EOSIO is one typical public blockchain platform. It is scalable in terms of transaction speeds and has a growing ecosystem supporting smart contracts and decentralized applications. However, the vulnerabilities within the EOSIO smart contracts have led to serious attacks, which caused serious financial loss to its end users. In this work, we systematically analyzed three typical EOSIO smart contract vulnerabilities and their related attacks. Then we presented EOSFuzzer, a general black-box fuzzing framework to detect vulnerabilities within EOSIO smart contracts. In particular, EOSFuzzer proposed effective attacking scenarios and test oracles for EOSIO smart contract fuzzing. Our fuzzing experiment on 3963 EOSIO smart contracts shows that EOSFuzzer is both effective and efficient to detect EOSIO smart contract vulnerabilities with high accuracy.
Santiago Figueroa-Lorenzo, Jon Goya, Javier Añorga, Iñigo Adín · 6 authors
The European Union is moving toward the “smart” era having as one of the key topics the smart mobility. What is more, the European union (EU) is moving toward Mobility as a Service (MaaS). The key concept behind MaaS is the capability to offer both the traveler's mobility and goods' transport solutions based on travel needs. For example, unique payment methods, intermodal tickets, passenger services, freight transport services, etc. The introduction of new services implies the integration of many Internet-of-Things (IoT) sensors. At this point, security gains a key role in the railway sector. Considering an environment where sensor data are monitored from sensor events, and alarms are detected and emitted when events contain an anomaly, this document proposes the development of an alarms collection system, which ensures both traceability and privacy of these alarms. This system is based on Ethereum blockchain events-log, as an efficient storage mechanism, which guarantees that any railway entity can participate in the network, ensuring both entity security and information privacy.
With the popularity of Internet of Things (IoT) technology, the security of the IoT network has become an important issue. Traditional intrusion detection systems have their limitations when applied to the IoT network due to resource constraints and the complexity. This research focusses on the design, implementation and testing of an intrusion detection system which uses a hybrid placement strategy based on a multi-agent system, blockchain and deep learning algorithms. The system consists of the following modules: data collection, data management, analysis, and response. The National security lab–knowledge discovery and data mining NSL-KDD dataset is used to test the system. The results demonstrate the efficiency of deep learning algorithms when detecting attacks from the transport layer. The experiment indicates that deep learning algorithms are suitable for intrusion detection in IoT network environment.
In this paper, we propose a Blockchain-based solution for the recovery of an SDN controller back to a previously known state upon sudden failure. A lightweight minimal Blockchain ledger containing metadata details about each controller event is maintained by the switches. The set of all instructions given by the controller to the switches denotes the state of the controller at that instant. Whenever a new event occurs, the meta-information about it gets stored in the Blockchain which is updated in the switches after regular epochs. Upon sudden failure and subsequently coming back online again, the controller downloads all the tables and information from the respective switches. It checks and compares the metadata contained in the Blockchain with those data received from the switches. In addition to the existing security services provided by Blockchain, the proposed scheme can further solve the controller failure problem. The performance of the proposed solution is measured through simulation. The proposed scheme with the metadata-based solution saves about 75% of space and a controller can securely recover with a duration of 50 Sec.
The basic idea of Software Defined Networks (SDNs) is to centralize the control plane and make it programmable using generic APIs. In SDNs, the network intelligence resides within the controller which is considered as the heart of the entire network. The network principles are programmed as controller applications by the administrator using the generic APIs at the North Bound. Though SDNs improve the programmability of the network, the centralized control and flexibility are offered at the cost of security vulnerabilities at various surfaces in the SDN stack. Fortunately, the programmable control plane allows enforcing a sophisticated security policy that can be easily customized for securing the network. Many research studies reveal that the major threat in SDNs is the single point of failure. Any failure in the controller will impact the overall functionality of the network due to which compromising the controller has become the primary target of attackers. Hence, the security of the controller plays a crucial role in the success of SDNs. Besides securing the controller, the overall security of the network is equally important. In this paper, the authors proposed a security model based on Blockchain technology for ensuring consistency among instances of the SDN controller with enhanced security. The said security model is proposed considering the operational flow of the OpenDaylight (ODL) controller as a case study, but can be implemented with any SDN controller.
