Cyber Threat Intelligence (CTI) is the knowledge of cyber and physical threats that help mitigate potential cyber attacks. The rapid evolution of the current threat landscape has seen many organisations share CTI to strengthen their security posture for mutual benefit. However, in many cases, CTI data contains attributes (e.g., software versions) that have the potential to leak sensitive information or cause reputational damage to the sharing organisation. While current approaches allow restricting CTI sharing to trusted organisations, they lack solutions where the shared data can be verified and disseminated `differentially' (i.e., selective information sharing) with policies and metrics flexibly defined by an organisation. In this paper, we propose a blockchain-based CTI sharing framework that allows organisations to share sensitive CTI data in a trusted, verifiable and differential manner. We discuss the limitations associated with existing approaches and highlight the advantages of the proposed CTI sharing framework. We further present a detailed proof of concept using the Ethereum blockchain network. Our experimental results show that the proposed framework can facilitate the exchange of CTI without creating significant additional overheads.
Blockchain-based smart contracts enable the creation of decentralized applications, which often handle assets of considerable value. While the underlying platforms guarantee the correctness of smart-contract execution, they cannot ensure that the code of a contract is correct. Today, as evidenced by a number of recent security breaches, developers still have a hard time making contracts that work properly.Even though these incidents often exploit contract interaction, prior work on smart-contract verification, vulnerability discovery, and secure development typically considers only individual contracts in isolation. To address this gap, we introduce theVeriSolidframework for the formal verification of contracts that are specified using a abstract state machine based model with rigorous operational semantics. Our model-based approach allows developers to reason about and verify the behavior of a set of interacting contracts at a high level of abstraction.VeriSolidallows the generation of Solidity code that is functionally and behaviorally equivalent to verified models, which enables the creation of correct-by-design smart contracts. We additionally introduce a graphical notation (calleddeployment diagrams) for specifying possible interactions between contract types. Based on this notation, we present a framework for the automated verification, generation, and deployment of contracts that conform to a deployment diagram. To demonstrate the applicability ofVeriSolid, we translate existing Ethereum Improvement Proposal (EIP) specifications to temporal properties for two of the most popular contract interfaces: ERC20 and ERC721. We also show you how to write code for the ERC20 and ERC721 interfaces in a way that is safe, and we do this by usingVeriSolid. We evaluate our framework on 726 contracts that are currently deployed on the Ethereum blockchain, which include 267 ERC20 and 459 ERC721 contracts. Our experiments indicate that 18% of ERC20 contracts and 4% of ERC721 contracts fail to satisfy the EIP specifications.
A smart contract is a pivotal notion in blockchain technology. Distributed applications contain smart contracts verifying the fulfillment of the conditions, which determine the execution of transactions between the blockchain network nodes. Those software-controlled logical conditions are called verification rules. As the number of conditions increases, the complexity of smart contract testing rapidly grows. This paper aims to propose a smart contract testing pattern that significantly limits the needed number of test cases. For evaluation expression with four verification rules, the pattern usage reduces the number of test cases by 68.75% in relation to the full coverage of logical value combinations. With the increase in the number of logical conditions, not only the number of test cases but also their percentage decreases. Starting from seven verification rules in the evaluation expression, the percentage reduction of test cases exceeds 90%. As a result, the cost of preparing and maintaining test case suites may be substantially cut. It should be emphasized that test execution time can be reduced even by 3 orders of magnitude (from seconds to milliseconds). Such an approach is highly important for regression testing, especially when used in continuous software integration, delivery, and deployment approaches.
Fausto Spoto, Sara Migliorini, Mauro Gambini, Andrea Benini
Abstract This paper shows that generic types ( generics ) are useful for writing more abstract and more general smart contracts, but this comes with some security risks, reporting a concrete security issue found while using generics for writing smart contracts that implement shared entities for the Hotmoka blockchain. That issue can be used to steal the remuneration of validator nodes. This paper proposes a patch based on appropriate code rewriting. Namely, smart contracts are pieces of code that are deployed and executed in the context of a blockchain infrastructure in order to automatically enforce some effects when particular events occur. The writing of smart contracts is a complex and critical activity that can benefit from the use of high-level features of programming languages, and generics is one of them. In many programming languages, such as Java, generics are implemented by erasure , i.e. replaced by their upper bound type during compilation into bytecode. This is safe at source level, since the compiler takes care of checking that types are correct, before erasure. However, the erased types of the generated bytecode are consequently weaker. In a permissionless blockchain, where every user can call the bytecode of smart contracts installed by other users, these weaker types pose a risk of attack.
