neural network with a stacked autoencoder (CNN-SAE) model. The beetle search optimizer algorithm (BSOA) method is used for the hyperparameter tuning procedure to increase the recognition outcomes of the CNN-SAE technique. An extensive simulation outcome is created to exhibit a better solution to the SPOHDL-ID method. The experimental validation of the SPOHDL-ID method portrayed a superior accuracy value of 99.59 % and 99.54 % over recent techniques under the ToN-IoT and CICIDS-2017 datasets.
Cyber-Physical Systems (CPS) have become a research hotspot due to their vulnerability to stealthy network attacks like ZDA and PDA, which can lead to unsafe states and system damage. Recent defense mechanisms for ZDA and PDA often rely on model-based observation techniques prone to false alarms. In this paper, we present an innovative approach to securing CPS against Advanced Persistent Threat (APT) injection attacks by integrating machine learning with blockchain technology. Our system leverages a robust ML model trained to detect APT injection attacks with high accuracy, achieving a detection rate of 99.89%. To address the limitations of current defense mechanisms and enhance the security and integrity of the detection process, we utilize blockchain technology to store and verify the predictions made by the ML model. We implemented a smart contract on the Ethereum blockchain using Solidity, which logs the input features and corresponding predictions. This immutable ledger ensures the integrity and traceability of the detection process, mitigating risks of data tampering and reducing false alarms, thereby enhancing trust in the system's outputs. The implementation includes a user-friendly interface for inputting features, a backend for data processing and model prediction, and a blockchain interaction module to store and verify predictions. The integration of blockchain with Machine learning enhances both the precision and resilience of APT detection while providing an additional layer of security by ensuring the transparency and immutability of the recorded data. This dual approach represents a substantial advancement in protecting CPS from sophisticated cyber threats.
Achraf Yahia, Yassine Mouhssine, Abdelkader Elalaoui, Said Ouatik Elalaoui
Cryptocurrencies like Bitcoin and Ethereum have experienced remarkable growth but also high volatility, making anomaly detection crucial for predictive modeling and risk management. This study evaluates three unsupervised machine learning algorithms - Local Outlier Factor, One-Class Support Vector Machine, and Isolation Forest - for detecting anomalies in Bitcoin and Ethereum prices and returns from January 2017 to May 2024. Local Outlier Factor is benchmarked against One-Class Support Vector Machine and Isolation Forest using mean absolute error (MAE), root mean squared error (RMSE), and explained variance score (EVS) as performance metrics. Results demonstrate Local Outlier Factor outperforms One-Class Support Vector Machine and Isolation Forest in detecting return anomalies for both cryptocurrencies. While Local Outlier Factor and Isolation Forest exhibit similar global anomaly detection capability, Local Outlier Factor achieves lower RMSE, indicating superior efficiency in capturing cryptocurrency market dynamics. One-Class Support Vector Machine lagged the other two methods across all metrics. The findings highlight the efficacy of density-based local outlier detection techniques like Local Outlier Factor for cryptocurrency applications. This study provides valuable insights for developing robust anomaly detection systems to enhance risk management and trading strategies in the highly volatile cryptocurrency market.
Antonio Pellicani, Gianvito Pio, Michelangelo Ceci
Cryptocurrencies are virtual currencies that exploit cryptography to perform secure financial transactions. They gained widespread popularity in recent years due to their decentralized nature, (pseudo-)anonymity, and ability to facilitate cross-border transactions without the need for intermediaries. However, their price on the market exhibits a huge volatility, that makes them prone to market anomalies. Therefore, predicting anomalies in cryptocurrency time series can be considered an important task for financial institutions, traders, and investors, to maximize their profit or minimize losses. In this paper, we propose a novel approach for predicting anomalies in cryptocurrency time series by exploiting temporal correlations among different cryptocurrencies. Our approach, called CARROT, is based on the idea that groups of cryptocurrencies exhibit similar trends, possibly due to common influencing factors. CARROT analyzes the temporal correlation between different cryptocurrencies, and identifies clusters showing similar patterns that can be useful for gaining insights into future anomalies. Subsequently, CARROT exploits multiple (i.e., one for each cluster) multi-target LSTM models to predict anomalies. Our experiments, performed on a dataset of 17 cryptocurrencies, proved that CARROT outperforms single-target LSTM models of up to 20%, as well as other approaches based on neural networks, i.e., MLP and CNN, in terms of macro F1-score. Therefore, the proposed approach can be considered as a promising tool for predicting anomalies in cryptocurrency time series data and can potentially be used to improve risk management and trading strategies in the cryptocurrency market. • Analysis of cryptocurrency trends. • Clustering-based multi-target prediction of anomalies in time series. • Consistent improvements achieved over the single-target counterpart.
