In recent years, the number of smart contracts running in the blockchain has increased rapidly, accompanied by many security problems, such as vulnerability propagation caused by code reuse or vicious transaction caused by malicious contract deployment, for example. Most smart contracts do not publish the source code, but only the bytecode. Based on the research of bytecode similarity of smart contract, smart contract upgrade, vulnerability search and malicious contract analysis can be carried out. The difficulty of bytecode similarity research is that different compilation versions and optimization options lead to the diversification of bytecode of the same source code. This paper presents a solution, including a series of methods to measure the similarity of smart contract bytecode. Starting from the opcode of smart contract, a method of pre-training the basic block sequence of smart contract is proposed, which can embed the basic block vector. Positive samples were obtained by basic block marking, and the negative sampling method is improved. After these works, we put the obtained positive samples, negative samples and basic blocks themselves into the triplet network composed of transformers. Our solution can obtain evaluation results with an accuracy of 97.8%, so that the basic block sequence of optimized and unoptimized options can be transformed into each other. At the same time, the instructions are normalized, and the order of compiled version instructions is normalized. Experiments show that our solution can effectively reduce the bytecode difference caused by optimization options and compiler version, and improve the accuracy by 1.4% compared with the existing work. We provide a data set covering 64 currently used Solidity compilers, including one million basic block pairs extracted from them.
Document Verification using Blockchain Technology has a huge scope. With increasing documents generated every year, there is no systematic and simple way to verify the documents. This system could be used to the governments, organizations, employers and basically anybody who wants to verify that the given document is not forged. This could be used to verify all kinds of immutable records ranging from attendance records, birth certificates, graduation and academic credentials. The proposed system could be used by the government to construct a decentralized network to store and maintain record. This is also the best way to ensure that the documents exist in the state of their creation, that they are not tampered with by anyone. Motivated by this, we propose to develop a decentralized blockchain system using Ethereum that will serve as an application to authenticate the documents. An application will be installed to local systems in which the users will verify the documents. These local systems also known as “Nodes” or “Blocks”.Once the documents are added to blocks forming the blockchain, complex calculations are performed to find the unique hash for that particular document.This concept can be implemented through decentralized applications deployed on the blockchain. The blockchain that is intended to be used for the deployment process is the Ropsten Ethereum Network. Thus, the immutability of documents can be maintained, while providing a simple, yet secure way for authenticating/verifying documents.
Luís T. A. N. Brandão, Carlos Galhardo, René Peralta
Abstract Software-controlled measuring instruments used in commercial transactions, such as fuel dispensers and smart meters, are sometimes subject to “memory replacement” attacks. Cybercriminals replace the approved software by a malicious one that then tampers with measurement results, inflicting a financial loss to customers and companies. To mitigate such attacks, legal metrology systems often require regular device attestation, where an auditor checks that the device possesses (“knows”) the approved software. However, current attestation methods usually require the software to be known by the auditor, thus increasing the risk of inadvertent leakage or malicious theft of proprietary information, besides facilitating its malicious adulteration. We describe how this issue can be addressed in legal metrology systems by using zero-knowledge proofs of knowledge (ZKPoK). These proofs enable attestation of possession of approved software, while ensuring its confidentiality from the auditor. To further provide publicly verifiable evidence of freshness, each such proof can be related to a fresh random value from a public randomness beacon. This article presents the basic conceptual idea, while also discussing pitfalls that should be avoided.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
Rajasekhar Chaganti, Bharat Bhushan, Vinayakumar Ravi
With the proliferation of new technologies such as Internet of Things (IOT) and Software-Defined Networking(SDN) in the recent years, the distributed denial of service (DDoS)attack vector has broadened and opened new opportunities for more sophisticated DDoS attacks on the targeted victims. The new attack vector includes unsecured and vulnerable IoT devices connected to the internet, denial of service vulnerabilities like southbound channel saturation in the SDN architecture. Given the high-volume and pervasive nature of these attacks, it is beneficial for stakeholders to collaborate in detecting and mitigating the denial of service attacks in a timely manner. The blockchain technology is considered to improve the security aspects owing to the decentralized design, secured distributed storage and privacy. A thorough exploration and classification of blockchain techniques used for DDoS attack mitigation is not explored in the prior art. This paper reviews and categorizes the existed state-of-the-art DDoS mitigation solutions based on blockchain technology. The DDoS mitigation techniques are classified based on the solution deployment location i.e. network based, near attacker location, near victim location and hybrid solutions in the network architecture with emphasis on the IoT and SDN architectures. Additionally, based on our study, the research challenges and future directions to implement the blockchain based DDoS mitigation solutions are discussed. We believe that this paper could serve as a starting point and reference resource for future researchers working on denial of service attacks detection and mitigation using blockchain technology.
