May 1, 2022·2022 IEEE 8th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing, (HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS)
Smart contracts are distributed, self-executing programs on blockchain network and they have the potential to impact many industries. A large number of developers are optimistic about the development prospects of smart contracts. However, due to different levels of familiarity of developers with technology, the existence of serious vulnerabilities in code can result in huge property losses. The serious consequences of reentrancy vulnerabilities have attracted widespread attention from researchers, and researchers have proposed many approaches to detect them. Many experiments show that these approaches can only effectively detect certain types of vulnerabilities. Similar vulnerabilities still exist in some smart contracts. In this paper, we propose a semantic analysis-based detection method for reentrancy vulnerabilities. The method utilizes machine learning techniques to efficiently detect the vulnerabilities of the given code. And then, our method provides semantic analysis-based effective correction feedback of the code. Compared with the existing vulnerability detection tools Slither and Mythril, our method improves the work efficiency. Moreover, compared with the current Mythril method with the best vulnerability detection accuracy, our method improves the accuracy by 1.01%.
Mitchell Olsthoorn, Dimitri Stallenberg, Arie van Deursen, Annibale Panichella
Ethereum is the largest and most prominent smart contract platform. One key property of Ethereum is that once a contract is deployed, it can not be updated anymore. This increases the importance of thoroughly testing the behavior and constraints of the smart contract before deployment. Existing approaches in related work either do not scale or are only focused on finding crashing inputs. In this tool demo, we introduce SynTest-Solidity, an automated test case generation and fuzzing framework for Solidity. SynTest-Solidity implements various metaheuristic search algorithms, including random search (traditional fuzzing) and genetic algorithms (i.e., NSGA-II, MOSA, and DynaMOSA). Finally, we performed a preliminary empirical study to assess the effectiveness of SynTest-Solidity in testing Solidity smart contracts.
In today's era, internet-connected things provide immense opportunities to the world for enhancing the quality of lives through better data processing and intelligent decision making. Since the last decade, IoT brought numerous changes in people's personal as well as professional lives. With the enhancement in quality of lives, IoT also comes up with challenges such as security and privacy of data and devices. Every day, the attacker generates new zero-day attacks for IoT devices and data, and it's important to detect and protect the IoT eco-system from this type of attacks. Numerous researchers have proposed security schemes and methods to protect the IoT eco-system through either cryptography way or learning technique based way. AI and ML learning techniques have got immense popularity in handling the IoT security challenges as they are automatic in nature and can outperform provided the sufficient quality and quantity of data. Moreover, the AI techniques, including ML, DL and FL helps in intelligent decision-making and can also generate knowledge through its learning techniques. AI needs data to process, and IoT supplies the necessary data to process. In this paper, we provide a state-of-the-art survey for IoT security solutions proposed based on learning techniques. We provide an in-depth review of available learning techniques to solve critical security challenges such as IoT authentication, access control, anomaly detection and malware analysis. At the end, we also highlighted various futuristic technologies that can invigorate IoT research and help in the design of full proof IoT eco-system.
Ye Wang, Patrick Zuest, Yaxing Yao, Zhicong Lu · 5 authors
Decentralized finance (DeFi) enables crypto-asset holders to conduct complex financial transactions, while maintaining control over their assets in the blockchain ecosystem. However, the transparency of blockchain networks and the open mechanism of DeFi applications also cause new security issues. In this paper, we focus on sandwich attacks, where attackers take advantage of the transaction confirmation delay and cause financial losses for victims. We evaluate the impact and investigate users’ perceptions of sandwich attacks through a mix-method study. We find that due to users’ lack of technical background and insufficient notifications from the markets, many users were not aware of the existence and the impact of sandwich attacks. They also had a limited understanding of how to resolve the security issue. Interestingly, users showed high tolerance for the impact of sandwich attacks on individuals and the ecosystem, despite potential financial losses. We discuss general implications for users, DeFi applications, and the community.
Internet technologies, new era of advancements, have changed inter-connectivity among people at an incredible scale over the last decade. The next revolution is projected towards creation of connectivity among diverse things, resulting in a smart environment. The need for data-on- demand continues to rise as we advance from World Wide Web to web2 i.e. social networking web. The world has now advanced to web3 i.e. ubiquitous computing or web of things. There is no doubt that IoT is progressing more and more, while offering a wide range of smart solutions and innovative applications. However, with such advancements in IoT, some vulnerabilities are also there. The expanding trend of cyber assaults such as DoS, sniffing attack, port scanning etc., on systems core, along with system underlying flaws, is a subject of worry for both the companies as well as customers. The goal of this research is to quantify the category of various system related flaws that compromise IoT infrastructure and leads to cybercrime, as well as to create a justification for more research into this developing technology. This paper also presents a detailed overview of attacks in IoT along with security requirements that will be helpful for securing IoT from threats and attacks.