Yang Yang, Shangbin Han, Ping Xie, Yan Zhu · 8 authors
With the increasing demand for privacy protection in the blockchain, the universal zero-knowledge proof protocol has been developed and widely used. Because hash function is an important cryptographic primitive in a blockchain, the zero-knowledge proof of hash preimage has a wide range of application scenarios. However, it is hard to implement it due to the transformation of efficiency and execution complexity. Currently, there are only zero-knowledge proof circuits of some widely used hash functions that have been implemented, such as SHA256. SM3 is a Chinese hash function standard published by the Chinese Commercial Cryptography Administration Office for the use of electronic authentication service systems, and hence might be used in several cryptographic applications in China. As the national cryptographic hash function standard, the zero-knowledge proof circuit of SM3 (Chinese Commercial Cryptography) has not been implemented. Therefore, this paper analyzed the SM3 algorithm process, designed a new layered circuit structure, and implemented the SM3 hash preimage zero-knowledge proof circuit with a circuit size reduced by half compared to the automatic generator. Moreover, we proposed several extended practical protocols based on the SM3 zero-knowledge proof circuit, which is widely used in blockchain.
Along with the advancements in blockchain technology, many blockchain-based successful projects have been done mainly on the ethereum platform, most of which deal with transactions.Still, it also carries various risks when it comes to security, as evident from past attacks.Most big projects like uniswap, decentraland, and others use smart contracts, deployed on the ethereum platform, leading to similar projects via code reuse.Code reuse practice is quite frequent as a survey suggests 26% of contract code deployed is via code reuse.Smart contract code obfuscation techniques can be used on solidity code that is publicly verified, published (in the case of Ethereum), and on the deployment address.All the above techniques work by replacing characters with their random counterpart, known as statistical substitution.A statistical substitution is a process of transforming an input string into a new string where each character has been replaced by a random character drawn from a stock of all possible 'random' characters.Therefore, we proposed numerous methods in this paper to solve the above problems using various smart contract code obfuscation techniques.These techniques can be really useful in blockchain projects and can save millions of dollars to investors & companies by enhancing code security and preventing code reusability.Techniques mentioned in this paper when compared with other techniques.Our methods are not expensive to implement, very easy to use, and provide a developer-friendly selective increment in code complexity.
Cristina Regueiro, Ivan Gutierrez-Ag ́ Ag ́uero, Sergio Sergio, Santiago de Diego · 5 authors
This paper presents a protocol for Identity Management in Industrial IoT enabled devices, that is based on the principles of Self-Sovereign Identity. The Industry 4.0 transformation has led to the Industry sector digitalization and one of its major challenges is to uniquely identify the Industrial Internet of Things unattended devices. The digital identity management must allow increasing the security and control, and it has been evolving towards a model where the device acquires the responsibility for managing its own data through Self-Sovereign Identity. This paper studies why the Self-Sovereign Identity approach is suitable for the industrial IoT particularities, properly justifying its use. Furthermore, it analyzes the actors and roles involved in an industrial identity environment, and it addresses a protocol that defines how data should be exchanged over an Hyperledger Indy public permissioned Distributed Ledger Technology network as Sovrin. The paper applies the proposal to a reference use case, filling the gaps that are not currently specified in the literature for a successful Industrial Internet of Things identity management operation.
Jesús Rosa-Bilbao, Juan Boubeta-Puig, Adrian Rutle
Blockchain is a cutting-edge technology based on a distributed, secure and immutable ledger that facilitates the registration of transactions and the traceability of tangible and intangible assets without requiring central governance. The agreements between the nodes participating in a blockchain network are defined through smart contracts. However, the compilation, deployment, interaction and monitoring of these smart contracts is a barrier compromising the accessibility of blockchains by non-expert developers. To address this challenge, in this paper, we propose a low-code approach, called EDALoCo, that facilitates the development of event-driven applications for smart contract management. These applications make blockchain more accessible for software developers who are non-experts in this technology as these can be modeled through graphical flows, which specify the communications between data producers, data processors and data consumers. Specifically, we have enhanced the open-source Node-RED low-code platform with blockchain technology, giving support for the creation of user-friendly and lightweight event-driven applications that can compile and deploy smart contracts in a particular blockchain. Additionally, this platform extension allows users to interact with and monitor the smart contracts already deployed in a blockchain network, hiding the implementation details from non-experts in blockchain. This approach was successfully applied to a case study of COVID-19 vaccines to monitor and obtain the temperatures to which these vaccines are continuously exposed, to process them and then to store them in a blockchain network with the aim of making them immutable and traceable to any user. As a conclusion, our approach enables the integration of blockchain with the low-code paradigm, simplifying the development of lightweight event-driven applications for smart contract management. The approach comprises a novel open-source solution that makes data security, immutability and traceability more accessible to software developers who are non-blockchain experts.