The synchrophasor technology has been changing the wide-area monitoring system (WAMS) of power grids; as it facilitates real-time grid situational awareness, observability and state estimation, and online stability assessment. However, the measurement samples inside the substations, or in phasor data concentrators (PDCs) can become a target for cyber-attacks, such as false data injection and data tampering attacks. Moreover, the synchrophasors are vulnerable to a single point of failure. Blockchain, the main technology behind the bitcoin, can simultaneously ensure reliability, security, and integrity with decentralization properties in a peer-to-peer system. Therefore, to mitigate the issues in the synchrophasor network, in this paper, we propose a blockchain-based synchrophasor network protection framework to enhance the self-defensive capability of its monitoring system. Our proposed model can mitigate data manipulation attacks from malicious entities by introducing bloom filter based fast phasor data identity validation, and Merkle tree-based fast data verification. Finally, the blockchain consensus can help to keep the consistency in the system and eliminate malicious entities from manipulating the overall security of the protection framework. Our experimental results show that the proposed system is scalable and fast in terms of synchrophasor data verification.
DDoS attacks are the most commonly performed cyber-attacks with a motive to suspend the target services and making them unavailable to users. A recent attack on Github, explains that the traffic was traced back to “over a thousand different autonomous systems across millions of unique endpoints”. Generally, there are various types of DDoS attacks and each attack uses a different protocol and attacker uses a botnet to execute such attacks. Hence, it will be very difficult for organizations to deal with these attacks and going for third parties to secure themselves from DDoS attacks. In order to eliminate the third parties. Our proposed system uses machine learning algorithms to identify the incoming packet is malicious or not and use Blockchain technology to store the Blacklist. The key benefit of Blockchain is that blacklisted IP addresses are effectively stored, and usage of such infrastructure provides an advantage of extra security mechanism over existing DDoS mitigation systems. This paper has evaluated three different algorithms, such as the KNN Classifier, the Decision Tree Classifier, Random Forest algorithm to find out the better classifying algorithm. Tree Based Classifier technique used for Feature Selection to boost the computational time. Out of the three algorithms, Random Forest provides an accuracy about 95 % in real-time traffic analysis.
EOSIO has become one of the most popular blockchain platforms since its mainnet launch in June 2018. In contrast to the traditional PoW-based systems (e.g., Bitcoin and Ethereum), which are limited by low throughput, EOSIO is the first high throughput Delegated Proof of Stake system that has been widely adopted by many decentralized applications. Although EOSIO has millions of accounts and billions of transactions, little is known about its ecosystem, especially related to security and fraud. In this paper, we perform a large-scale measurement study of the EOSIO blockchain and its associated DApps. We gather a large-scale dataset of EOSIO and characterize activities including money transfers, account creation and contract invocation. Using our insights, we then develop techniques to automatically detect bots and fraudulent activity. We discover thousands of bot accounts (over 30% of the accounts in the platform) and a number of real-world attacks (301 attack accounts). By the time of our study, 80 attack accounts we identified have been confirmed by DApp teams, causing 828,824 EOS tokens losses (roughly \$2.6 million) in total.
Zakaria Abou El Houda, Abdelhakim Hafid, Lyes Khoukhi
Nowadays, blockchain technology is seen as one of the main technological innovations to emerge since the advent of the internet. Many applications can benefit from blockchain to protect their exchanges. Nonetheless, applications with more restricted interests cannot use public blockchains. Permissioned blockchains promise to combine effectiveness of blockchains with stricter permissions to join blockchain's network. In permissioned blockchain, the number of participating entities is limited compared to public blockchain. However, by targeting the peers of the blockchain, the attackers can easily take control of consensus process and halt the blockchain operations. In this paper, we propose BrainChain, a scalable and efficient scheme to protect permissioned blockchain nodes from the largest ever Distributed Denial of Service (DDoS) attack (i.e., Domain Name System (DNS) amplification attack) in the context of software defined networks (SDN). BrainChain consists of 4 schemes: (1) Flow statistics collection scheme (FS) to gather the features of flows in an efficient way using sFlow; (2) Entropy based scheme (ES) to measure disorder of network features; (3) Bayes Network based Filtering scheme (BF) to classify, based on entropy values, illegitimate DNS requests; and (4) DNS Mitigation (DM) scheme to mitigate in an effective way the illegitimate flows (i.e., illegitimate DNS requests). Experimental results show that BrainChain can quickly and effectively detect and mitigate the attacks (i.e., DNS amplification attacks) with a high accuracy and a small false positive rate making it a promising scheme to protect blockchain applications from DNS Amplification attacks.
