Targets of cyber crime are not exclusive to the private sector. Successful cyber attacks on nation-states have proved that cyber threats can jeopardize significant national interests. In response, nation-states have begun to handle cyber threats at the national defense level, which is titled ‘cyber defense.’ The cyber defense sector is related to national security, therefore requires robust security technology. Contrary to normal systems, blockchain provides strong security properties without a centralized control entity, and as such its application in the cyber defense field is under the spotlight. In this paper, we present opportunities blockchain provides for cyber defense, research and national projects, and limitations. We constructed a survey of government documents, interviews, related news, technical reports, and research papers from 2016 to 2021. As a result, our research contributes to reducing the gap in blockchain for cyber defense by systematically conducting research and analysis. In our research, we found that not only research but also government-led plans are actively promoting blockchain, which demonstrates that blockchain will play a remarkable role in cyber defense. This paper concludes with suggestions for future research in aspects of the blockchain technology, evaluation, and survey.
The prosperity of the cryptocurrency ecosystem drives the need for digital asset trading platforms. Beyond centralized exchanges (CEXs), decentralized exchanges (DEXs) are introduced to allow users to trade cryptocurrency without transferring the custody of their digital assets to the middlemen, thus eliminating the security and privacy issues of traditional CEX. Uniswap, as the most prominent cryptocurrency DEX, is continuing to attract scammers, with fraudulent cryptocurrencies flooding in the ecosystem. In this paper, we take the first step to detect and characterize scam tokens on Uniswap. We first collect all the transactions related to Uniswap V2 exchange and investigate the landscape of cryptocurrency trading on Uniswap from different perspectives. Then, we propose an accurate approach for flagging scam tokens on Uniswap based on a guilt-by-association heuristic and a machine-learning powered technique. We have identified over 10K scam tokens listed on Uniswap, which suggests that roughly 50% of the tokens listed on Uniswap are scam tokens. All the scam tokens and liquidity pools are created specialized for the "rug pull" scams, and some scam tokens have embedded tricks and backdoors in the smart contracts. We further observe that thousands of collusion addresses help carry out the scams in league with the scam token/pool creators. The scammers have gained a profit of at least $16 million from 39,762 potential victims. Our observations in this paper suggest the urgency to identify and stop scams in the decentralized finance ecosystem, and our approach can act as a whistleblower that identifies scam tokens at their early stages.
Blockchain technology is continually gaining momentum, with applications expanding in sectors beyond digital assets and financial services. With the existence of a public distributed ledger, the validity of transactions and accounts on the blockchain can be easily reviewed. Nevertheless, there are malicious persons that attempt to fraud cryptocurrency holders, undermining the reliability of the blockchain. This study focuses on identifying fraudulent transactions and accounts by detecting anomalies in the Bitcoin and the Ethereum transaction networks, the two largest cryptocurrencies. By leveraging GPU-accelerated machine learning models, including Support Vector Machines, Random Forest, and Logistic Regression, we draw the metadata of over 30 million transactions on the Bitcoin network and confirmed transactions from over 500 thousand accounts on the Ethereum network. We offer insight into feature importance through sensitivity analysis, as well as train accurate models that allow for method adoption in automated fraud detection systems. The trained models achieve an accuracy and recall of 96.9% and 0.987 on the Bitcoin dataset, and 80.2% and 0.835 on the Ethereum dataset. The study of anomaly detection in the cryptocurrency blockchain done in this paper can be generalized to other blockchain networks, including health service blockchains, public sector blockchains, and financial intelligence blockchains.