Wenjuan Li, Yu Wang, Weizhi Meng, Jin Li · 5 authors
To safeguard critical services and assets in a distributed environment, collaborative intrusion detection systems (CIDSs) are usually adopted to share necessary data and information among various nodes, and enhance the detection capability. For simplifying the network management, software defined networking (SDN) is an emerging platform that decouples the controller plane from the data plane. Intuitively, SDN can help lighten the management complexity in CIDSs, and a CIDS can protect the security of SDN. In practical implementation, trust management is an important approach to help identify insider attacks (or malicious nodes) in CIDSs, but the challenge is how to ensure the data integrity when evaluating the reputation of a node. Motivated by the recent development of blockchain technology, in this work, we design BlockCSDN — a framework of blockchain-based collaborative intrusion detection in SDN, and take the challenge-based CIDS as a study. The experimental results under both external and internal attacks indicate that using blockchain technology can benefit the robustness and security of CIDSs and SDN.
Internet of Things (IoT) devices are widely used in many industries including smart cities, smart agriculture, smart medical, smart logistics, etc. However, Distributed Denial of Service (DDoS) attacks pose a serious threat to the security of IoT. Attackers can easily exploit the vulnerabilities of IoT devices and control them as part of botnets to launch DDoS attacks. This is because IoT devices are resource-constrained with limited memory and computing resources. As an emerging technology, Blockchain has the potential to solve the security issues in IoT. Therefore, it is important to analyse various Blockchain-based solutions to mitigate DDoS attacks in IoT. In this survey, a detailed survey of various Blockchain-based solutions to mitigate DDoS attacks in IoT is carried out. First, we discuss how the IoT networks are vulnerable to DDoS attacks, its impact over IoT networks and associated services, the use of Blockchain as a potential technology to address DDoS attacks, in addition to challenges of Blockchain implementation in IoT. We then discuss various existing Blockchain-based solutions to mitigate the DDoS attacks in the IoT environment. Then, we classify existing Blockchain-based solutions into four categories i.e., Distributed Architecture-based solutions, Access Management-based solutions, Traffic Control-based solutions and the Ethereum Platform-based solutions. All the solutions are critically evaluated in terms of their working principles, the DDoS defense mechanism (i.e., prevention, detection, reaction), strengths and weaknesses. Finally, we discuss future research directions that can be explored to design and develop better Blockchain-based solutions to mitigate DDoS attacks in IoT.
Jusop Choi, Wonseok Choi, William Aiken, Hyoungshick Kim · 8 authors
Since Bitcoin appeared in 2009, over 6,000 different cryptocurrency projects have followed. The cryptocurrency world may be the only technology where a massive number of competitors offer similar services yet claim unique benefits, including scalability, fast transactions, and security. But are these projects really offering unique features and significant enhancements over their competitors? To answer this question, we conducted a large-scale empirical analysis of code maintenance activities, originality and security across 592 crypto projects. We found that about half of these projects have not been updated for the last six months; over two years, about three-quarters of them disappeared, or were reported as scams or inactive. We also investigated whether 11 security vulnerabilities patched in Bitcoin were also patched in other projects. We found that about 80% of 510 C-language-based cryptocurrency projects have at least one unpatched vulnerability, and the mean time taken to fix the vulnerability is 237.8 days. Among those 510 altcoins, we found that at least 157 altcoins are likely to have been forked from Bitcoin, about a third of them containing only slight changes from the Bitcoin version from which they were forked. As case studies, we did a deep dive into 20 altcoins (e.g., Litecoin, FujiCoin, and Feathercoin) similar to the version of Bitcoin used for the fork. About half of them did not make any technically meaningful change - failing to comply with the promises (e.g., about using Proof of Stake) made in their whitepapers.