Cryptocurrencies are the digital currencies designed to replace the regular cash money while taking place in our daily lives especially for the last couple of years. Mining cryptocurrencies are one of the popular ways to have them and make a profit due to unstable values in the market. This attracts attackers to utilize malware on internet users’ computer resources, also known as cryptojacking, to mine cryptocurrencies. Cryptojacking started to be a major issue in the internet world. In this case, we developed MiNo, a web browser add-on application to detect these malicious mining activities running without the user’s permission or knowledge. This add-on provides security and efficiency for the computer resources of the internet users. MiNo designed and developed with double-layer protection which makes it ahead of its competitors in the market.
Mehrdad Hajizadeh, Nima Afraz, Marco Ruffini, Thomas Bauschert
The legacy security defense mechanisms cannot resist where emerging sophisticated threats such as zero-day and malware campaigns have profoundly changed the dimensions of cyber-attacks. Recent studies indicate that cyber threat intelligence plays a crucial role in implementing proactive defense operations. It provides a knowledge-sharing platform that not only increases security awareness and readiness but also enables the collaborative defense to diminish the effectiveness of potential attacks. In this paper, we propose a secure distributed model to facilitate cyber threat intelligence sharing among diverse participants. The proposed model uses blockchain technology to assure tamper-proof record-keeping and smart contracts to guarantee immutable logic. We use an open-source permissioned blockchain platform, Hyperledger Fabric, to implement the blockchain application. We also utilize the flexibility and management capabilities of Software-Defined Networking to be integrated with the proposed sharing platform to enhance defense perspectives against threats in the system. In the end, collaborative DDoS attack mitigation is taken as a case study to demonstrate our approach.
Intrusion Detection System is a well-known term in the domain of Network and Information Security. It's one of the important components of the Network and Information Security infrastructure. Host Intrusion Detection System (HIDS) helps to detect unauthorized use, abnormal and malicious activities on the host, whereas Network Intrusion Detection System (NIDS) helps to detect attacks and intrusion on networks. Various researchers are actively working on different approaches to improving the IDS performance and many improvements have been achieved. However, development in many other technologies and newly emerging techniques always opens the doors of opportunity to add a sharp edge to IDS and to make it more robust and reliable. This paper proposes the development of Distributed Intrusion Detection System (DIDS) using emerging and promising technologies like Blockchain upon a stable platform like cloud infrastructure.
Osama Alkadi, Nour Moustafa, Benjamin Turnbull, Kim‐Kwang Raymond Choo
There has been significant research in incorporating both blockchain and intrusion detection to improve data privacy and detect existing and emerging cyberattacks, respectively. In these approaches, learning-based ensemble models can facilitate the identification of complex malicious events and concurrently ensure data privacy. Such models can also be used to provide additional security and privacy assurances during the live migration of virtual machines (VMs) in the cloud and to protect Internet-of-Things (IoT) networks. This would allow the secure transfer of VMs between data centers or cloud providers in real time. This article proposes a deep blockchain framework (DBF) designed to offer security-based distributed intrusion detection and privacy-based blockchain with smart contracts in IoT networks. The intrusion detection method is employed by a bidirectional long short-term memory (BiLSTM) deep learning algorithm to deal with sequential network data and is assessed using the data sets of UNSW-NB15 and BoT-IoT. The privacy-based blockchain and smart contract methods are developed using the Ethereum library to provide privacy to the distributed intrusion detection engines. The DBF framework is compared with peer privacy-preserving intrusion detection techniques, and the experimental outcomes reveal that DBF outperforms the other competing models. The framework has the potential to be used as a decision support system that can assist users and cloud providers in securely migrating their data in a timely and reliable manner.
In recent years, the number of malware continues to grow, which has a huge impact on individuals, enterprises and so on. In this paper, a method of malware classification and sharing based on Threat Intelligence is proposed, which transforms malware into gray-scale image and uses broad learning system to classify malware. we design a malware intelligence storage system based on IPFS and Ethereum smart contract. For classified intelligence, it is uploaded by user node to realize the prevention from single node to full node. Experiments show that the performance of this algorithm is better than other classification algorithms, and the decentralized storage system based on blockchain is more secure and efficient.
Muhammad Asaad Cheema, Hassaan Khaliq Qureshi, Chrysostomos Chrysostomou, Marios Lestas
In this paper, we present a distributed machine learning based intrusion detection system in Internet of Things (IoT) utilizing Blockchain technology. In particular, spectral partitioning is proposed to divide the IoT network into autonomous systems (AS) enabling traffic monitoring for intrusion detection (ID) to be performed by the selected AS border area nodes in a distributed manner. The ID system is based on machine learning, where a support-vector machine algorithm is trained using prominent IoT data sets and detection of the attackers is provided. Furthermore, the integrity of the attackers' list is offered by utilizing Blockchain technology, which enables a distributed sharing of the attackers' information among the AS border area nodes of the Blockchain network. Simulations are performed to evaluate different aspects of the proposed IoT system and demonstrate the potential of integrating machine learning based ID to a distributed spectral partitioned Blockchain network.
