Machine Learning (ML) models are increasingly deployed to detect fraudulent activities in Ethereum, where phishing and scamming attacks pose serious security risks. Despite their promise, these models remain susceptible to adversarial manipulations. In this article, we present a comprehensive evaluation of ML-based Ethereum phishing detectors under a spectrum of adversarial perturbations. Our study examines multiple classifiers, including Random Forest, Decision Tree, K-Nearest Neighbors, Graph Neural Networks, and XGBoost, against rule-based, gradient-based, and black-box adversarial attacks. We conduct detailed feature-level analyses to identify transaction attributes most vulnerable to manipulation, and we evaluate the comparative robustness of classifiers under both targeted and untargeted attack scenarios. To strengthen model resilience, we assess mitigation techniques such as adversarial training and randomized smoothing, demonstrating their effectiveness in improving robustness without significant performance degradation.
Xiangyun Tang, Minyang Li, Tao Zhang, Yijing Lin · 7 authors
In low-altitude networks, various aerial platforms such as unmanned aerial vehicles and airships cooperate to provide services including real-time monitoring, emergency response, and data collection. These platforms often operate with limited computing resources, restricted energy supply, and unstable wireless connectivity, making centralized data processing inefficient and prone to privacy risks. Federated Learning (FL) provides a promising solution by enabling multiple platforms to collaboratively train a shared model without exchanging raw data. However, the presence of Byzantine clients and a potentially malicious server poses serious threats to the robustness and trustworthiness of FL in such environments. Existing Byzantine-robust FL methods typically assume a semi-honest server and rely on auxiliary information such as clean datasets or known attacker ratios, which limits their applicability in dynamic and non-IID scenarios. In this paper, we propose zkFL, a Byzantine-robust FL framework that embeds zero-knowledge proofs to ensure verifiable aggregation under a malicious server. ZkFL allows clients to verify the correctness of server-side aggregation and dynamically adjusts client weights based on inference-guided detection, without relying on external datasets. Each round includes a zk-SNARK proof to guarantee aggregation integrity while preserving gradient privacy. Experiments demonstrate that zkFL exhibits strong robustness and verifiability in both IID and non-IID settings, outperforming prior methods, even in the presence of a malicious server.
Non-custodial staking in Ethereum empowers users to participate in securing the network without transferring their funds to any entity other than the official deposit contract. This approach minimizes the need for trust in third parties, aligning with the core principles of decentralization. However, there is a lack of studies to understand the risk that a staker takes when choosing a non-custodial solution. Furthermore, non-custodial staking may be difficult for non-technical users. In this paper, we analyze the risk of non-custodial staking in Ethereum and we provide some tools to simplify some of the processes for non-technical users. We introduce a detailed threat model in which an attacker gains access to a validator’s private key, and evaluate both the direct financial losses due to slashing and the potential economic incentives for an attacker. Two attack scenarios are explored-targeting solo stakers and coordinated attacks on non-custodial services-quantifying their impact and feasibility. We also provide lightweight Python scripts that enable users to generate and validate voluntary exit messages without deploying a full Ethereum node. These tools are especially relevant for increasing the resilience of non-custodial staking, particularly in the event of service disruption. Our results suggest that while validator key exposure is a serious risk, rational non-custodial providers are economically disincentivized from behaving maliciously.
The vulnerabilities in this vigorous digital landscape are taking a more sophisticated shape as the nature and danger of cyber threats and the nature of cyber threats are taking new forms as a zero-day attack, polymorphic malware, insider threat and advanced social engineering methodologies and where traditional reactive security measures are no longer relevant. This issue of organizations detecting the threat, and that they need to mitigate the threat in real time is rather of a challenge in the light of the fact the behaviour of the adversaries is very much similar to that of legitimate user behaviour and as such will create ambiguity issues that will make an organization believe that it has hit a false positive or missed a threat. A proactive approach to cyber threat countering, the Adaptive AI-Driven Autonomous Threat Hunting (ADCH) Framework, is the focus of this paper as it will be able to monitor, analyse, and mitigate the development of the new threats far before it becomes reality. Behavioural profiling and reinforcement learning are employed at ADCH to differentiate between innocent and harmful actors on the fly even in the ambiguous or complex situation, and ethical precautions are taken so that the deepfake interaction modules are tightly regulated and privacy safeguarding. The framework brings together automated threat intelligence extraction where Indicators of compromise (IoCs) are extracted, classified and pooled across different sources and offer rapid and actionable information. Additionally, ADCH is compatible with Siem and SOAR, automates the incident response and mitigation process to minimise latency and dependency on people. Secure logging provides auditability resistant to tampering and transparent recording of events without de-anonymization of sensitive operational data, with blockchain used to enforce the use of permissioned ledger systems, smart contracts, and zero-knowledge proofs. The results of simulation testify that ADCH has been doing consistently well in terms of detection performance and accuracy, precision, recall and F1 scores, the results stand at $80-90$ and far better than the traditional threat hunting systems. Autonomous AI-controlled detection, ethical simulation, automated intelligence extraction, coordinated response, and blockchain-based logging can be combined to help in establishing a strong and intelligent paradigm of defense against the emergent and advanced cyberspace threats and ensure the safety of the digital infrastructures, transparency, accountability and ethical standards.
