Privacy-focused crypto-currencies, such as Zcash or Monero, aim to provide strong cryptographic guarantees for transaction confidentiality and unlinkability.In this paper, we describe side-channel attacks that let remote adversaries bypass these protections.We present a general class of timing side-channel and traffic-analysis attacks on receiver privacy.These attacks enable an active remote adversary to identify the (secret) payee of any transaction in Zcash or Monero.The attacks violate the privacy goals of these crypto-currencies by exploiting side-channel information leaked by the implementation of different system components.Specifically, we show that a remote party can link all transactions that send funds to a user, by measuring the response time of that user's P2P node to certain requests.The timing differences are large enough that the attacks can be mounted remotely over a WAN.We responsibly disclosed the issues to the affected projects, and they have patched the vulnerabilities.We further study the impact of timing side-channels on the zero-knowledge proof systems used in these cryptocurrencies.We observe that in Zcash's implementation, the time to generate a zero-knowledge proof depends on secret transaction data, and in particular on the amount of transacted funds.Hence, an adversary capable of measuring proof generation time could break transaction confidentiality, despite the proof system's zero-knowledge property.Our attacks highlight the dangers of side-channel leakage in anonymous crypto-currencies, and the need to systematically protect them against such attacks.
Matteo Signorini, Matteo Pontecorvi, Waël Kanoun, Roberto Di Pietro
Anomaly detection tools play a role of paramount importance in protecting networks and systems from unforeseen attacks, usually by automatically recognizing and filtering out anomalous activities. Over the years, different approaches have been designed, all focused on lowering the false positive rate. However, no proposal has addressed attacks specifically targeting blockchain-based systems. In this paper, we present BAD: Blockchain Anomaly Detection. This is the first solution, to the best of our knowledge, that is tailored to detect anomalies in blockchain-based systems. BAD is a complete framework, relying on several components leveraging, at its core, blockchain meta-data in order to collect potentially malicious activities. BAD enjoys some unique features: (i) it is distributed (thus avoiding any central point of failure); (ii) it is tamper-proof (making it impossible for a malicious software to remove or to alter its own traces); (iii) it is trusted (any behavioral data is collected and verified by the majority of the network); and, (iv) it is private (avoiding any third party to collect/analyze/store sensitive information). Our proposal is described in detail and validated via both experimental results and analysis, that highlight the quality and viability of our Blockchain Anomaly Detection solution.
This paper reviews the background and related studies in the areas of cloud systems, intrusion detection and blockchain applications against cyber attacks. This work aims to discuss collaborative anomaly detection systems for discovering insider and outsider attacks from cloud centres, including the technologies of virtualisation and containerisation, along with trusting intrusion detection and cloud systems using blockchain. Moreover, the ability to detect such malicious attacks is critical for conducting necessary mitigation, at an early stage, to minimise the impact of disruption and restore cloud operations and their live migration processes. This paper presents an overview of cloud architecture and categorises potential state-of-the-art security events based on their occurrence at different cloud deployment models. Network Intrusion Detection Systems (NIDS) in the cloud, involving types of classification and common detection approaches, are also described. Collaborative NIDSs for cloud-based blockchain applications are also explained to demonstrate how blockchain can address challenges related to data privacy and trust management. A summary of the research challenges and future research directions in these fields is also explained.
Bruno Rodrigues, Trendafilov Spasen, Eder J. Scheid, Burkhard Stiller
Distributed Denial-of-Service (DDoS) attacks remains as one of the major causes of concerns for service providers around the world. This paper introduces SC-FLARE, a Smart Contract (SC) based cooperative signaling protocol built on top of a Ethereum Proof-of-Authority Blockchain (BC) for the sharing of attack information, the exchange of incentives, and the tracking of reputation in a fully distributed and automated fashion. By making use of BC and SC, SC-FLARE provide the required collaborative platform without the burden to maintain, design, and develop special registries and gossip protocols for a cooperative defense.