In wireless sensor networks (WSNs), the presence of malicious nodes (MNs) poses significant challenges to data integrity, network stability, and system reliability. These issues are intensified by energy resource constraints and limitations within centralized authentication systems, necessitating an energy-efficient solution to ensure real-time responsiveness. Although artificial intelligence-driven approaches enhance detection capabilities, they overcome challenges related to data volume, coordination overhead, and latency in centralized control. This study introduces blockchain-machine learning (BC-ML), a novel hybrid model that seamlessly integrates blockchain and machine learning (ML) techniques to effectively identify MNs in WSNs. The model establishes an energy-efficient blockchain among cluster heads (CHs) for robust node authentication, incorporating a Schnorr-like zero-knowledge-proof technique to validate node data during communication initiation. Utilizing a hybrid lightweight approach with both symmetric and asymmetric ciphers enhances the security of node data transmission. A new proof-of-authority method is introduced, which leverages node digital certificates instead of conventional data transactions. This consensus mechanism reduces the processing overhead associated with larger data sizes in traditional proof-of-work methods, thereby improving both energy efficiency and scalability. To address dataset imbalances, the model employs a hybrid unsupervised ML technique, combining adaptive synthetic sampling with a convolutional neural network for efficient analysis of nodes and network features. The ML model, hosted on a robust data server, ensures ongoing oversight by updating CHs with security levels for detected MNs, thereby reducing storage and mitigating coordination challenges. Comprehensive analyses validate the effectiveness of the BC-ML model for detecting MNs, optimizing resource utilization, minimizing delays, and prolonging node and network lifetimes. Security analysis further confirms the ability of the model to mitigate diverse attacks and meet the stringent WSN security requirement.
The Internet of Things (IoT) refers to a network where different smart devices are interconnected through the Internet. This network enables these devices to communicate, share data, and exert control over the surrounding physical environment to work as a data-driven mobile computing system. Nevertheless, due to wireless networks' openness, connectivity, resource constraints, and smart devices' resource limitations, the IoT is vulnerable to several different routing attacks. Addressing these security concerns becomes crucial if data exchanged over IoT networks is to remain precise and trustworthy. This study presents a trust management evaluation for IoT devices with routing using the cryptographic algorithms Rivest, Shamir, Adleman (RSA), Self-Adaptive Tasmanian Devil Optimization (SA_TDO) for optimal key generation, and Secure Hash Algorithm 3-512 (SHA3-512), as well as an Intrusion Detection System (IDS) for spotting threats in IoT routing. By verifying the validity and integrity of the data exchanged between nodes and identifying and thwarting network threats, the proposed approach seeks to enhance IoT network security. The stored data is encrypted using the RSA technique, keys are optimally generated using the Tasmanian Devil Optimization (TDO) process, and data integrity is guaranteed using the SHA3-512 algorithm. Deep Learning Intrusion detection is achieved with Convolutional Spiking neural network-optimized deep neural network. The Deep Neural Network (DNN) is optimized with the Archimedes Optimization Algorithm (AOA). The developed model is simulated in Python, and the results obtained are evaluated and compared with other existing models. The findings indicate that the design is efficient in providing secure and reliable routing in IoT-enabled, futuristic, smart vertical networks while identifying and blocking threats. The proposed technique also showcases shorter response times (209.397 s at 70% learn rate, 223.103 s at 80% learn rate) and shorter sharing record times (13.0873 s at 70% learn rate, 13.9439 s at 80% learn rate), which underlines its strength. The performance metrics for the proposed AOA-ODNN model were evaluated at learning rates of 70% and 80%. The highest metrics were achieved at an 80% learning rate, with an accuracy of 0.989434, precision of 0.988886, sensitivity of 0.988886, specificity of 0.998616, F-measure of 0.988886, Matthews Correlation Coefficient (MCC) of 0.895521, Negative predictive value (NPV) of 0.998616, False Positive Rate (FPR) of 0.034365, and False Negative Rate (FNR) of 0.103095.
Given a JPEG pipeline (compression or decompression), this paper demonstrates how to find the antecedent of an 8x8 block. If it exists, the block is considered compatible with the pipeline. For unaltered images, all blocks remain compatible with the original pipeline; however, for manipulated images, this is not necessarily true. This article provides a first demonstration of the potential of compatibility-based approaches for JPEG image forensics. It introduces a method to address the key challenge of finding a block antecedent in a high-dimensional space, relying on a local search algorithm with restrictions on the search space. We show that inpainting, copy-move, and splicing, when applied after JPEG compression, result in three distinct mismatch problems that can be detected. In particular, if the image is re-compressed after modification, the manipulation can be detected when the quality factor of the second compression is higher than that of the first. Through extensive experiments, we highlight the potential of this compatibility attack under varying degrees of assumptions. While our approach shows promising results-outperforming three state-of-the-art deep learning models in an idealized setting-it remains a proof of concept rather than an off-the-shelf forensic tool. Notably, with a perfect knowledge of the JPEG pipeline, our method guarantees zero false alarms in block-by-block localization, given sufficient computational power.