Lingling Xia, Tao Zhu, Zhengjun Jing, Qun Wang · 7 authors
Digital currencies, led by Bitcoin and USDT, are characterized by decentralization and anonymity, which obscure the identities of traders and create a conducive environment for illicit activities such as drug trafficking, money laundering, cyber fraud, and terrorism financing. Focusing on the USDT-TRC20 token on the Tron blockchain, we propose a two-layer transaction network-based approach for virtual currency address identity recognition for digging out hidden relationships and encrypted assets. Specifically, a two-layer transaction network is constructed: Layer A describes the flow of USDT-TRC20 between on-chain addresses over time, while Layer B represents the flow of TRX between on-chain addresses over time. Subsequently, an identity metric is proposed to determine whether a pair of addresses belongs to the same user or group. Furthermore, transaction records are systematically acquired through blockchain explorers, and the efficacy of the proposed recognition method is empirically validated using dataset from the Key Laboratory of Digital Forensics. Finally, the transaction topology is visualized using Neo4j, providing a comprehensive and intuitive representation of the traced transaction pathways.
The evolution of 5G and emerging 6G networks has introduced unprecedented opportunities for connectivity, but also expanded the attack surface for Distributed Denial of Service (DDoS) amplification attacks. Service-Based Architecture (SBA), network slicing, and massive IoT (mMTC) environments create new vectors for reflection and amplification, making conventional defenses inadequate. This paper proposes a novel layered defense framework that integrates edge filtering, AI-driven anomaly detection, slice isolation, cloud scrubbing, and quantum-safe cryptography to mitigate DDoS amplification attacks in 5G/6G environments. The framework is theoretically modeled through equations for amplification, mitigation efficiency, resilience, and defense cost, and evaluated experimentally using simulated signaling floods, IoT-driven amplification, slice-targeted floods, and hybrid attacks. Performance was measured using detection rate, false alarm rate, service availability, resilience score, and resource overhead. Two algorithms—pseudonymous authentication with zero-knowledge proof (ZKP) and layered mitigation orchestration—were implemented to operationalize the defense strategy. The results demonstrate that the proposed framework achieves a detection accuracy of 95–97%, reduces false positives to 2%, and maintains a service availability of over 85% under prolonged amplification attacks. It scales efficiently in scenarios with up to 10,000 simulated IoT devices, retaining 70–80% throughput, and maintains URLLC latency below 10 ms, outperforming baseline defenses (firewalls, scrubbing, and AI-only) and state-of-the-art defenses from the literature. These findings validate the framework as a scalable, efficient, and future-ready solution for mitigating amplification attacks in 5G/6G networks, with strong alignment with 3GPP, GSMA, and NIST post-quantum standards.
Open access
Advanced Malware Detection Techniques
Network Security and Intrusion Detection
Physical Unclonable Functions (PUFs) and Hardware Security
Bitcoin transaction anomaly detection is essential for maintaining financial market stability. A significant challenge is capturing the dynamically evolving transaction patterns within transaction networks. Dynamic graph models are effective for characterizing the temporal evolution of transaction systems. However, current methods struggle to mine long-range temporal dependencies and address the class imbalance caused by the scarcity of abnormal samples. To address these issues, we propose a novel approach, the Bidirectional EvolveGCN with Class-Balanced Learning Network (Balanced-BiEGCN), for Bitcoin transaction anomaly detection. This model integrates two key components: (1) a bidirectional temporal feature fusion mechanism (Bi-EvolveGCN) that enhances the capture of long-range temporal dependencies and (2) a Sample Class Transformation (CSCT) classifier that generates difficult-to-distinguish abnormal samples to balance the positive and negative class distribution. The generation of these samples is guided by two loss functions: the adjacency distance adaptive loss function and the symmetric space adjustment loss function, which optimize the spatial distribution and confusion of abnormal samples. Experimental results on the Elliptic dataset demonstrate that Balanced-BiEGCN outperforms existing baseline methods in anomaly detection.