In the paper "A blockchain-Based Architecture for Collaborative DDoS Mitigation," Rodrigues, Bocek, Lareida, Hausheer, Rafati, and Stiller proposed a collaborative DDoS signaling system using the Ethereum blockchain and smart contract for AS owners to cooperate and mitigate a DDoS attack in a fully decentralized manner. Rodrigues, Bocek, and Stiller later created a proof-of-concept of this system and called it Blockchain Signaling System (BloSS). In their architecture, AS owners will deploy their smart contract on the Ethereum blockchain for other members to signal when they are under attack by sending IP addresses to be white or blacklisted to the smart contract. BloSS uses a central registry to store information on participating Autonomous Systems (AS) IP addresses it managed, Ethereum wallet addresses, and their smart contact address for victims to report attacker's IP addresses in the event of a DDoS attack. However, a trusted central authority is required to manage the registry. The members of the collaboration need to believe that the central authority is honest in performing its role since membership in the alliance is up to the central authority discretion. McCorry, Siamak, and Hao present a decentralized and self-tallying voting protocol with maximum voter secrecy using Ethereum smart contract called Open Vote Network (OV-net) that does not rely upon any trusted authority to tally the vote. Nevertheless, it still requires an administrator to set up the election and add voters to the election. Therefore, the voters still need to trust a central authority to manage the election and to make sure those who are eligible to vote are in the voters' list. The goal of this project is to implement a self-managed blockchain scheme based on the collaborative DDoS mitigation architecture proposed by Rodrigues et al., where participation in the collaboration requires members' consensus. We introduced a decentralized autonomous organization (DAO) smart contract called ElectionCommissioner to manage the membership to BloSS central registry. The addition or removal of member needs to the registry needs to be proposed by an existing member. When a member submits a proposal, the Election Commissioner will advertise the proposal to the community. The members then register their interest to vote by sending their voting key and Ethereum token (ETH) as a deposit, which is refundable after the election. The Election Commissioner executes an “election process” (described in section IV) to determine the support for a proposal to add or remove a member. After voting, the Election Commissioner will tally the vote and if the executes the proposal if it is accepted by most of the registered voters.
Pavlos Papadopoulos, Nikolaos Pitropakis, William J. Buchanan, Owen Lo · 5 authors
The Domain Name System (DNS) was created to resolve the IP addresses of the web servers to easily remembered names. When it was initially created, security was not a major concern; nowadays, this lack of inherent security and trust has exposed the global DNS infrastructure to malicious actors. The passive DNS data collection process creates a database containing various DNS data elements, some of which are personal and need to be protected to preserve the privacy of the end users. To this end, we propose the use of distributed ledger technology. We use Hyperledger Fabric to create a permissioned blockchain, which only authorized entities can access. The proposed solution supports queries for storing and retrieving data from the blockchain ledger, allowing the use of the passive DNS database for further analysis, e.g. for the identification of malicious domain names. Additionally, it effectively protects the DNS personal data from unauthorized entities, including the administrators that can act as potential malicious insiders, and allows only the data owners to perform queries over these data. We evaluated our proposed solution by creating a proof-of-concept experimental setup that passively collects DNS data from a network and then uses the distributed ledger technology to store the data in an immutable ledger, thus providing a full historical overview of all the records.