Distributed ledger systems have become more prominent and successful in recent years, with a focus on blockchains and cryptocurrency. This has led to various misunderstandings about both the technology itself and its capabilities, as in many cases blockchain and cryptocurrency is used synonymously and other applications are often overlooked. Therefore, as a whole, the view of distributed ledger technology beyond blockchains and cryptocurrencies is very limited. Existing vocabularies and ontologies often focus on single aspects of the technology, or in some cases even just on one product. This potentially leads to other types of distributed ledgers and their possible use cases being neglected. In this paper, we present a knowledge graph and an ontology for distributed ledger technologies, which includes security considerations to model aspects such as threats and vulnerabilities, application domains, as well as relevant standards and regulations. Such a knowledge graph improves the overall understanding of distributed ledgers, reveals their strengths, and supports the work of security personnel, i.e. analysts and system architects. We discuss potential uses and follow semantic web best practices to evaluate and publish the ontology and knowledge graph.
Tanusree Sharma, Zhixuan Zhou, Andrew Miller, Yan Wang
Smart contracts are self-executing programs that run on blockchains (e.g., Ethereum). 680 million US dollars worth of digital assets controlled by smart contracts have been hacked or stolen due to various security vulnerabilities in 2021. Although security is a fundamental concern for smart contracts, it is unclear how smart contract developers approach security. To help fill this research gap, we conducted an exploratory qualitative study consisting of a semi-structured interview and a code review task with 29 smart contract developers with diverse backgrounds, including 10 early stage (less than one year of experience) and 19 experienced (2-5 years of experience) smart contract developers. Our findings show a wide range of smart contract security perceptions and practices including various tools and resources they used. Our early-stage developer participants had a much lower success rate (15%) of identifying security vulnerabilities in the code review task than their experienced counterparts (55%). Our hierarchical task analysis of their code reviews implies that just by accessing standard documentation, reference implementations and security tools is not sufficient. Many developers checked those materials or used a security tool but still failed to identify the security issues. In addition, several participants pointed out shortcomings of current smart contract security tooling such as its usability. We discuss how future education and tools could better support developers in ensuring smart contract security.
Elvira Albert, Pablo Gordillo, Alejandro Hernández-Cerezo, Albert Rubio · 5 authors
Smart contracts are programs deployed on a blockchain. They are executed for a monetary fee paid in gas —a clear optimization target for smart contract compilers. Because smart contracts are a young, fast-moving field without (manually) fine-tuned compilers, they highly benefit from automated and adaptable approaches, especially as smart contracts are effectively immutable, and as such need a high level of assurance. This makes them an ideal domain for applying formal methods. Super-optimization is a technique to find the best translation of a block of instructions by trying all possible sequences of instructions that produce the same result. We present a framework for super-optimizing smart contracts based on Max-SMT with two main ingredients: (1) a stack functional specification extracted from the basic blocks of a smart contract, which is simplified using rules capturing the semantics of arithmetic, bit-wise, and relational operations, and (2) the synthesis of optimized blocks , which finds—by means of an efficient SMT encoding—basic blocks with minimal gas cost whose stack functional specification is equal (modulo commutativity) to the extracted one. We implemented our framework in the tool syrup 2.0 . Through large-scale experiments on real-world smart contracts, we analyze performance improvements for different SMT encodings, as well as tradeoffs between quality of optimizations and required optimization time.
Siwei Wu, Lei Wu, Yajin Zhou, Runhuai Li · 8 authors
Ethereum has been attracting lots of attacks, hence there is a pressing need to perform timely investigation and detect more attack instances. However, existing systems suffer from the scalability issue due to the following reasons. First, the tight coupling between malicious contract detection and blockchain data importing makes them infeasible to repeatedly detect different attacks. Second, the coarse-grained archive data makes them inefficient to replay transactions. Third, the separation between malicious contract detection and runtime state recovery consumes lots of storage. In this article, we propose a scalable attack detection framework named EthScope , which overcomes the scalability issue by neatly re-organizing the Ethereum state and efficiently locating suspicious transactions. It leverages the fine-grained state to support the replay of arbitrary transactions and proposes a well-designed schema to optimize the storage consumption. The performance evaluation shows that EthScope can solve the scalability issue, i.e., efficiently performing a large-scale analysis on billions of transactions, and a speedup of around \( \text{2,300}\times \) when replaying transactions. It also has lower storage consumption compared with existing systems. Further analysis shows that EthScope can help analysts understand attack behaviors and detect more attack instances.