Satellite communication (SATCOM) networks are essential in delivering long-range and high-capacity data transmission on a global basis. With emerging satellite-ground-air integrated networks (SAGIN) responding to growing demands for communication and low-latency connections, their unique, dynamic infrastructure raises novel issues in security. Traditional centralized defenses are increasingly ineffective against advanced attacks such as distributed denial-of-service (DDoS). This research advocates an integrated solution that combines blockchain infrastructure with deep learning approaches to address these security challenges. The model was simulated in an NS-3 environment, and normal and attack traffic were generated to train a hybrid CNN-LSTM-based anomaly detection model. Distinct types of threats were recorded on a private Ethereum-based blockchain using smart contracts, enabling decentralized blacklist control and automated response behaviors. With decentralized control of threats, detection efficiency is enhanced by application of AI-driven analysis, and trust is ensured by virtue of immutable logging. The test results hold promise for this solution in delivering scalable, robust, and autonomous security for modern SATCOM networks.
With the rise of cryptocurrencies, illicit activities such as money laundering, fraud, and Ponzi schemes have gained attention. Traditional methods using graph neural networks (GNNs) to detect illicit transactions treat the entire transaction network as input, which works well on small networks but struggles with large-scale blockchain data. To address this limitation, the authors propose a neighborhood subgraph-based method that combines GCN and LSTM. The GCN captures information from neighboring nodes for each transaction, enhancing the understanding of the network structure, while the LSTM tracks the sequence and variations of fund flows. Experimental results show that by using 3-hop neighborhood subgraphs, the method outperforms other baseline models while requiring data from only an average of 80 nodes, thereby significantly improving efficiency compared to methods that process the entire transaction network.
Integration of Federated Learning (FL) with Blockchain technology to decentralized privacy-preserving, and scalable framework for strengthening cybersecurity. As cyber threats like ransomware, malware, and network intrusions grow in complexity, there is an increasing need for collaborative threat detection and mitigation. However, traditional collaborative approaches often involve sharing sensitive information across organizations, raising significant privacy concerns and regulatory challenges under frameworks like GDPR and HIPAA. FL works to solve these problems through enabling multiple entities to work together on training machine learning models without sharing their original information. Despite its advantages, FL faces challenges such as the risk of model tampering, trust deficits between participants, and dependence on a centralized server for model aggregation. To overcome these limitations the Blockchain technologies will be in used so blockchain technology provides a distributed, transparent, and non-mutable ledger that safely manages FL operations. It helps preserve the accuracy and trustworthiness of model updates via smart contracts along with consensus mechanisms, bypassing the requirement fora central aggregator. In addition, blockchain enables incentivization by introducing token-based rewards, encouraging active participation in collaborative threat detection networks. Privacy- preserving techniques to boost information security, techniques like differential privacy and homomorphic encryption are also put into practice. Such a integration of FL and blockchain is particularly impactful in securing distributed systems such as IoT devices, critical infrastructure, and enterprise networks, where privacy, trust, and scalability are crucial. This project aims to demonstrate the practical implementation of this framework, paving the way for adaptive and globally scalable cyber security systems to combat evolving threats.
Anthony Sai Richardo, Franz Adeta, Yohan Muliono, Michelle Hamjaya · 5 authors
Web3 airdrops have become a popular way to distribute tokens and raise project awareness, but their objective is frequently abused by bot activities. For example, the 2024 Hamster Kombat project reported detecting over 2.3 million automated bot interactions during its airdrop event. To address the problem, this research compares seven supervised machine learning models for detecting bot activity in Telegram-based Web3 airdrops by analyzing patterns in API requests. A total of 2600 data entries were collected: 1300 from real bot scripts and 1300 manually gathered using Telegram's built-in network tools. Each sample contains technical features such as HTTP request methods, URLs, request headers, and public IP addresses. These were further enriched with indicators of VPN usage, proxy connections, TOR relay presence, and whether the IP address was linked to a hosting provider. The result shows Gaussian Naïve Bayes and the MLP Classifier were the top performers, with$\mathbf{9 4. 4 1 \%}$validation accuracy,$\mathbf{9 4. 0 0 \%}$test accuracy, and 84.56 % accuracy when evaluated on a separate set of new data. These models accurately captured statistical patterns in bot data and complex interactions in human data. The results emphasize the importance of machine learning in securing Web3 token distribution processes.