Blockchain is a service operated by a peer-to-peer type distributed network, and protocol control such as JSON-RPC is implemented as the interface for flexibility and operability. However, attacks that use protocol control against vulnerable and unmanaged interfaces have been reported. One of the methods to track cyber attacks on such a malicious user's network service is a honeypot that imitates the service and acquires attacker's behavior information. In this research, focusing on the Ethereum network, the behavior of malicious users is clarified using malicious communication history sent to simple honeypots installed in nine countries, Ethereum network information and darknet arrival packets. By analyzing these, the behavior of attackers and the tendency of requests were elucidated, and primary safety measures were established.
The concept of microservices architecture has nowadays become popular in the development of most software systems due to their benefits of application modularity and flexibility. Nevertheless, such architecture poses new security concerns especially on how to handle APIs that act as points of communication between different services. Traditional API protection strategies, based on predetermined patterns and a centralized platform, can be ineffective in guarding microservices because of the loosely connected structure of the latter. These limitations make APIs a sweet spot of highly skilled cyber threats like unauthorized data access, injection assaults, and Distributed Denial of Service (DDoS). This research presents a conceptual framework known as Dynamic Adaptive API Security Framework that uses Artificial Intelligence (AI) and blockchain technology to address these challenges. This first one uses AI to monitor API traffic and detect anomalies in real time with the help of the proposed framework. Through anomaly detection, machine learning models can detect unusual activity such as Suspicious usage patterns, patterns with malicious payloads, and pattern of many API calls. Also, AI offers an analytic feature, which can predict the vulnerability a certain target, based on data from previous attacks, and allow targeted prevention. Alongside AI, blockchain innovation is used to create an unalterable, distributed record of communication between API. Based on consensus mechanisms like Proof of Stake or Practical Byzantine Fault Tolerance, the framework guarantees the provenance of API transaction logs. These logs offer a great resource for the forensic activities in case of a breach of the system’s security. Also, smart contracts support even complex and constantly changing dynamic access control policies, adjusting as soon as AI-driven threat intelligence data is available. This synergy of using AI and blockchain in the framework generates an adaptable, transparent, and resilient security model that interfaces threats. Real-time anomaly detection together with immutable auditability integrated in the proposed framework improves the level of API security in microservices while simultaneously supporting GDPR and HIPAA compliance. This approach fills the gap in existing security solutions which cannot cope with the growing security issues in microservices format, providing a long-term solution for increasing security of complicated, decentralized microservices landscape. Summing up, this work presents a new comprehensive strategy to API security using the advantages of both AI and blockchain technologies. Applying the framework identifies how these technologies can be synchronously balanced and orchestrated to respond to threats, protect data input, and offer clear microservices security and foundation for the advancement of subsequent generation of software.
Dimitri Kamenski, Arash Shaghaghi, Matthew Warren, Salil S. Kanhere
We focus on the problem of botnet orchestration and discuss how attackers can leverage decentralised technologies to dynamically control botnets with the goal of having botnets that are resilient against hostile takeovers. We cover critical elements of the Bitcoin blockchain and its usage for `floating command and control servers'. We further discuss how blockchain-based botnets can be built and include a detailed discussion of our implementation. We also showcase how specific Bitcoin APIs can be used in order to write extraneous data to the blockchain. Finally, while in this paper, we use Bitcoin to build our resilient botnet proof of concept, the threat is not limited to Bitcoin blockchain and can be generalized.
Nahom Aron Dawit, Sujith Samuel Mathew, Kadhim Hayawi
Cyber-security is indispensable as malicious incidents are ubiquitous on the Internet. Intrusion Detection Systems have an important role in detecting and thwarting cyber-attacks. However, it is more effective in a centralized system but not in peer-to-peer networks which makes it subject to central point failure, especially in collaborated intrusion detection systems. The novel blockchain technology assures a fully distributed security system through its powerful features of transparency, immutability, decentralization, and provenance. Therefore, in this paper, we investigate and demonstrate several methods of collaborative intrusion detection with blockchain to analyze the suitability and security of blockchain for collaborative intrusion detection systems. We also studied the difference between the existing means of the integration of intrusion detection systems with blockchain and categorized the major vulnerabilities of blockchain with their potential losses and current enhancements for mitigation.