Cryptocurrencies have been a target for cybercriminal activities because of the pseudo-anonymity and privacy they offer. Researchers have been actively working on analyzing and developing innovative defensive mechanisms to prevent these activities. A significant challenge facing researchers is collecting datasets to train defensive systems to detect and analyze these cyberattacks. Our aims in this systematic review are to explore and aggregate the state of the art threats that have emerged with cryptocurrencies and the defensive mechanisms that have been proposed. We also discuss the threats type, scale, and how efficient the defensive mechanisms are in providing early detection and prevention. We also list out the resources that have been used to collect datasets, and we identify the publicly available ones. In this study, we extracted 1,221 articles from four top scientific and engineering databases and libraries in Computer Science: IEEE Xplore, ACM Digital Library, Elsevier's Scopus, and Crarivate's Web of Science. We defined inclusion, exclusion, and quality of assessment criteria, and after a detailed review process, 66 publications were included in the final review. Our analysis revealed that the literature contains a significant amount of research to detect and analyze several attack types, such as the high yield investment programs and pump and dump. These attacks have been used to steal millions of USD, abuse millions of connected devices, and have created even more significant loss in denial of services and productivity losses. We have found that the researchers use various sources to collect training datasets. Many authors have made their dataset publicly available. We have created a list of these datasets, which we have made available along with other supplementary websites, tools, and libraries that can be used in the data collection and analysis process.
This paper describes a simulation study on security attacks over Distributed Ledger Technologies (DLTs). We specifically focus on attacks at the underlying peer-to-peer layer of these systems, that is in charge of disseminating messages containing data and transaction to be spread among all participants. In particular, we consider the Sybil attack, according to which a malicious node creates many Sybils that drop messages coming from a specific attacked node, or even all messages from honest nodes. Our study shows that the selection of the specific dissemination protocol, as well as the amount of connections each peer has, have an influence on the resistance to this attack.
Blaž Podgorelec, Muhamed Turkanović, Sašo Karakatič
The basis of blockchain-related data, stored in distributed ledgers, are digitally signed transactions. Data can be stored on the blockchain ledger only after a digital signing process is performed by a user with a blockchain-based digital identity. However, this process is time-consuming and not user-friendly, which is one of the reasons blockchain technology is not fully accepted. In this paper, we propose a machine learning-based method, which introduces automated signing of blockchain transactions, while including also a personalized identification of anomalous transactions. In order to evaluate the proposed method, an experiment and analysis were performed on data from the Ethereum public main network. The analysis shows promising results and paves the road for a possible future integration of such a method in dedicated digital signing software for blockchain transactions.
Ahmet Kurt, Enes Erdin, Mumin Cebe, Kemal Akkaya · 5 authors
While various covert botnets were proposed in the past, they still lack complete anonymization for their servers/botmasters or suffer from slow communication between the botmaster and the bots. In this paper, we propose a new generation hybrid botnet that covertly and efficiently communicates over Bitcoin Lightning Network (LN), called LNBot. LN is a payment channel network operating on top of Bitcoin network for faster Bitcoin transactions with negligible fees. Exploiting various anonymity features of LN, we designed a scalable two-layer botnet which completely anonymize the identity of the botmaster. In the first layer, the botmaster sends commands anonymously to the C&C servers through LN transactions. Specifically, LNBot allows botmaster's commands to be sent in the form of surreptitious multihop LN payments, where the commands are encoded with ASCII or Huffman encoding to provide covert communications. In the second layer, C&C servers further relay those commands to the bots they control in their mini-botnets to launch any type of attacks to victim machines. We implemented a proof-of-concept on the actual LN and extensively analyzed the delay and cost performance of LNBot. Our analysis show that LNBot achieves better scalibility compared to the other similar blockchain botnets with negligible costs. Finally, we also provide and discuss a list of potential countermeasures to detect LNBot activities and minimize its impacts.
Yi Zhong, Anmin Zhou, Lei Zhang, Jing Fan · 5 authors
As the root cause of illegal cyber activities, botnets are evolving continuously over the last two decades. Current researches on botnet command and control mechanism based on blockchain network suffer from high economic cost, single point of failure, and limited scalability. In this paper, we present DUSTBot, a novel P2P botnet model based on Bitcoin transactions to prepare for new cyber threats. Specifically, a covert, duplex, and low-cost command and control (C&C) channel in the Bitcoin network is presented in our work. DUSTBot uses the Bitcoin main network as the downstream channel while using the Bitcoin testnet as the upstream channel. Furthermore, the peer list exchange algorithm based on the Ethereum block hash proposed in this paper is effective against routing table poisoning attack and P2P botnet crawling. The robustness of DUSTBot against node removal is studied through constructing the botnet with a P2P simulator. We deploy the implementation of DUSTBot on cloud platforms to test its feasibility and performance. Moreover, the stealthiness of DUSTBot and the effectiveness of the proposed peer list exchange algorithm are evaluated. The results demonstrate the feasibility, performance, stealthiness, and robustness of DUSTBot. In the end, possible countermeasures are discussed to mitigate similar threats in the future.