Yenlik Begimbayeva, Temirlan Zhaxalykov, Amir Akhtanov, Ruslan Pashkevich · 6 authors
This research focuses on enhancing the security of decentralized quantum key distribution (QKD) networks, where the absence of a central authority creates significant challenges such as malicious node infiltration, undetected key leakage, and unauthorized re-entry of revoked participants. Traditional authentication and trust models are insufficient for fully distributed QKD topologies, which remain highly vulnerable to insider threats and persistent compromise. To address these risks, let’s propose a layered security framework composed of three integrated components: Challenge-Response Authentication (CRA), Dynamic Trust Scoring (DTS), and Blockchain-Based Access Control (BBAC). CRA verifies node legitimacy through randomized quantum-state interactions, significantly reducing impersonation and quantum replay attacks. DTS implements real-time trust evaluation using anomaly detection to dynamically downgrade compromised nodes based on their behavioral deviations. BBAC maintains an immutable and tamper-proof trust ledger to block revoked nodes from re-entering under falsified identities and resists Sybil attacks using post-quantum cryptographic primitives. Simulation results confirm that the system improves detection rates of covert threats, ensures authentication latency under 10 ms, and reduces re-entry success to zero. The proposed architecture ensures long-term scalability and resilience, making it applicable to critical domains such as finance, national infrastructure, and military communication. This work contributes a novel, verifiable, and scalable solution to one of the most pressing open problems in distributed quantum networks
The Ethereum platform is booming with growing richness and variety in decentralized finance (DeFi) products. However, this progress comes with sophisticated threats, such as sandwich attacks, where attackers exploit the openness and certainty of blockchain technology to manipulate market prices and secure illegal financial rewards through a strategically planned series of transactions. The existing sandwich attack detection methods are ineffective at detecting multi-token transactions and fail to identify multi-token sandwich attacks. To tackle this challenge, this study improves the original detector’s algorithm to identify both traditional single-token and multi-token sandwich attacks. The enhanced system is not only responsive and accurate but also capable of detecting and alerting potential multi-token sandwich attacks. It has been successfully integrated with the go-Ethereum client (Geth). The system is performance-optimized with an average processing time of 0.81 seconds per block and an accuracy rate of 96.17%. The response time for detecting new blocks in real-time is usually no more than 4 seconds, with most between 2 and 3 seconds, which meets practical application requirements. By carefully analyzing the transaction data flow, this system is not only able to identify the traditional front-running attack and sandwich attack, but also extends to multi-currency complex attack strategies. The core innovation lies in the system’s ability to accurately detect and provide early warnings of multi-token sandwich attacks through real-time analysis of in-block transactions, all while maintaining the overall operational efficiency of the node.
Li Xingchen, Zhou Zhang, Burra Venkata Durga Kumar
One of the most important properties of cold chain is that ensure that temperature-sensitive products such as food, medicine, and chemicals maintain quality and safety during transportation and storage. For traditional cold chain systems, most operations such as transportation and inspection were relying on manual inspection and decentralized systems, which are inefficient, error-prone, and lack transparency. Today, some studies have combined blockchain technology with the Internet of Things (IoT) to store various necessary supply chain data on the blockchain, thereby achieving the role of monitoring and review, providing a basic solution to these challenges. But there still some problems, for example, how to attribute the responsibility in the transportation process to individuals to achieve a precise accountability system? For example, know who is responsible for this leg of the shipment? who is responsible for receiving this shipment? Since the temperature and humidity data of the fruit may be constantly changing, how can you effectively detect whether these changes are justified so that you can respond effectively and in a timely manner to irregularities? Regarding above mentioned issues, in this paper, we propose a two-tier framework that combines biometric-based Zero Knowledge Proof (ZKP) authentication and AE-based AI anomaly detection. The authentication subsystem uses biometric data and personal information to generate credentials, which are verified by the ZKP stored on the chain. Meanwhile, the IoT device collects multisource sensor data processed by feature engineering, and detects temperature, humidity, and route anomalies via VAE model.