Sai Bharadwaj Atreyapurapu, K Amarendra, Mohammed Muzamil Alishah
Hyperledger Fabric is a permissioned distributed ledger framework for developing solutions and applications that works at the enterprise grade. It is one of the latest blockchain framework that is built as foundation for developing products, solutions, and applications based on blockchain. Lately, the pandemic has changed a lot in the medical system throughout the world. Patients required immediate attention where doctors were scarce. This has led to the implementation of blockchain technologies for designing online applications to provide patients with better and secure services. The private blockchain is implemented using Hyperledger Fabric that records the patients' data. This provides better security and prevents loss of data through redundancy. Blockchain has gained popularity lately due to the rise of the cryptocurrencies like Bitcoin, Ethereum etc. Their value has sky-rocketed with the amount of attention they gained during the pandemic. An application of blockchain technology i.e. Distributed Ledger Protocol (DLT) called Hyperledger Fabric developed by Linux Foundation is used to solve many business use cases like storing health records, managing financial transactions etc.
Cryptocurrencies have completely altered the digital transaction process all over the globe. Almost a decade after Satoshi Nakamoto generated the first Bitcoin block; many cryptocurrencies have been established. The Ransomware attack is a type of cybercrime and a class of malware that encrypts the files and prevents users from accessing their data or systems and demands payment for decrypting and retrieving access to their files. Ransomware data classification using present data mining and machine learning methods is difficult because predictions aren't always correct. We aim to build two models that effectively address these challenges and can diagnose and classify Ransomware attacks accurately, then compare the performance of the models. In this paper, we investigated the use of Rule-Based algorithms for mining Bitcoin Ransomware Data to classify Ransomware attacks in Bitcoin transactions. Employing Rule-Based techniques in detecting Bitcoin data is beneficial because the algorithms effectively classify non-linear datasets. The analysis was done on a Bitcoin dataset for 61,004 addresses selected from 29 Ransomware families and contained ten descriptive and decision attributes. Both Rule-Based algorithms were illustrated and compared on the dataset employing 10-fold cross-validation. Experimental results show that classification under partial decision tree (PART) algorithm performed better in different metrics than the Decision Table algorithm. It provides an accuracy of 96.01%, a recall of 96%, a precision of 95.9%, and an F-Measure of 95.6%. Experimental results propose that it is beneficial to further investigate the application of PART to predictive modelling tasks in Ransomware studies.
Ransomware attacks have caused serious data loss, and a frequent/good backup is the only solution to deal with such risks. Unfortunately, current research of data backup mainly focuses on improving data recovery efficiency, and rarely takes backups confidentiality and service DDoS attacks resistance into consideration, which greatly limits their usability in practice. In this work, we propose a novel data backup scheme called RAP (RAnsomware Protection scheme based on blockchain) to make up for the above deficiencies. Based on the principle of data isolation, we first formally discuss the role of gateways in data backup systems and deploy mechanism on gateways to resist DDoS attacks. RAP employs an optimized all-or-nothing transform (AONT) and offers the scheme for setup, backups upload and data recovery through secure channel. We define and analyze the security of RAP for data confidentiality and DDoS attacks resistance. We instantiate RAP by a consortium blockchain based on Ethereum and evaluate its performance. The running time of each phase in RAP is less than 1 millisecond excluding the$r$ead/$w$rite delay of typic data size and our scheme would be compatible with most existing blockchains, which further demonstrate its practicality and scalability.
