Christopher Molloy, Philippe Charland, Steven H. H. Ding, Benjamin C. M. Fung
Cyber threat intelligence (CTI) has become a critical component of the defense of organizations against the steady surge of cyber attacks. Malware is one of the most challenging problems for CTI, due to its prevalence, the massive number of variants, and the constantly changing threat actor behaviors. Currently, Malpedia has indexed 2,390 unique malware families, while the AVTEST Institute has recorded more than 166 million new unique malware samples in 2021. There exists a vast number of variants per malware family. Consequently, the signature-based representation of patterns and knowledge of legacy systems can no longer be generalized to detect future malware attacks. Machine learning-based solutions can match more variants. However, as a black-box approach, they lack the explainability and maintainability required by incident response teams.There is thus an urgent need for a data-driven system that can abstract a future-proof, human-friendly, systematic, actionable, and dependable knowledge representation from software artifacts from the past for more effective and insightful malware triage. In this paper, we present the first phenotype-based malware decomposition system for quick malware triage that is effective against malware variants. We define phenotypes as directly observable characteristics such as code fragments, constants, functions, and strings. Malware development rarely starts from scratch, and there are many reused components and code fragments. The target under investigation is decomposed into known phenotypes that are mapped to known malware families, malware behaviors, and Advanced Persistent Threat (APT) groups. The implemented system provides visualizable phenotypes through an interactive tree map, helping the cyber analysts to navigate through the decomposition results. We evaluated our system on 200,000 malware samples, 100,000 benign samples, and a malware family with over 27,284 variants. The results indicate our system is scalable, efficient, and effective against zero-day malware and new variants of known families.
Eugene B. Chang, Paul J. Darcy, Kim‐Kwang Raymond Choo, Nhien‐An Le‐Khac
Cryptocurrency has been (ab)used to purchase illicit goods and services such as drugs, weapons and child pornography (also referred to as child sexual abuse materials), and thus mobile devices (where cryptocurrency wallet applications are installed) are a potential source of evidence in a criminal investigation. Not surprisingly, there has been increased focus on the security of cryptocurrency wallets, although forensic extraction and attribution of forensic artefacts from such wallets is understudied. In this paper, we examine Bitcoin and Dogecoin. The latter is increasingly popular partly due to endorsements from celebrities and being positioned as an introductory path to cryptocurrency for newcomers. Specifically, we demonstrate how one can acquire forensic artefacts from Android Bitcoin and Dogecoin cryptocurrency wallets, such as wallet IDs, transaction IDs, timestamp information, email addresses, cookies, and OAuth tokens.
Smart contracts are self-executing programs that run on the blockchain and make it possible for peers to enforce agreements without a third-party guarantee. The smart contract on Ethereum is the fundamental element of decentralized finance with billions of US dollars in value. Smart contracts cannot be changed after deployment and hence the code needs to be verified for potential vulnerabilities. However, smart contracts are far from being secure and attacks exploiting vulnerabilities that have led to losses valued in the millions. In this work, we explore the current state of smart contracts security, prevalent vulnerabilities, and security-analysis tool support, through reviewing the latest advancement and research published in the past five years. We study 13 vulnerabilities in Ethereum smart contracts and their countermeasures, and investigate nine security-analysis tools. Our findings indicate that a uniform set of smart contract vulnerability definitions does not exist in research work and bugs pertaining to the same mechanisms sometimes appear with different names. This inconsistency makes it difficult to identify, categorize, and analyze vulnerabilities. We explain some safeguarding approaches and best practices. However, as technology improves new vulnerabilities may emerge. Regarding tool support, SmartCheck, DefectChecker, contractWard, and sFuzz tools are better choices in terms of more coverage of vulnerabilities; however, tools such as NPChecker, MadMax, Osiris, and Sereum target some specific categories of vulnerabilities if required. While contractWard is relatively fast and more accurate, it can only detect pre-defined vulnerabilities. The NPChecker is slower, however, can find new vulnerability patterns.