In an era marked by increasingly sophisticated cyber threats and growing vulnerabilities in national critical infrastructure, this study explores the transformative role of confidential computing in defending against emerging cryptographic attacks and enabling secure threat intelligence sharing. Traditional cybersecurity measures, while effective for protecting data at rest and in transit, fall short in securing data during active processingan area exploited by advanced persistent threats, quantum computing, and side-channel attacks. This research investigates how hardware-based trusted execution environments (TEEs), homomorphic encryption, and zero-knowledge proofs embedded in confidential-computing platforms can preserve the confidentiality of sensitive operations even within potentially compromised environments. Through detailed case studies of major U.S. institutionsincluding PGandE, Exelon, JPMorgan Chase, Wells Fargo, and Kaiser Permanentethe paper demonstrates significant improvements in detection speed, false positive reduction, and operational efficiency. Furthermore, it proposes a scalable, privacy-preserving framework for collaborative cyber defense across critical sectors such as energy, finance, and healthcare. The findings underscore that integrating confidential computing with decentralized intelligence sharing networks not only enhances cybersecurity resilience but also yields substantial economic and regulatory benefits. This work advocates for a national, and eventually global, shift toward confidential-computing-enabled infrastructures to achieve robust, cooperative, and future-proof cyber defense ecosystems.
Weizhao Jin, Erik Kline, T. K. Satish Kumar, Lincoln Thurlow · 5 authors
Path validation in computer networks is used to enforce and verify data forwarding rules across network slices and administrative domains to satisfy specific service level requirements. Deviating from pre-established paths has the potential to downgrade network service quality, increase attack surface area, and disrupt network orchestration capabilities. Network operators regard the network infrastructure and topology as sensitive. This necessitates the need for privacy-preserving path validation techniques that leak minimal information about the overall network path to individual infrastructure owners. We present the design of a decentralized privacy-preserving path validation protocol using Non-Interactive Zero-Knowledge (NIZK) proofs to provide provable path privacy guarantees. The NIZK-based pairwise validation design identifies individual slice nodes that deviate from the prescribed path. Deploying this lightweight protocol periodically enables individual nodes to enforce and validate the network control path. We have implemented and evaluated our system on a testbed simulating a multi-authority network. Our results demonstrate the feasibility of preserving path privacy as well as the practicality of our proposed protocols for next-generation multi-authority sliced networks.
Büşra Büyüktanır, Şahsene Altınkaya, Gozde Karatas Baydoğmus, Kazım Yıldız
Abstract Federated Learning (FL) has emerged as a promising distributed machine learning approach that addresses confidentiality and integrity concerns in various sectors, including Internet of Things (IoT), healthcare, finance, and cybersecurity. In order to improve privacy protection and detection accuracy in decentralized systems, this study investigates the incorporation of FL into Intrusion Detection Systems (IDS). FL is especially useful in situations where data security and privacy are crucial because it allows for the cooperative training of models without centralizing sensitive data. We examine many FL-based IDS solutions across several domains, emphasizing how well they mitigate data breaches, maintain confidentiality, and enhance intrusion detection capabilities. The use of Generative Adversarial Networks (GANs), artificial immune systems, and hybrid deep learning techniques to maximize IDS performance are among the current developments in FL methodology that are covered in the paper. We also look at issues like the requirement for effective aggregation procedures and non-independent and identically distributed (non-IID) data. Finally, we outline future directions and open research topics to improve the scalability, resilience, and effectiveness of FL-based IDS solutions in practical applications.
In the modern era, the use of blockchain technology has been growing rapidly, where Ethereum smart contracts play an important role in securing decentralized application systems. However, these smart contracts are also susceptible to a large number of vulnerabilities, which pose significant threats to intelligent systems and IoT applications, leading to data breaches and financial losses. Traditional detection techniques, such as manual analysis and static automated tools, suffer from high false positives and undetected security vulnerabilities. To address these problems, this paper proposes an Artificial Intelligence (AI)-based security framework that integrates Generative Adversarial Network (GAN)-based feature selection and deep learning techniques to classify and detect malware attacks on smart contract execution in the blockchain decentralized network. After an exhaustive pre-processing phase yielding a dataset of 40,000 malware and benign samples, the proposed model is evaluated and compared with related studies on the basis of a number of performance metrics including training accuracy, training loss, and classification metrics (accuracy, precision, recall, and F1-score). Our combined approach achieved a remarkable accuracy of 97.6%, demonstrating its effectiveness in detecting malware and protecting blockchain systems.