Bitcoin's attack in finance has caused a new wind to blow in the stock market and with the emergence of many new crypto currencies, the crypto currency market has become a new financial area. Although Blockchain technology is the technological infrastructure of Bitcoin, awareness is not as high as Bitcoin. Despite it was found in 1992, its first use was in the shadow of Bitcoin, influenced by the fact that it was with Bitcoin in 2008. However, due to the features that it provides; Without Blockchain technology, the Bitcoin system would not work. As the dazzling offer of Bitcoin; through the decentralized structure, buyers and sellers can meet directly on a platform and make their purchases securely, without involvement of any third party. Verification in the system can only be done by approving by more than 50% of the participants. Thus, besides of no need for a central authority, it became almost impossible for any cyber attack to be successful. The continued success of Blockchain technology is vital for Bitcoin and other cryptographic currencies survival. Beside of all these advantages, there are some issues that need to be addressed for Blockchain technology. These can be listed as throughput, latency in processing, size and bandwidth, some security vulnerabilities, resource waste for adding a new block to chains, usability, and privacy. In this article, we will discuss these issues that need to be addressed for Blockchain technology.
Abstract Decentralized Finance (DeFi) is a system of financial products and services built and delivered through smart contracts on various blockchains. In recent years, DeFi has gained popularity and market capitalization. However, it has also been connected to crime, particularly various types of securities violations. The lack of Know Your Customer requirements in DeFi poses challenges for governments trying to mitigate potential offenses. This study aims to determine whether this problem is suited to a machine learning approach, namely, whether we can identify DeFi projects potentially engaging in securities violations based on their tokens’ smart contract code. We adapted prior works on detecting specific types of securities violations across Ethereum by building classifiers based on features extracted from DeFi projects’ tokens’ smart contract code (specifically, opcode-based features). Our final model was a random forest model that achieved an 80% F-1 score against a baseline of 50%. Notably, we further explored the code-based features that are the most important to our model’s performance in more detail by analyzing tokens’ Solidity code and conducting cosine similarity analyses. We found that one element of the code that our opcode-based features can capture is the implementation of the SafeMath library, although this does not account for the entirety of our features. Another contribution of our study is a new dataset, comprising (a) a verified ground truth dataset for tokens involved in securities violations and (b) a set of legitimate tokens from a reputable DeFi aggregator. This paper further discusses the potential use of a model like ours by prosecutors in enforcement efforts and connects it to a wider legal context.
Traditional medical systems are vulnerable to attacks, leaks, and loss of data. The centralized structure of medical systems makes them more susceptible to attacks. Blockchain can be used as a solution to this issue. In particular, using blockchain to track patient medical history and vaccination records can guarantee privacy and security, which are critical requirements for healthcare systems. In this paper, we propose a blockchain-based application to maintain and share medical data and vaccination records using Hyperledger Fabric and Ethereum platforms to ensure data integrity and immutability. Our vaccination tracking system based on the Ethereum platform allows easy verification for people who want to travel abroad. For this system, we employ Ganache to test these vaccination records in a safe and deterministic environment. We have evaluated the performance of our implementation using Hyperledger Caliper and Explorer. The results show that our blockchain-based systems can increase the efficiency and transparency of tracking medical and vaccination records. We believe our proposal is especially valuable in the context of the ongoing COVID-19 pandemic because it providesa secure way to update, share and verify vaccination records.
Marina Liu, William Yeoh, Frank Jiang, Kim‐Kwang Raymond Choo
Blockchain has transitioned beyond the hype to reality, as evidenced by the amount of research it has attracted and by its commercial applications. One popular application of blockchain is in cybersecurity, which is the focus of this paper. Specifically, we performed a systematic literature review of blockchain use cases for cybersecurity, while focusing on articles published over the past decade. Based on our analysis of 111 articles, we developed a classification framework using the thematic analysis approach. This classification framework is designed to offer readers a comprehensive perspective of the potential of blockchain to enhance cybersecurity in different contexts. The findings have implications for research and practice.