Abstract The realization of fully autonomous vehicles in great scale is already in sight. However, to be safe and reliable, autonomous driving requires a significant amount of communication with cloud services, which are prone to many kinds of failures and malicious attacks. This paper introduces the use of AIngle, a novel distributed-ledger technology developed to guarantee real-time encrypted communication among IoT devices. Not only AIngle tackles various kinds of malicious attacks by design, such as Sybil attacks, but it also enables semantic distributed applications (Sem D Apps). Sem D Apps decentralize supporting driving services, such as traffic and route mapping, which are typically centralized in cloud services. AIngle provides a new paradigm for Sem D Apps, that will support future-proofed, fast, reliable, intelligent distributed applications for the autonomous vehicle industry.
Zhendong Wu, Shan Li, Bin Wang, Tianjian Liu · 7 authors
Decentralized applications and smart contracts running on Ethereum have been widely applied in many fields, such as finance and logistics. On the one hand, the number of smart contracts surges. On the other hand, smart contracts often carry million dollars. Once there is a severe vulnerability in a smart contract, huge losses may occur. Detection tools like Oyente and Mythril were developed for vulnerabilities in smart contracts. However, many of these tools many detection tools do not use intrinsic features in the contract, resulting in ineffectiveness in the detection. In addition, many tools rely on symbolic execution and lack automation in the detection, resulting in inefficiency and in incapacity in vetting huge number of emerging smart contract on Ethereum. In our work, we are motivated to enhance the effectiveness and efficiency of vulnerability detection in contracts. First, we use opcodes as static features and use bigram to build the opcode feature space that is further optimized with Mtfidf. Second, We use deep learning algorithms namely, CNN, LSTM, CNN-BiLSTM, and ResNets, for the smart contract vulnerability detection. Extensive experimental results based on real-world smart contracts show that our methods are promising. Mtfidf significantly improves the detection performance. The best detection performance with ResNets reaches 82% in terms of Macro-F1.
The growing popularity of Ethereum and Solidity smart contracts makes them attractive targets for security threats and attacks. Even though researchers have been dedicating substantial efforts in developing machine learning-based vulnerability detection models for Solidity smart contracts, the models achieved considerably lower accuracy due to shallow coverage of the feature space. In this paper, we introduce SmartMixModel, an improved vulnerability detection model considering an expanded feature space covering both the source- and byte-codes of the Solidity smart contracts. In particular, our contribution in this paper is threefold. First, we collect close to seventy thousand real-world Solidity smart contracts deployed on the Ethereum mainnet and employ the SmartCheck tool to label them considering ten types of vulnerabilities. Next, we generate a mixed-level embedding feature space considering both the high-level syntactic features of the source codes and the low-level features extracted from the compiled byte codes. Finally, we train various Machine Learning and Deep Learning models on our dataset balanced with SMOTETomek. We observe an improved detection performance compared to the state-of-the-art models, achieving the highest Micro-F1 of 98.34%, Macro-F1 of 98.20%, maximum F1-score rate of 99%, and maximum AUROC of 99.60% in the case of XGBoost classifier.