The goal of the thesis is to study and perform an analysis of the possible attack vectors on the Iota network 2.0 version of the protocol. In this work, existing attack vectors on Distributed Ledger Technologies are studied and their applicability to the Iota 2.0 protocol is discussed. A specific attack that targets the capability of honest participants to write to the ledger is presented and analyzed in a network of nodes that run a full node software version.
Quang-Thang Nguyen, Do Bao Son, Thi Tam Nguyen, Ba-Lam Do
Currently, the number of smart contracts using Solidity language in Ethereum increases at a breakneck speed. In this context, optimizing gas fees in smart contracts becomes necessary to save costs for both developers and users who interact directly with these contracts. To optimize gas, developers typically need to have deep knowledge of blockchain and programming languages, making it a significant challenge for new programmers. In this paper, we introduce GasSaver - an open-source tool that analyzes Solidity-based contracts and suggests modifications to reduce transaction fees. Our tool, which relies on a set of seven rules for identifying non-optimized codes, shows that 6,333 in a total of 10,245 top most interactive contracts on Ethereum contain at least one optimization problem and the total problems are more than 30,000. Hence, the use of this tool can reduce a considerable cost for the deployment and interaction of smart contracts.
Kunjian Song, Nedas Matulevicius, Eddie B. de Lima Filho, Lucas C. Cordeiro
Smart contracts written in Solidity are programs used in blockchain networks, such as Etherium, for performing transactions. However, as with any piece of software, they are prone to errors and may present vulnerabilities, which malicious attackers could then use. This paper proposes a solidity frontend for the efficient SMT-based context-bounded model checker (ESBMC), named ESBMC-Solidity, which provides a way of verifying such contracts with its framework. A benchmark suite with vulnerable smart contracts was also developed for evaluation and comparison with other verification tools. The experiments performed here showed that ESBMC-Solidity detected all vulnerabilities, was the fastest tool and provided a counterexample for each benchmark. A demonstration is available at https://youtu.be/3UH8_1QAVN0.
Mitchell Olsthoorn, Dimitri Stallenberg, Arie van Deursen, Annibale Panichella
Ethereum is the largest and most prominent smart contract platform. One key property of Ethereum is that once a contract is deployed, it can not be updated anymore. This increases the importance of thoroughly testing the behavior and constraints of the smart contract before deployment. Existing approaches in related work either do not scale or are only focused on finding crashing inputs. In this tool demo, we introduce SynTest-Solidity, an automated test case generation and fuzzing framework for Solidity. SynTest-Solidity implements various metaheuristic search algorithms, including random search (traditional fuzzing) and genetic algorithms (i.e., NSGA-II, MOSA, and DynaMOSA). Finally, we performed a preliminary empirical study to assess the effectiveness of SynTest-Solidity in testing Solidity smart contracts.
The detection of smart contracts vulnerability is a valuable research problem because smart contracts hold a huge amount of cryptocurrency. In the past, popular detection tools were mainly based on some traditional techniques such as fuzzing and symbolic execution, which rely on fixed expert features or patterns and often miss many vulnerabilities. Recent machine learning approaches alleviate this issue but do not notice the semantic information in the source code. In this paper, we develop a system called SVChecker to classify the smart contract source code written in Solidity. To show the superiority of our system, we conduct experiments on more than 40,000 smart contracts collected from Ethereum. Empirically, our experimental results demonstrate that our system outperforms all popular detection tools.
May 20, 2022·2022 3rd International Conference on Computer Vision, Image and Deep Learning & International Conference on Computer Engineering and Applications (CVIDL & ICCEA)
The security problem within cryptocurrencies has high priority since it is published. The news of cryptocurrencies attack is keeping rising, and types of attacks are recorded as the classical security issues such as the most famous one decentralized autonomous organization (DAO) attack and which caused 3.6 million cryptocurrencies stolen. Thus, with the ripe fuzzing technique, using such testing skills on smart contracts to discover more bugs and leaks hidden in cryptocurrencies in a more automatic and intelligent approach could bring huge benefits. This paper is aimed to analyze the variation from the very first smart contract tools to the newest one, to discuss their pros and cons of them. This experiment mainly chose three fuzzing tools, several basic and classic smart contracts as tested material, and recorded the performance of fuzzing contracts of each tool. And the results are clear to show that even the newest fuzzer has a better performance than the other, but it is better to use it depending on the specific requirements while the rest of the two fuzzing tools has some advantages in some aspect. Therefore, this paper could make guidance for the later researcher to use exactly the type of fuzzer they need.