A DDoS attack is a spiteful attempt to disrupt legitimate traffic to a server by overwhelming the target with a flood of requests from geographically dispersed systems. Today attackers prefer DDoS attack methods to disrupt target services as they generate GBs to TBs of random data to flood the target. In existing mitigation strategies, because of lack of resources and not having the flexibility to cope with attacks by themselves, they are not considered to be that effective. So effective DDoS mitigation techniques can be provided using emerging technologies such as blockchain and SDN(Software-Defined Networking). We propose an architecture where a smart contract is deployed in a private blockchain, which facilitates a collaborative DDoS mitigation architecture across multiple network domains. Blockchain application is used as an additional security service. With Blockchain, shared protection is enabled among all hosts. With help of smart contracts, rules are distributed among all hosts. In addition, SDN can effectively enable services and security policies dynamically. This mechanism provides ASes(Autonomous Systems) the possibility to deploy their own DPS(DDoS Prevention Service) and there is no need to transfer control of the network to the third party. This paper focuses on the challenges of protecting a hybridized enterprise from the ravages of rapidly evolving Distributed Denial of Service(DDoS) attack.
Phan The Duy, Hien Do Hoang, Do Thi Thu Hien, Nguyen Ba Khanh · 5 authors
Despite bringing many benefits of global network configuration and control, Software Defined Networking (SDN) also presents potential challenges for both digital forensics and cybersecurity. In fact, there are various attacks targeting a range of vulnerabilities on vital elements of this paradigm such as controller, Northbound and Southbound interfaces. In addition to solutions of security enhancement, it is important to build mechanisms for digital forensics in SDN which provide the ability to investigate and evaluate the security of the whole network system. It should provide features of identifying, collecting and analyzing log files and detailed information about network devices and their traffic. However, upon penetrating a machine or device, hackers can edit, even delete log files to remove the evidences about their presence and actions in the system. In this case, securing log files with fine-grained access control in proper storage without any modification plays a crucial role in digital forensics and cybersecurity. This work proposes a blockchain-based approach to improve the security of log management in SDN for network forensics, called SDNLog-Foren. This model is also evaluated with different experiments to prove that it can help organizations keep sensitive log data of their network system in a secure way regardless of being compromised at some different components of SDN.
Data security plays an important role in the healthcare monitoring systems, where critical patient data is transacted over the internet especially through wireless devices, wireless routes such as optical radio channels, or optical fiber-related transport networks. In one way or the other every device is connected to internet and we address such things as internet connected things. As the network is moving towards wireless applications, the threat to attack is also becoming a crucial issue. These attacks can be identified through various intrusion detection techniques and some of which were discussed in the previous decades. The intrusion detection technique is used to identify the privacy breach in the network. Its main purpose is to detect the unauthorized access. Some of the systems or networks that need protection are part of wireless networks (Things connected to internet). Wireless network applications comprises of WLANs (Wireless Local Area Networks), WPANs (Wireless Personal Area Networks), ad hoc networks etc. Since digitization is taking place in each and every sector and so the threat to data also exist. In this article, we protect IoT based E-healthcare systems by using a novel concept called “Blockchain Technology”.