This paper presents a brief overview of blockchain and cryptocurrency for beginners in Malaysia. Cryptocurrency is an innovation for financial technology (also called FinTech) which has been innovated based on the blockchain technology. The presence of several properties provided by blockchain allows cryptocurrency to be traded and exchanged in a virtual environment; just like the common currencies used today. However, as the processes for exchanging and managing blockchain and cryptocurrency are carried out over the Internet, users are vulnerable to several cyber-attacks. Besides, the existence of cryptocurrency may lead to other crimes such as money-laundering and online gambling. Therefore, this paper discusses security issues and crimes related to cryptocurrency. Furthermore, this paper proposes an improved crypto-hygiene as the guideline to mitigate and minimize the risk of cyber-attack which may also assist beginners who wish to involve with cryptocurrency or any blockchain applications in gaining some insights and opinions regarding blockchain and cryptocurrency.
Xucan Chen, Wei Cheng, Marie Ouellet, Yuan Li · 6 authors
Darknet markets are e-commerce websites operating on the darknet and have grown rapidly in recent years. Darknet only allow cryptocurrencies as the payment methods, making it hard for law enforcement to trace those illicit transactions. In this paper, we present a method to identify vendors’ bitcoin addresses by matching vendors’ feedback reviews with bitcoin transactions in the public ledger. The problem is decomposed into two steps in formulation. In Step 1, we solve a bounding box matching between the set of feedback reviews and bitcoin transactions. In Step 2, we find the bitcoin addresses with a maximum coverage of the reviews. Baseline algorithm for Step 1 runs in quadratic time thus we develop a K-D tree to accelerate the computing. Problem in Step 2 is NP-hard thus we develop a greedy algorithm with an approximation ratio of (1 − 1/e) based on the submodular property of the objective function. We further propose a cost-effective algorithm to accelerate both steps effectively. Comprehensive experimental results have demonstrated the effectiveness and efficiency of the proposed method.
Abstract The pronounced multi-domain technologicalization specific to the last decades has had a significant impact on all areas of activity, including the financial one. The use of cyberspace to facilitate the actions undertaken in the monetary activity has generated the development of this field to the point where virtual currencies have been created and new technologies have been developed to support their use. Like any emerging domain, the cryptocurrency field and the related technology are in a relatively early stage and exclusively imply operating in cyberspace, thus generating security risks in the event of the involvement of malicious entities in illicit activities. In this context, it is worth analyzing how the improper use of the crypto domain can lead to various risks to national security.
The tremendous rise of cryptocurrency in the payment domain has unlocked huge opportunities but also raised numerous challenges in parallel involving cybercriminal activities like money laundering, terrorist financing, illegal and risky services, etc, owing to its anonymous and decentralized setup. The demand for building a more transparent cryptocurrency network, resilient to such activities, has risen extensively as more financial institutions look to incorporate it into their network. While a plethora of traditional machine learning and graph based deep learning techniques have been developed to detect illicit activities in a cryptocurrency transaction network, the challenge of generalization and robust model performance on future timesteps still exists. In this paper, we show that the model learned on transactional feature set provided in dataset (Elliptic Dataset) carry a temporal bias, i.e. they are highly dependent on the timesteps they occur. Deploying temporally biased models limits their performance on future timesteps. To address this, we propose a temporal debiasing technique using GNN based architecture that ensures generalization by adversarially learning between fraud1classification and temporal classification. The adversarial loss constructed optimizes the embeddings to ensure they 1.) perform well on fraud classification task 2.) does not contain temporal bias. The proposed architecture capture the underlying fraud patterns that remain consistent over time. We evaluate the performance of our proposed architecture on the Elliptic dataset and compare the performance with existing machine learning and graph-based architectures.1Fraud and illicit are used interchangeably in this paper
The susceptibility of cryptocurrencies to criminal activity is a vigorously debated issue of high policy relevance. Not only the share of cryptocurrency turnover linked to crime is unknown, also the question which of several cryptocurrencies are prevalent on the darknet, and hence should be prioritized in building analytical capability for law enforcement, calls for empirical research. Using the event study methodology, we estimate the market reaction on cryptocurrency exchanges to news about successful law enforcement actions of systemic relevance for the cybercriminal ecosystem. The events studied include seizures of darknet marketplaces and shutdowns of cybercriminal data centers and mixers. Although the number of relevant events is still small, we observe significant cumulative abnormal returns to such news over the past years. We cautiously interpret the obtained results by cryptocurrency and direction of the effect, and derive implications for future research and policy.