Open access
Digital Media Forensic Detection
Generative Adversarial Networks and Image Synthesis
Stefano Ferretti, Gabriele D’Angelo, Vittorio Ghini
This paper presents a study on the application of Heterogeneous Graph Neural Networks (HGNNs) for enhancing the security of complex social systems by identifying illicit and malicious behaviors. We focus on digital asset tokenization, a key component in the construction of many innovative social services, with the aim of classifying token exchanges and identifying illicit activities. Utilizing the Elliptic++ dataset, we demonstrate the efficacy of HGNNs in identifying illicit activities in token-based exchanging applications. In particular, we evaluate four different HGNN architectures, i.e. Heterogeneous GAT, Heterogeneous SAGE, HGT (Heterogeneous Graph Transformer), and HAN (Heterogeneous Attention Network). Our results underscore the importance of characterizing and describing interactions in these complex systems, both for studying the system dynamics and for activating mechanisms to cope with cybersecurity issues, like misuses and usurpation of resources in social systems.
The last few years have witnessed the widespread use of blockchain technology in several works, due to its effectiveness in terms of privacy, security, and trustworthiness. However, the Cyber-attacks challenges represent a real threat to systems based on this technology. The resort to the systems of anomaly detection focused on deep learning, also called deep anomaly detection, is an appropriate and efficient means to tackle cyber-attacks on the blockchain. This paper provides an overview of the blockchain technology concept, its characteristics, challenges and limitations, and its systems taxonomy. Numerous blockchain cyber-attacks are discussed such as 51% attacks, selfish mining attacks, double spending attacks, and Sybil attacks, etc. Furthermore, we surveyed an overview of deep anomaly detection systems with their challenges and unresolved issues. In addition, this article gives a glimpse of various deep learning approaches implemented for anomaly detection in the blockchain environment, also presenting several methods that enhance the security features of anomaly detection systems. Finally, we discussed the benefits and drawbacks of these recent advanced approaches in light of three categories, which are discriminative, generative, and hybrid learning with other methods based on graphs and highlighting the ability of the proposed approaches to perform real-time anomaly detection.
Abstract In this study, we propose an effective system called RG-Guard that detects potential risks and threats in the use of cryptocurrencies in the metaverse ecosystem. In order for the RG-Guard engine to detect suspicious transactions, Ethereum network transaction information and phishing wallet addresses were collected, and a unique dataset was created after the data preprocessing process. During the data preprocessing process, we manually distinguished the features within the original dataset that contained potential risk indicators. The learning process of the RG-Guard engine in risk classification was achieved by developing a deep learning model based on LSTM + Softmax. In the training process of the model, RG-Guard was optimised for maximum accuracy, and optimum hyperparameters were obtained. The reliability and dataset performance of the preferred LSTM + Softmax model were verified by comparing it with algorithms used in risk classification and detection applications in the literature (Decision tree, XG boost, Random forest and light gradient boosting machine). Accordingly, among the trained models, LSTM + Softmax has the highest accuracy with an F 1-score of 0.9950. When a cryptocurrency transaction occurs, RG-Guard extracts the feature vectors of the transaction and assigns a risk level between 1 and 5 to the parameter named β risk . Since transactions with β risk > = 3 are labelled as suspicious transactions, RG-Guard blocks this transaction. Thus, thanks to the use of the RG-Guard engine in metaverse applications, it is aimed to easily distinguish potential suspicious transactions from instant transactions. As a result, it is aimed to detect and prevent instant potential suspicious transactions with the RG-Guard engine in money transfers, which have the greatest risk in cryptocurrency transactions and are the target of fraud. The original dataset prepared in the proposed study and the hybrid LSTM + Softmax model developed specifically for the model are expected to contribute to the development of such studies.
On blockchain platforms, an individual can use multiple wallet accounts to participate in transactions without disclosing identity. This poses great difficulty for entity behavior analytics on blockchain networks. To detect wallets belonging to the same owner, most solutions today rely on either off-chain data such as those on public forums and social media, or heuristic rules that pertain only to the specific blockchain network used. Their scalability and integrability are limited, especially upon changes in the underlying data structure or blockchain mechanisms. We propose to build a machine learning based solution that learns on on-chain transaction data, rather than relying only on heuristic rules. Specifically, we use heuristic methods to collect and label training data, and then apply our proposed machine learning technique to train the model. We focus on EVM blockchain networks and evaluated the proposed approach on two chains: Ethereum and BNB Chain, obtaining a dataset with over 3 million labeled wallet addresses. The detection accuracy can reach more than 90%. This is better than an existing commercial entity detection system which offers only 75%. Our prediction also is around two times better in terms of F-measure.