Sabreen Ahmadjee, Carlos Mera‐Gómez, Rami Bahsoon, Rick Kazman
Blockchain is a disruptive technology intended to implement secure decentralised distributed systems, in which transactional data can be shared, stored, and verified by participants of the system without needing a central authentication/verification authority. Blockchain-based systems have several architectural components and variants, which architects can leverage to build secure software systems. However, there is a lack of studies to assist architects in making architecture design and configuration decisions for blockchain-based systems. This knowledge gap may increase the chance of making unsuitable design decisions and producing configurations prone to potential security risks. To address this limitation, we report our comprehensive systematic literature review to derive a taxonomy of commonly used architecture design decisions in blockchain-based systems. We map each of these decisions to potential security attacks and their posed threats. MITRE’s attack tactic categories and Microsoft STRIDE threat modeling are used to systematically classify threats and their associated attacks to identify potential attacks and threats in blockchain-based systems. Our mapping approach aims to guide architects to make justifiable design decisions that will result in more secure implementations.
The book begins with an analysis of distributed ledger technology, and its principal innovation, the ability to replace a central authority with a decentralised consensus mechanism. The chapter illustrates how this new technology might drive the dis-intermediation of financial services, using the first cryptocurrency, Bitcoin, and the subsequent innovation of the wider capabilities of Ethereum as examples. The chapter then traces cryptocurrencies back to their philosophical roots in the Cypherpunk movement of the 1980s and 1990s and the libertarian ideas that continue to underpin many digital asset projects.
Context: Smart contracts are computer programs that are automatically executed on the blockchain. Vulnerabilities in their implementation have led to severe loss of cryptocurrency. Smart contracts become immutable when deployed to the Ethereum blockchain. Therefore, it is essential to understand the nature of vulnerabilities in Ethereum smart contracts to prevent them in the future. Existing classifications exist, but are limited in several ways. Objective: We aim to characterize vulnerabilities in Ethereum smart contracts written in Solidity, and unify existing classifications schemes. Method: We extracted 2143 vulnerabilities from public coding platforms and popular vulnerability databases and categorized them using a card sorting approach. We targeted the Ethereum blockchain in this paper, as it is the first and most popular blockchain to support the deployment of smart contracts, and Solidity as the most widely used language to implement smart contracts. We devised a classification scheme of smart contract vulnerabilities according to their error source and impact. Afterwards, we mapped existing classification schemes to our classification. Results: The resulting classification consists of 11 categories describing the error source of a vulnerability and 13 categories describing potential impacts. Our findings show that the language specific coding and the structural data flow categories are the dominant categories, but that the frequency of occurrence differs substantially between the data sources. Conclusions: Our findings enable researchers to better understand smart contract vulnerabilities by defining various dimensions of the problem and supporting our classification with mappings with literature-based classifications and frequency distributions of the defined categories.
Miner malware has been steadily increasing in recent years as the value of cryptocurrency rises, which poses a considerable threat to users’ device security. Miner malware has obvious behavior patterns in order to participate in blockchain computing. However, most miner malware detection methods use raw bytes feature and sequential opcode as detection features. It is difficult for these methods to obtain better detection results due to not modeling robust features. In this paper, a miner malware identification method based on graph classification network is designed by analyzing the features of function call graph and control flow graph of miner malware, called MBGINet. MBGINet can model the behavior graph relationship of miner malware by extracting the connection features of critical nodes in the behavior graph. Finally, MBGINet transforms these node features into the feature vectors of the graph for miner malware identification. In the test experiments, datasets with different volumes are used for simulating real-world scenarios. The experimental results show that the MBGINet method achieves a leading and stable performance compared to the dedicated opcode detection method and obtains an accuracy improvement of 3.08% on the simulated in-the-wild dataset. Meanwhile, MBGINet gains an advantage over the general malware detection method Malconv. These experimental results demonstrate the superiority of the MBGINet method, which has excellent characteristics in adapting to realistic scenarios.