May 20, 2022·2022 3rd International Conference on Computer Vision, Image and Deep Learning & International Conference on Computer Engineering and Applications (CVIDL & ICCEA)
Smart contract is the key core part of the blockchain’s operation, which has the feature that it cannot be changed after deploying, resulting in the fact that the vulnerabilities associated with smart contracts cannot be fixed. Currently, deep learning has the best performance for detecting smart contract vulnerabilities. However, the common deep learning method treats the smart contract source code as a text sequence, ignoring the running logic and data flow of the program, and can not extract the constructed features. In this paper, a modular vulnerability detection model Link-DC is proposed. the model takes the contract graph constructed by smart contracts and the pattern features defined by expert knowledge as the original data input to capture richer feature information through stitching. Then, the deep and cross network is adopted to construct low-dimensional and sparse features into high-dimensional nonlinear features, thus improving the performance and efficiency of detection. Extensive experiments are conducted on smart contracts with vulnerabilities on the Ether and VNTChain platforms. The experiment results show that the high detection accuracy performance of the Link-DC model is obtained, where the accuracy of detection of re-entry vulnerability, timestamp-dependent vulnerability, and infinite loop vulnerability reaches 94.37%, 92.11%, and 85.29%, respectively.
Ethereum is a blockchain platform that enables the use of smart contracts. Smart contracts will execute a set of instructions without an intermediary party when called upon. The possibility to make calls to another contract or exchange cryptocurrency allows for potential exploits to occur, most notable reentrancy. The Solidity language for coding smart contracts has syntactic constructs created to be safer alternatives, and guards to aid in securing code against exploits. In this paper, we collect a total of 26,799 verified Solidity smart contracts from Etherscan, to analyze the language constructs used in calling another contract or exchanging ether. We also analyze the usage of guards to make the code more secure. For instance, even though call is the unsafest function, it is still used by 50% of the contracts in our dataset. The safe method transfer is used by approximately one-third of contracts, and send is rarely used. We noticed that contracts using call have a higher average and median size in Lines of Code than normal. We also found an increased percentage of call contracts using more guards. Moreover, 97% of all contracts are using the require guard, with 23 uses of require on average per contract. This may be an indication that Solidity developers are using more guards to prevent exploits in their contracts
Shunhui Ji, Shaoqing Zhu, Pengcheng Zhang, Hai Dong · 5 authors
Smart contracts are commonly deployed for safety-critical applications, the quality assurance of which has been a vital factor. Test cases are standard means to ensure the correctness of data flows in smart contracts. To more efficiently generate test cases with high coverage, we propose an improved genetic algorithm-based test-case generation approach for smart contract data flow testing. Our approach introduces the theory of particle swarm optimization into the genetic algorithm, which reduces the influence brought by the randomness of genetic operations and enhances its capability to find global optima. A set of 30 real smart contracts deployed on Ethereum and GitHub is collected to perform the experimental study, on which our approach is compared with three baseline approaches. The experimental results show that, in most cases, the coverage of the test cases generated by our approach is significantly higher than the baseline approaches with relatively lower numbers of iterations and lower execution time.
Blockchain technologies have found important and concrete applications in the real world. Active solutions leverage Smart Contracts for the management of cryptocurrencies, sensitive data, and other valuable assets. One of the core objectives of blockchain-oriented software engineering (BOSE) is ensuring that Smart Contracts receive adequate pre-release testing to guarantee the deployment of reliable code. However, the novelty and the complexity of the blockchain environment pose new challenges to the validation and verification of Smart Contract based software. In this paper, we analyze the aforementioned challenges to foster the discussion on the specific topic of Smart Contract testing and identify relevant research directions.