Stuart D. Semujju, Fangqing Liu, Han Huang, Yi Xiang
Smart contracts are programs that reside on a block-chain. A key feature of smart contracts is their immutability, meaning that they cannot be modified once they are deployed. Despite existing efforts to uncover vulnerabilities, a common assumption is that loop structures rarely occur in smart contracts. Traditional search-based algorithms encounter challenges in uniform exploration, particularly in complex control flow paths where certain paths are more critical than others for fault detection. To overcome this challenge, we propose an adaptive probabilistic sampling strategy that allows for targeted exploration of critical paths. The proposed adaptive probabilistic sampling strategy empowers search-based algorithms to select individuals covering paths with defects. Experimental results demonstrate the efficacy of the proposed adaptive probabilistic sampling strategy in ensuring targeted exploration of critical paths within smart contract loops and enhanced mutant-killing capabilities when combined with search-based algorithms.
Anomaly detection in the financial system has been studied for decades. Anomalies refer to irregular items or events that are different from the majority. Therefore, illegal activities are anomalous by nature because it is opposed to the norm. Preventive actions like anomalous detection play an important role in avoiding incidents that damage people's property. In this paper, the Bitcoin network is the subject of the study. We consider the effectiveness of two unsupervised learning algorithms, Histogram-based Outlier Score (HBOS) and Isolation Forest, for detecting anomalous transactions and wallet addresses. Providing insights into the strengths and weaknesses of HBOS and Isolation Forest for anomaly detection. We also analyze which features are the most important for each algorithm in identifying anomalies. The result shows similar detection for both algorithms. While HBOS has higher wallet visualization score at 0.423, Isolation Forest yields better scores on transaction visualization, dual, and known-thieves evaluations with score of 0.713, 0.681, and 0.035, respectively.
The Internet of Things (IoT) revolutionizes technology interaction by enabling seamless connectivity and automation, but it introduces significant security challenges. A distributed ledger technology (DLT) called IOTA Tangle, a utilizing a Directed Acyclic Graph (DAG), enables secure and feeless transactions among IoT devices. Despite its advantages, the IOTA Tangle faces threats such as replay attacks and double spending, which highlight vulnerabilities in distributed ledger technologies. To address these security concerns, we initially developed EdgeGuard, a rule-based system for spam detection within the IOTA ecosystem. However, its reliance on predetermined rulesets limited its adaptability. We have now enhanced our approach with EdgeShield, incorporating a neural network for superior threat detection.EdgeShield enhances adaptability over EdgeGuard in threat detection for the IOTA Tangle by integrating machine learning. EdgeShield analyzes network packets to identify threats, leveraging machine learning to adapt to evolving risks. Trained using the MQTTSet dataset, it detects network-based threats such as denial-of-service (DoS) attacks and packet flooding. Tested with simulated IoT data, EdgeShield demonstrates effectiveness across various domains, particularly in healthcare IoT. Its decentralized processing on edge devices like the Raspberry Pi 4 enables immediate network traffic analysis, reducing reliance on centralized servers and improving system resilience. Additionally, real-time alerts empower administrators to proactively secure IoT deployments and maintain transaction integrity within the IOTA Tangle. This paper traces our research evolution from EdgeGuard to EdgeShield, highlighting advancements and demonstrating the enhanced security of IoT transactions on the IOTA Tangle.
Jesús Rosa-Bilbao, Juan Boubeta-Puig, Jesús Lagares-Galán, Mark Vella
Blockchain is a relatively recent technology that provides immutability, traceability and transparency of information, thus building trust in the digital society. Blockchain networks generate a large amount of logs which capture and describe data flowing through the network in the form of transactions, blocks and events. Monitoring these blockchain data from the off-chain world is needed to detect anomalies with the aim of mitigating the risks that may arise as a result of using blockchain technology. However, the real-time monitoring of these logs by off-chain systems has become a challenge from the beginning of 2018 when the blockchain networks reached a high number of daily transactions. In this paper, we propose a portable, maintainable and easily configurable architecture integrating blockchain and complex event processing technologies that allows for both the real-time monitoring of logs generated in Ethereum Virtual Machine (EVM)-compatible blockchain networks and the automatic detection of anomalies in these networks by matching event patterns. This architecture was tested by using vast amounts of blockchain data already publicly registered in Ethereum and Polygon networks. The results demonstrate that the proposed architecture is able to automatically detect anomalies which occur in different blockchain networks, making analytics of blockchain data possible by off-chain systems.