Smart grid (SG) has given a better vision for electricity infrastructure. The quality, quantity of power transmitted and the usage of available data from smart sensing, metering and communication has dramatically increased with the introduction of smart grid to power systems. SG also has empowered customer participation by managing their load pattern to take advantage of choosing their supply and pricing options. The heart of the SG lies on the communication between the consumers and the grid operators. Grids operators need the real time customer meter data to schedule their supply and pricing policies and the consumers need the same to manage their loads. The Wireless Sensor Network (WSN) uses Aggregation Protocol with Error Detection (APED) to improve the security of data. The SG with SCADA is facilitated by data acquisitions which includes the meter reading, system conditions, etc. that are monitored and transmitted at regular intervals in real time. The security of data transfer is assured by the introduction of improvised Ciphertext Policy_ Attribute Based Encryption (CP-ABE) is used to achieve the security parameters like confidentiality, integrity, and availability in cloud computing. Block chain-based systems combine distributed register and cryptographic security measures. Introduction of block chain in SG has revolutionized the functioning of SG with smart contracts, and transaction of huge amount of data in a fully decentralized market platform.This paper reviews the modern technologies used in smart grid communication based on IEEE 802.15.4 standard to the SG and how it is modified to ensure effective, efficient and economical and secured communication of the huge real time data from the smart meters.
Jonathan Myers, Leonardo Babun, Edward Yao, Sarah C. Helble · 5 authors
In the Internet of Things (IoT), applications hosted on resource-limited devices interact with the user and the physical world to provide digital connectivity and automation to daily activities, and frequently provide a point of entry into networks. However, many IoT applications are vulnerable to cyber attacks that can put networks, data, and connected devices at risk. Integrity measurement is an active defense technique used to detect malicious modification of software at runtime. While its usefulness has been well-demonstrated, integrity measurement is application-dependent and requires domain knowledge of the targeted software. Currently, adding integrity measurement to a platform requires substantial human effort, and thus application has been limited to usage on widely-deployed software such as the Linux kernel. Due to the diversity of IoT, vendors are unlikely to devote a substantial amount of effort to add integrity measurement systems to their devices. In this paper we introduce MAD- IOT (Memory Anomaly Detection for the Internet of Things), an integrity measurement framework for IoT. In order to provide low-cost integrity measurement agents and software anomaly detection for IoT platforms, MAD-IOT uses a process called IMAGE: Integrity Measurement Agent GEneration. The IMAGE process uses machine learning to automatically generate integrity measurement agents for arbitrary IoT devices. We demonstrated MAD-IOT and IMAGE on a proof-of-concept testbed and evaluated its performance with supervised and unsupervised machine learning models. Our results indicate that IMAGE is highly effective in recognizing known forms of misbehavior on IoT app operations, and very promising in identifying zero-day attacks. Finally, MAD-IOT introduces minimal overhead, making it feasible to implement on systems with very limited resources.
The massive spread of harmful content on the internet is hard to filter. Meanwhile, blacklist content filtering cannot keep up with the rapid growth of content creations. As a result, an extra protection layer is required to provide a safe internet for children. However, implementing a network or application firewall requires an expert's knowledge and complicated maintenance. In this paper, we proposed a framework to automate internet protection by using whitelist packet filtering. We use the blockchain smart contract as the secure collaboration media to determine the filtering rules. Meanwhile, the SDN controller automates the packet filtering by installing the determined forwarding rules into the network switches. We evaluate the whitelist packet filtering by using Mininet for the network emulation and Ethereum Rinkeby networks for the smart contract implementation. The result shows that the proposed whitelist system can filter the packet without incurring significant latency. It supports fast content update with a maximum speed of ≈ 1200 valid contents per-minute by using a three-votes verification system.
The lack of supervision is an important reason that hinders the development of cryptocurrencies. In the case of Bitcoin, many lawless elements use Bitcoin for illegal transactions. With the decentralization and anonymity provided by Blockchain, it is difficult for finance institudes to identify them by traditional means of supervision. Based on the existing research on Bitcoin server tracing, this paper proposes an efficient Bitcoin client tracing mechanism to trace from Bitcoin server to the client through traffic analysis. Experiments are carried out and show that under the condition of general network connection, the tracing accuracy is close to no error.