Smart contracts are self-executing programs that are stored on the blockchain. Once a smart contract is compiled and deployed on the blockchain, it cannot be modified. Therefore, having a bug-free smart contract is vital. To ensure a bug-free smart contract, it must be tested thoroughly. However, little is known about how developers test smart contracts in practice. Our study explores 139 open source smart contract projects that are written in Solidity to investigate the state of smart contract testing from three dimensions: (1) the developers working on the tests, (2) the used testing frameworks and testnets and (3) the type of tests that are conducted. We found that mostly core developers of a project are responsible for testing the contracts. Second, developers typically use only functional testing frameworks to test a smart contract, with Truffle being the most popular one. Finally, our results show that functional testing is conducted in most of the studied projects (93%), security testing is only performed in a few projects (9.4%) and traditional performance testing is conducted in none. In addition, we found 34 projects that mentioned or published external audit reports.
Randhir Kumar, Prabhat Kumar, Abhinav Kumar, A. Antony Franklin · 5 authors
The softwarized infrastructure of Software-Defined Industrial Internet of Things (SDIIoT) offers a cost-effective solution to improve flexibility and reliability in network management but faces several critical challenges. First, th Majority of SDIIoT entities operate over wireless channel, which expose them to a variety of attacks (e.g., man-in-the-middle, replay, and impersonation attacks) and also the centralized nature of SDN controller is prone to single point attacks. Second, network traffic in the SDIIoT is associated with large scale, high dimension and redundant data, all of which present significant hurdles in the development of efficient flow analyzer. In this regard, we present a novel blockchain and Deep Learning (DL) integrated framework for protecting confidential information and hunting cyber threats against SDIIoT and their network traffic. First the blockchain module is proposed to securely transmit industrial data from IIoT sensors to controllers of SDN via forwarding nodes (i.e., OpenFLow switches) using Clique Proof-of-Authority (C-PoA) consensus mechanism. A novel flow analyzer based on DL architecture named LSTMSCAE-AGRU is designed by combining Long Short-Term Memory Stacked Contractive AutoEncoder (LSTMSCAE) with Attention-based Gated Recurrent Unit (AGRU) at the control plane. The latter first extracts low-dimensional features in an unsupervised manner, which is then fed to AGRU for hunting anomalous switch requests. The proposed framework can withstand a variety of well-known cyber threats and mitigate the single point of controller failure problem in SDIIoT.
Zheyuan He, Zhou Liao, Luo Feng, Dijun Liu · 6 authors
The development of blockchain has promoted the prosperity of the cryptocurrency ecosystem. The majority of cryptocurrencies are ERC20 tokens implemented based on Ethereum contracts. The major role of ERC20 tokens is to carry out various trades and loans in decentralized applications (DApps). To participate in DApps, users must grant the DApps permission to spend tokens on user behalf. However, if the authorization logic of token contract is flawed implementation, the holder of token will suffer tremendous financial losses. In this work, we detect the authentication implementation of the flaws in ERC20 token, which has not been done before. We find the authentication process of the token is implemented by operating the authentication data structure of the token. Therefore, we capture the operations of the authentication data structure in token contract to infer authentication behaviors and detect authentication defects. However, it’s not a simple task as most smart contracts are not open source and the bytecode of token contract lacks type information. To tackle these problems, we utilize symbolic execution on the token bytecode, then identify the authentication data structure and capture the operations by parsing the symbolic expressions, and finally detect authentication defects through the inferred authentication behavior. To best our knowledge, this is the first work to detect the flaws in the implementation of authentication in ERC20 Token. To automate the analysis, we implement our approach in a new tool named TokenCat and use it to inspect 245,822 tokens. As a result, the TokenCat found 491 ERC20 token authentication implementation flaws with 94% precision.
Learning smart contract representations can greatly facilitate the development of smart contracts in many tasks such as bug detection and clone detection. Existing approaches for learning program representations are difficult to apply to smart contracts which have insufficient data and significant homogenization. To overcome these challenges, in this paper, we propose SRCL, a novel, self-supervised approach for learning smart contract representations. Unlike existing supervised methods, which are tied on task-specific data labels, SRCL leverages large-scale unlabeled data by self-supervised learning of both local and global information of smart contracts. It automatically extracts structural sequences from abstract syntax trees (ASTs). Then, two discriminators are designed to guide the Transformer encoder to learn local and global semantic features of smart contracts. We evaluate SRCL on a dataset of 75,006 smart contracts collected from Etherscan. Experimental results show that SRCL considerably outperforms the state-of-the-art code representation models on three downstream tasks.