This paper presents the design, implementation, and verification of a blockchain-based online electronic voting system that ensures accuracy and reliability in electronic voting and its application to various types of voting using blockchain technologies, such as distributed ledgers and smart contracts. Specifically, in this study, the connection between the electronic voting system and blockchain nodes is simplified using the REST API design, and the voting opening and counting information is designed to store the latest values in the distributed ledger in JSON format, using a smart contract that cannot be falsified. The developed electronic voting system can provide blockchain authentication, secret voting, forgery prevention, ballot verification, and push notification functions, all of which are currently not supported in existing services. Furthermore, the developed system demonstrates excellence on all evaluation items, including 101 transactions per second (TPS) of blockchain online authentication, 57.6 TPS of secret voting services, 250 TPS of forgery prevention cases, 547 TPS of read transaction processing, and 149 TPS of write transaction processing, along with 100% ballot verification service, secret ballot authentication, and encryption accuracy. Functional and performance verifications were obtained through an external test certification agency in South Korea. Our design allows for blockchain authentication, non-forgery of ballot counting data, and secret voting through blockchain-based distributed ledger technology. In addition, we demonstrate how existing electronic voting systems can be easily converted to blockchain-based electronic voting systems by applying a blockchain-linked REST API. This study greatly contributes to enabling electronic voting using blockchain technology through cost reductions, information restoration, prevention of misrepresentation, and transparency enhancement for a variety of different forms of voting.
Due ecosystem, it is common for new blockchains to fork or partially reuse the code of classic blockchains. For example, the popular Dogecoin, Litecoin, Binance BSC, and Polygon are all variants of Bitcoin/Ethereum. These “forked” blockchains thus could encounter similar vulnerabilities that are propagated from Bitcoin/Ethereum during forking or subsequently commit fetching. In this paper, we conduct a systematic study of detecting and investigating the propagated vulnerabilities in forked blockchain projects. To facilitate this study, we propose BlockScope, a novel tool that can effectively and efficiently detect multiple types of cloned vulnerabilities given an input of existing Bitcoin/Ethereum security patches. Specifically, BlockScope adopts similarity-based code match and designs a new way of calculating code similarity to cover all the syntax-wide variant (i.e., Type-1, Type-2, and Type-3) clones. Moreover, BlockScope automatically extracts and leverages the contexts of patch code to narrow down the search scope and locate only potentially relevant code for comparison. Our evaluation shows that BlockScope achieves good precision and high recall both at 91.8% (1.8 times higher recall than that in the state-of-the-art ReDeBug while with close precision). BlockScope allows us to discover 101 previously unknown vulnerabilities in 13 out of the 16 forked projects of Bitcoin and Ethereum, including 16 from Dogecoin, 6 from Litecoin, 1 from Binance BSC, and 4 from Optimism. We have reported all the vulnerabilities to their developers; 40 of them have been patched or accepted, 66 were acknowledged or under pending, and only 4 were rejected. We further investigate the propagation and patching processes of discovered vulnerabilities, and reveal three types of vulnerability propagation from source to forked projects, as well as the long delay (mostly over 200 days) for releasing patches in Bitcoin forks (vs. ∼100 days for Ethereum forks).
Cyber physical system (CPS) is a network of cyber and physical elements, which interact with one another in a feedback form. CPS approves critical infrastructure and is treated as essential in day to day since it forms the basis of futuristic smart devices. An increased usage of CPSs poses security as a challenging issue and intrusion detection systems (IDS) can be applied for the identification of network intrusions. The latest advancements in the field of artificial intelligence (AI) and deep learning (DL) enables to design effective IDS models for the CPS environment. At the same time, metaheuristic algorithms can be employed as a feature selection approach in order to reduce the curse of dimensionality. With this motivation, this study develops a novel Poor and Rich Optimization with Deep Learning Model for Blockchain Enabled Intrusion Detection in CPS Environment, called PRO-DLBIDCPS technique. The proposed PRO-DLBIDCPS technique initially introduces an Adaptive Harmony Search Algorithm (AHSA) based feature selection technique for proper selection of feature subsets. For intrusion detection and classification, and attention based bi-directional gated recurrent neural network (ABi-GRNN) model is applied. In addition, the detection efficiency of the ABi-GRNN technique has been enhanced by the use of Poor and rich optimization (PRO) algorithm based hyperparameter optimizer, which resulted in enhanced intrusion detection results. Furthermore, blockchain technology is applied for enhancing security in the CPS environment. In order to demonstrate the enhanced outcomes of the PRO-DLBIDCPS technique, a wide range of simulations was carried out on benchmark dataset and the results reported the better outcomes of the PRO-DLBIDCPS technique in terms of several measures.