Heidelinde Rameder, Monika di Angelo, Gernot Salzer
Programs on public blockchains often handle valuable assets, making them attractive targets for attack. At the same time, it is challenging to design correct blockchain applications. Checking code for potential vulnerabilities is a viable option to increase trust. Therefore, numerous methods and tools have been proposed with the intention to support developers and analysts in detecting code vulnerabilities. Moreover, publications keep emerging with different focus, scope, and quality, making it difficult to keep up with the field and to identify relevant trends. Thus, regular reviews are essential to keep pace with the varied developments in a structured manner. Regarding blockchain programs, Ethereum is the platform most widely used and best documented. Moreover, applications based on Ethereum are entrusted with billions of USD. Like on similar blockchains, they are subject to numerous attacks and losses due to vulnerabilities that exist at all levels of the ecosystem. Countermeasures are in great demand. In this work, we perform a systematic literature review (SLR) to assess the state of the art regarding automated vulnerability analysis of smart contracts on Ethereum with a focus on classifications of vulnerabilities, detection methods, security analysis tools, and benchmarks for the assessment of tools. Our initial search of the major on-line libraries yields more than 1,300 publications. For the review, we apply a clear strategy and protocol to assure consequent, comprehensive, and reproducible documentation and results. After collecting the initial results, cleaning up references, removing duplicates and applying the inclusion and exclusion criteria, we retain 303 publications that include 214 primary studies, 70 surveys and 19 SLRs. For quality appraisal, we assess their intrinsic quality (derived from the reputation of the publication venue) as well as their contextual quality (determined by rating predefined criteria). For about 200 publications with at least a medium score, we extract the vulnerabilities, methods, and tools addressed, among other data. In a second step, we synthesize and structure the data into a classification of both the smart contract weaknesses and the analysis methods. Furthermore, we give an overview of tools and benchmarks used to evaluate tools. Finally, we provide a detailed discussion.
Kelechi G. Eze, Cajetan M. Akujuobi, Shermar Hunter, Shumon , Alam · 6 authors
The Internet of Things (IoT) is growing at a very fast pace and being increasingly adopted in many scenarios of industrial applications such as energy (smart grid), automobile (smart cars), healthcare (smart healthcare), manufacturing (smart manufacturing and supply chain) and other application such as homes (smart home) and cities (smart city). Nonetheless, these IoT technologies (devices, systems, protocols, and applications) are faced with many security-related issues. IoT Systems have different layers that are vulnerable to various kinds of attacks. To defend against these attacks, one must consider appropriate security approaches and mechanisms to ensure privacy, security, and trust within the various components and layers that make up the IoT system. Appropriate security mechanism is needed at every layer of an IoT system to keep them secure. Hence, finding suitable mechanism for each IoT layer is a necessity to keep IoT systems secure in the 21st-century applications and implementations. The paper first investigates the IoT layers and protocols, their vulnerability issues, and methods to resolve the issues from existing literatures. We then present a blockchain-based security architecture for the internet of things and practically investigated its security feature through implementation of various security mechanism. Analysis and discussion of the blockchain implementation results are carried for the purpose of meeting the security, privacy, and trust requirements of IoT.
Alessandra Rizzardi, Sabrina Sicari, Daniele Miorandi, Alberto Coen‐Porisini
Abstract Security and privacy of information transmitted among the devices involved in an Internet of Things (IoT) network represent relevant issues in IoT contexts. Guaranteeing effective control and supervising access permissions to IoT applications is a complex task, mainly due to resources' heterogeneity and scalability requirements. The design and development of highly customizable access control policies, along with an efficient mechanism for ensuring that the rules applied by the IoT platform are not tampered with or violated, will undoubtedly have a significant impact on the diffusion of IoT‐based solutions. In such a direction, the article proposes the integration of a permissioned blockchain within an honest‐but‐curious (i.e., not trusted) IoT distributed middleware layer, which aims to guarantee the correct management of access to resources by the interested parties. The result is a robust and lightweight system, able to manage the data produced by IoT devices, support relevant security features, such as integrity and confidentiality, and resist different kinds of attacks. The use of blockchain will ensure the tamper‐resistance and synchronization of the distributed system, where various stakeholders own applications and IoT platforms. The methodology and the proposed architecture are validated employing a test‐bed.
A secure electronic learning platform has been created to enable teachers and students to log into their accounts to learn efficiently and safely at any place and time. This platform has been proposed due to the urgent need to develop the education system and move it from traditional to interactive e-learning. In this paper, an application implemented that access remotely using a web browser interface and saved on a server depends on a Zero-Knowledge Proof (ZKP) system with an RSA algorithm was employed to solve registration and login challenges and securely transfer passwords. Using adapted AES to encrypt each user's personal information, Exams, and save it in in encrypted form in the database. The simulated results in this paper indicate the existence of a secure e-learning system, where security was achieved by performing the registration and login process without sending the password in its explicit form over an insecure network such as the Internet, in addition to encrypting the necessary information to be stored in an incomprehensible manner in the database, in the case of presence of an attack on the database.