Wanqing Jie, Arthur Sandor Voundi Koe, Pengfei Huang, Shiwen Zhang
The security of smart contracts has drawn attention in recent years due to their immutability and ability to hold assets. Existing machine learning and deep learning methods addressing vulnerabilities in smart contracts often partially combine pooled features from first the contract source code, second, the build based approach made of features extracted during source code compilation, and third, the bytecode approach relying on features obtained from the Ethereum virtual machine bytecode analysis. Together those three approaches form the full-stack, and they are usually being conducted under static analysis thanks to its speed of execution. However, to the best of our knowledge, no single work has yet simultaneously undertaken a full-stack intralayer and cross-layer features fusion for smart contracts vulnerability assessment under static analysis, without making use of expert-based patterns nor without manually fusing the various features extracted from shuffled partial combinations of layers in the full-stack. This paper introduces a full-stack hierarchical fusion of static features for smart contracts vulnerability detection. In our construction, we associate each layer of the full-stack to a modality and leverage automatic intramodality and crossmodality pooled features fusion from state-of-the-art artificial neural networks and deep neural networks. Additionally, our models are applied to the hierarchy of power set layers in the full-stack, without any expert-based rule. Furthermore, our work aims to assess the increase in vulnerability detection performance and provide guidance for future research on smart contracts vulnerability detection.
At present, most smart contract vulnerability detection use manually-defined patterns, which is time-consuming and far from satisfactory. To address this issue, researchers attempt to deploy deep learning techniques for automatic vulnerability detection in smart contracts. Nevertheless, current work mostly relies on a single code representation such as AST (Abstract Syntax Tree) or code tokens to learn vulnerability characteristics, which might lead to incompleteness of learned semantics information. In addition, the number of available vulnerability datasets is also insufficient. To address these limitations, first, we construct a dataset covering most typical types of smart contract vulnerabilities, which can accurately indicate the specific row number where a vulnerability may exist. Second, for each single code representation, we propose a novel way called AFS (AST Fuse program Slicing) to fuse code characteristic information. AFS can fuse the structured information of AST with program slicing information and detect vulnerabilities by learning new vulnerability characteristic information.
Recently, phishing scams have posed a significant threat to blockchains. Phishing detectors direct their efforts in hunting phishing addresses. Most of the detectors extract target addresses’ transaction behavior features by random walking or constructing static subgraphs. The random walking methods, unfortunately, usually miss structural information due to limited sampling sequence length, while the static subgraph methods tend to ignore temporal features lying in the evolving transaction behaviors. More importantly, their performance undergoes severe degradation when the malicious users intentionally hide phishing behaviors. To address these challenges, we propose TEGDetector, a dynamic graph classifier that learns the evolving behavior features from transaction evolution graphs (TEGs). First, we cast the transaction series into multiple time slices, capturing the target address’s transaction behaviors in different periods. Then, we provide a fast nonparametric phishing detector (FD) to narrow down the search space of suspicious addresses. Finally, TEGDetector considers both the spatial and temporal evolutions toward a complete characterization of the evolving transaction behaviors. Moreover, TEGDetector utilizes adaptively learned time coefficient to pay distinct attention to different periods, which provides several novel insights. Extensive experiments on the large-scale Ethereum transaction dataset demonstrate that the proposed method achieves state-of-the-art (SOTA) detection performance. The code of TEGDetector is open sourced at https://github.com/Seaocn/TEGDetector.