Rana Faisal Hayat, Sana Aurangzeb, Muhammad Aleem, Gautam Srivastava · 5 authors
Distributed denial of service (DDoS) attacks as well as botnet-based attacks are among the most important security vulnerabilities in Internet of Things (IoT) environments. Most of the existing research approaches use centralized defense mechanisms to prevent DDoS attacks in IoT environments. However, it is important to provide a reliable and scalable solution to prevent DDoS attacks. Combining technologies such as distributed blockchain-based mechanisms and smart contracts facilitates the construction of a trusted distributed framework that can defend against DDoS attacks in IoT. In this article, we have proposed a multilevel DDoS mitigation approach (ML-DDoS) to protect IoT devices and other computing resources or machines using the blockchain-based framework. The core concept of the proposed system is to use a device-based verification mechanism using blockchain and exclude malicious devices from IoT environments. The proposed framework was developed using Hyperledger Caliper (a blockchain benchmark tool) and its performance was evaluated using three benchmark applications. Compared to the state of the art, the results show that the proposed framework achieves up to 35% improvement in throughput, up to 40% improvement in latency, and up to 25% better utilization of CPU.
To address the challenge of representing ransomware-cryptocurrency payments, this article outlines a novel approach to the extraction and sharing of threat intelligence data from the Bitcoin blockchain. This work results in the creation of two new cyber-observable objects, x-cryptocurrency-address, and x-cryptocurrency-transaction.
Smart contracts are usually financial-related, which makes them attractive attack targets. Many static analysis tools have been developed to facilitate the contract audit process, but not all of them take account of two special features of smart contracts: (1) The external variables, like time, are constrained by real-world factors; (2) The internal variables persist between executions. Since these features import implicit constraints into contracts, they significantly affect the performance of static tools, such as causing errors in reachability analysis and resulting in false positives. In this paper, we conduct a systematic study on implicit constraints from three aspects. First, we summarize the implicit constraints in smart contracts. Second, we evaluate the impact of such constraints on the state-of-the-art static tools. Third, we propose a lightweight but effective mitigation method named ConSym to deal with such constraints and integrate it into OSIRIS. The evaluation result shows that ConSym can filter out 96% of false positives and reduce false negatives by two-thirds.
Alex Groce, Kush Jain, Rijnard van Tonder, Goutamkumar Tulajappa Kalburgi · 5 authors
Bitcoin is one of the most prominent distributed software systems in the world. This paper describes an effort to investigate and enhance the effectiveness of the Bitcoin Core fuzzing effort. The effort initially began as a query about how to escape saturation in the fuzzing effort, but developed into a more general exploration. This paper summarizes the outcomes of a two-week focused effort. While the effort found no smoking guns indicating major test/fuzz weaknesses, it produced a large number of additional fuzz corpus entries, increased the set of fuzzers used for Bitcoin Core, and ran mutation analysis of Bitcoin Core fuzz targets, with a comparison to Bitcoin functional tests and other cryptocurrencies’ tests. Our conclusion is that for high quality fuzzing efforts, improvements to the oracle may be the best way to get more out of fuzzing.
As a computer program running on top of blockchain, smart contract not only proliferates the diversity of applications but also brings a myriad of security issues that lead to huge financial losses. As a result, security evaluation of smart contracts, such as vulnerability identification and attack detection, has received extensive attention in recent years. Given that various types of approaches have been proposed for smart contract security analysis, a systematization of knowledge for this domain is needed. To this end, in this paper, we systematically review the related literature in recent years and describe the mainstream approaches to the security evaluation of smart contracts. Specifically, we classify state-of-the-art analysis techniques for smart contract analysis into two categories, namely, code-based approaches and transaction-based approaches. Further, we elaborate on the key techniques adopted by these works respectively. We highlight and summarize the key challenges in future research for smart contract security analysis. Our research provides a more in-depth understanding of the state-of-the-art works for securing smart contracts, which may shed light on future research in this area.