With the rapid development of the informatization and industrialization of the Internet of Vehicles (IoV), the number and application of connected vehicles are growing rapidly. The safety problem is related to the property and life of human beings, which has attracted extensive attention from academic and industrial circles. Based on the study of high-quality literature published in the past decade and other high-level research works, this paper first analyzes the forms of attack against the Internet of Vehicles from the two aspects of attack mode and target. Then, it summarizes the existing blockchain-based system framework of the Internet of Vehicles (BIoV) and then discusses the security solutions of blockchain-based vehicles from the aspects of authentication, privacy, trust management, access control, and so on, to support the distributed system architecture and solve the security challenges of the Internet of Vehicles. Finally, the technical difficulties and the direction of further research of BIoV are summarized.
The first special section is dedicated to Edge Consumer Electronics (ECE) that include gadgets or appliances, equipped with contemporary circuitry to carry out domestic tasks. They are designed and used exclusively for communication, entertainment, safety, and home-office endeavors. The abundance of consumer electronics is indebted to the semiconductor and appliance of related software solutions. T
Developing secure smart contracts remains a challenging task. Existing approaches are either impractical or leave the burden to developers for fixing bugs. In this paper, we propose the first practical smart contract compiler, called HCC, which automatically inserts security hardening checks at the source-code level based on a novel and language-independent code property graph (CPG) notation. The high expressiveness of our developed CPG allows us to mitigate all of the most common smart contract vulnerabilities, namely reentrancy, integer bugs, suicidal smart contracts, improper use of tx.origin, untrusted delegate-calls, and unchecked low-level call bugs. Our large-scale evaluation on 10k real-world contracts and several sets of vulnerable contracts from related work demonstrates that HCC is highly practical, outperforms state-of-the-art contract hardening techniques, and effectively prevents all verified attack transactions without hampering functional correctness.
Ethereum Smart Contracts based on Blockchain Technology (BT) enables monetary transactions among peers on a blockchain network independent of a central authorizing agency. Ethereum Smart Contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This enables consumers to make agreements in a transparent and conflict-free environment. However, there exist some security vulnerabilities within these smart contracts that are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. This paper presents a framework and empirical analysis that use code clone detection techniques for identifying vulnerabilities and their variations in smart contracts. Our empirical analysis is conducted using the Nicad code clone detection tool on a dataset of approximately 50k Ethereum smart contracts. We evaluated VOLCANO on two datasets, one with confirmed vulnerabilities and another with approximately 50k random smart contracts collected from the Etherscan. Our approach shows an improvement in the detection of vulnerabilities in terms of coverage and efficiency when compared to two of the publicly available static analyzers to detect vulnerabilities in smart contracts. To the best of our knowledge, this is the first study that uses a clone detection technique to identify vulnerabilities and their evolution in Ethereum smart contracts.
Vehicular Ad-hoc networks (VANETs) during the communication process, nodes are always varying and the process is always under security threats like Sybil attacks, masquerading attacks, etc. In order to reduce the probability of these attacks and to regulate traffic flow in the network, a software-defined network (SDN) is used. The SDN is used for implementing protocols like OpenFlow and reducing the routing load in the network, but it doesn’t provide a high level of security to the network, hence protocols like encryption, hashing, etc. are applied to the VANET. In the paper, SDN based blockchain-inspired algorithm is implemented, which coordinates network traffic and improves the overall security of the network. Security analysis of the proposed algorithm shows that the combination of blockchain with encrypted SDN is removing more than 95% of the network attacks as compared to its non-blockchain counterparts.
Abstract The recent years have garnered huge attention towards the Internet of Things (IoT) because it enables its consumers to improve their lifestyles and professionally keep up with the technological advancements in the cyber-physical world. The IoT edge devices are heterogeneous in terms of the technology they are built on and the storage file formats used. These devices require highly secure modes of mutual authentication to authenticate each other before actually sending the data. Mutual authentication is a very important aspect of peer-to-peer communication. Secure session keys enable these resource-constrained devices to authenticate each other. After successful authentication, a device can be authorized and can be granted access to shared resources. The need for validating a device requesting data transfer to avoid data privacy breaches that may compromise confidentiality and integrity. Blockchain and artificial intelligence (AI) both are extensively being used as an integrated part of IoT networks for security enhancements. Blockchain provides a decentralized mechanism to store validated session keys that can be allotted to the network devices. Blockchain is also used to load balance the stressing edge devices during low battery levels. AI on the other hand provides better learning and adaptiveness towards IoT attacks. The integration of newer technologies in IoT key management yields enhanced security features. In this article, we systematically survey recent trending technologies from an IoT security point of view and discuss traditional key security mechanisms. This article delivers a comprehensive quality study for researchers on authentication and session keys, integrating IoT with blockchain and AI-based authentication in cybersecurity.