João Paulo de Brito Gonçalves, Gustavo Alochio, Rodolfo da Silva Villaça, Roberta Lima Gomes
The fifth-generation (5G) wireless networks are expected to provide various services compared to the 4G and previous generations of networks. The Quality of Service requirements can be quite different in terms of latency, bandwidth, reliability, and availability. 5G technology allows the fragmentation of the network into small pieces, known as network slices. This network slicing is done by specific tools and the configuration must be protected from attacks that may be performed by malicious users. Thus in this paper, a solution to protect and prevent these failures from happening is addressed. For this solution to be carried out, a study was conducted on the Blockchain technology, as well as the use of Oracles in order to implement an integrity verification system, a system capable of assuring 5G network slices' configuration integrity through a complete architecture involving Blockchain, Smart Contracts and Oracles.
Ningyu He, Haoyu Wang, Lei Wu, Xiapu Luo · 6 authors
EOSIO, as one of the most representative blockchain 3.0 platforms, involves lots of new features, e.g., delegated proof of stake consensus algorithm and updatable smart contracts, enabling a much higher transaction per second and the prosperous decentralized applications (DApps) ecosystem. According to the statistics, it has reached nearly 18 billion USD, taking the third place of the whole cryptocurrency market, following Bitcoin and Ethereum. Loopholes, however, are hiding in the shadows. EOSBet, a famous gambling DApp, was attacked twice within a month and lost more than 1 million USD. No existing work has surveyed the EOSIO from a security researcher perspective. To fill this gap, in this paper, we collected all occurred attack events against EOSIO, and systematically studied their root causes, i.e., vulnerabilities lurked in all relying components for EOSIO, as well as the corresponding attacks and mitigations. We also summarized some best practices for DApp developers, EOSIO official team, and security researchers for future directions.
M2M communication in the Industrial Internet of Things is still in its infancy as the information exchange between machines is hindered by various modern security challenges and threats. An attacker can leverage the M2M communication by exploiting it with resource exhaustion, data integrity, and injection attacks. In this article, to address the aforementioned security issues, we first employed a long short-term memory based AI model on the edge servers to classify the machines' malicious and nonmalicious message requests and forwarded them to the onion routing (OR) network. Then, to enhance the security and reliability of the conventional OR network, we have associated it with blockchain technology by incorporating two additional fields along with the original message requests, i.e., verifying token and time to live that validates the incoming message requests. Additionally, the OR network, along with blockchain, is simulated inside a discrete simulator, i.e., a shadow simulator. Finally, the performance of the proposed system is evaluated with different performance metrics, such as F1 score, precision, recall, and false-negative rate. The empirical results show that the proposed OR network outperforms the conventional OR in terms of throughput, decryption time (computationally inexpensive), and OR circuit compromised rate.
The existing power grid and smart cities enable two-way communications, and the great experience is to increase the reliability, budget, and continuity of production as well as efficiency addressed, transmission and distribution of electricity from the stake to the smart grid implementation. However, connectivity and management issues need to be addressed before you can take full advantage of the smart grid. Furthermore, how to describe the challenges security of the use of grid resources and available energy, how to ensure reliability and safety, and how to provide the capability to be considered when the data communication increase on smart grid systems. In this article, some descriptions of the smart grid, like communications, response and demand, and mainly security, are discussed. blockchain and the integration issues of distributed energy sources are also taking place.
With the increasing popularity of blockchain, automatically detecting vulnerabilities in smart contracts is becoming a significant problem. Prior research mainly identifies smart contract vulnerabilities without considering the interactions between multiple contracts. Due to the lack of analyzing the fine-grained contextual information during cross-contract invocations, existing approaches often produced a large number of false positives and false negatives. This paper proposes SmartDagger, a new framework for detecting cross-contract vulnerability through static analysis at the bytecode level. SmartDagger integrates a set of novel mechanisms to ensure its effectiveness and efficiency for cross-contract vulnerability detection. Particularly, SmartDagger effectively recovers the contract attribute information from the smart contract bytecode, which is critical for accurately identifying cross-contract vulnerabilities. Besides, instead of performing the typical whole-program analysis which is heavy-weight and time-consuming, SmartDagger selectively analyzes a subset of functions and reuses the data-flow results, which helps to improve its efficiency. Our further evaluation over a manually labelled dataset showed that SmartDagger significantly outperforms other state-of-the-art tools (i.e., Oyente, Slither, Osiris, and Mythril) for detecting cross-contract vulnerabilities. In addition, running SmartDagger over a randomly selected dataset of 250 smart contracts in the real-world, SmartDagger detects 11 cross-contract vulnerabilities, all of which are missed by prior tools.