JT Hamrick, Farhang Rouhi, Arghya Mukherjee, Marie Vasek · 6 authors
As the number of cryptocurrencies has exploded in recent years, so too has the fraud. One popular strategy is when actors promote coordinated purchases of coins in hopes of temporarily driving up prices. Prior work investigating such pump and dump schemes has focused on the immediate impact to prices following pump signals, which were largely interpreted as following the same strategy. The reality, as with most cybercrimes, is that the operators of the schemes try out a much more heterogeneous mix of tactics. From a population of 12,252 pump signals observed between July 2017 and January 2019, we identify and examine 3,683 so-called target-based pump signals that announce promoted coins alongside buy and sell targets, but without a coordinated purchase time. We develop a strategy to measure the success of target pumps over longer time horizons. We find that around half of these pumps reach at least one of their sell targets, and that reaching their peak price often takes days, as opposed to the seconds or minutes required in pumps studied previously. We also examine the various groups promoting coins and present evidence that groups try a variety of distinct strategies and experience varying success. We find that the most successful groups promote many coins and issue many pumps, but not for the same coins. As decentralized finance becomes more popular, a deeper understanding of price manipulation techniques like target pumps is needed to combat fraud.
Crime research has repeatedly shown that small proportions of offenders are responsible for large proportions of crimes. While there is a substantial body of evidence for this ‘offending concentration’ in connection to traditional offline crime, there is limited research assessing the concentration of offending for cybercrime. This research analyzes victim reports of Bitcoin-related cybercrimes (blackmail, ransomware, sextortion, darknet market fraud, Bitcoin tumbler fraud) to illuminate the extent of cybercrime offending concentration and to identify groups of offenders involved in online crime. Our results indicate that a large proportion of cybercrimes are associated with a small number of very active Bitcoin addresses. However, Bitcoin addresses associated to high numbers of reports are not necessarily those that generate the largest financial benefits.
Abstract The rise of cryptocurrencies during the last decade has caused growing concerns among national and international regulators. One of the risks identified is that these instruments may constitute an innovative tool for criminals when laundering money. This risk has been confirmed by numerous recent cases which have underlined the criminogenic potential of cryptocurrencies. Through the V antimoney laundering (AML) Directive, the European legislator has first regulated this emerging issue. This legislation extends the AML duties to two players of the cryptocurrencies market: exchangers and wallet providers. This choice, however, does not exploit the opportunities offered by cryptocurrencies and fails to provide a customized regulatory framework. By maintaining a traditional regulatory approach centered on intermediaries it misses the key innovation of blockchain technology: disintermediation. Compared with traditional online money flows, intermediaries are not necessary nor fundamental in the cryptocurrencies environment. Failing to adapt to this reality, the Directive is employing chivalry to fight a trench war. To guarantee the integrity of this market, the policymaker has to abandon the traditional intermediary‐centred approach in favor of a strategy that seizes the new opportunities offered by blockchain. This paper advocates for a shift from an individual‐centered approach to financial crime control to a transaction‐centered one.
The increasing popularity of cryptocurrencies has raised many questions with regard to their regulation. Issues such as taxation and its role in criminal activities are of central importance to the way in which cryptocurrency will continue to develop and occupy space in society. In this paper, such regulatory aspects are explored, and South Africa’s response is addressed. With cryptocurrency growing worldwide at increasing rates, regulators are left having to respond quickly to this aspect of financial technology and while some have banned its use outright, others have taken the stance to embrace the use of cryptocurrencies to ensure it has a space for use in the future of the financial world.
Blockchain and smart contracts can be used to facilitate almost any financial transaction. Thanks to these smart contracts, the settlement of dividends and coupons could be automated. The blockchain would allow all these transactions to be saved in a single ledger rather than in many databases through many organizations as is currently the case. Smart contracts have become lucrative and profitable targets for attackers because they can hold a large amount of money. This paper takes stock of cryptocurrency crime by assessing attacks due to smart contracts and the cost of losses. These losses are often the result of two types of malicious contracts: vulnerable contracts and criminal smart contracts. Studying the behavior of malicious contracts allows us to understand the root causes and consequences of attacks and the defense capabilities that exist although they do not definitively solve the crime problem. It makes it possible to approach new defense perspectives which will be concretized in future work.