Internet of Things (IoT) device security is one of the crucial topics in the field of information security. IoT devices are often protected securely through firmware update. Traditional update methods have their shortcomings, such as bandwidth limitation and being attackers' easy targets. Although many scholars proposed a variety of methods that are based on the blockchain technology to update the firmware, there are still demerits existing in their schemes, including large storage space and centralized stored firmware. In summary, this research proposes a highly secure and efficient protection mechanism that is based on the blockchain technology to improve the above disadvantages. Therefore, this study can reduce the need of storage space and improve system security. The proposed system has good performance in some events, including firmware integrity, security of IoT device connection, system security, and device anonymity. Furthermore, we confirm the high security and practical feasibility of the proposed system by comparing with the existing methods.
The industrial Internet of Things (IIoT) is a fast-growing network of Internet-connected sensing and actuating devices aimed to enhance manufacturing and industrial operations. This interconnection generates a high volume of data over the IIoT network and raises serious security (e.g., the rapid evolution of hacking techniques), privacy (e.g., adversaries performing data poisoning and inference attacks), and scalability issues. To mitigate the aforementioned challenges, this article presents, a new privacy-preserved threat intelligence framework (P2TIF) to protect confidential information and to identify cyber-threats in IIoT environments. There are two major elements in the proposed P2TIF framework. First, a scalable blockchain module that enables secure communication of IIoT data and prevents data poisoning attacks. Second, a deep learning module that transforms actual data into a new format and protects data from inference attacks using a deep variational autoencoder (DVAE) technique. The encoded data are then employed by a threat detection system using attention-based deep gated recurrent neural network (A-DGRNN) to recognize malicious patterns in IIoT environments. The proposed framework is validated using two different network data sources, i.e., ToN-IoT and IoT-Botnet. Security analysis and experimental results revealed the high efficiency and scalability of the proposed P2TIF framework.
Several challenges have been announced on arithmetization-oriented hash functions, with bounties funded by the Ethereum Foundation. In this note, we report on our work to solve several of these challenges, on Feistel-MiMC, Rescue Prime and Poseidon. Our results are obtained by writing the challenges as systems of polynomial equations over the large field, and solving them with off-the-shelf tools (SageMath, NTL, Magma).
Jin Ling, Yinzhi Cao, Yan Chen, Di Zhang · 5 authors
Smart contracts, just like other computer programs, are prone to a variety of vulnerabilities, which lead to severe consequences including massive token and coin losses. Prior works have explored automated exploit generation for vulnerable Ethereum contracts. However, the scopes of prior works are limited in both vulnerability types and contract platforms. In this paper, we propose a cross-platform framework, calledExGen, to generate multiple transactions as exploits to given vulnerable smart contracts.ExGenfirst translates either Ethereum or EOS contracts to an intermediate representation (IR). Then,ExGengenerates symbolic attack contracts with transactions in a partial order and then symbolically executes the attack contracts together with the target to find and solve all the constraints. Lastly,ExGenconcretizes all the symbols, generates attack contracts with multiple transactions, and verifies the generated contracts’ exploitability on a private chain with values crawled from the public chain. We implemented a prototype ofExGenand evaluated it on Ethereum and EOS benchmarks.ExGensuccessfully exploits 1,258/1,399 (89.9%) Ethereum and 126/130 (96.9%) EOS vulnerabilities.ExGenis also able to exploit zero-day vulnerabilities on EOS.
Blockchain based applications backed by smart contracts are becoming increasingly popular in various domains. Smart contracts are vulnerable to attacks due to bugs in them and such attacks resulted in huge monetary losses, disruption in operation and so on in the past. Fuzz testing is one of the prominent methods used for identifying bugs in blockchain smart contracts. Multiple fuzzers are used for fuzzing smart contracts written in different programming languages. However, maintenance of multiple fuzzers become prohibitively difficult in an enterprise DevOps setup, in terms of skills, time, and efforts required in patching and keeping them up to date. Hence, we propose a novel vulnerability detection framework which uses a single fuzzer to fuzz smart contracts written in different programming languages, using LLVM IR. In this paper, we validated the proposed framework by testing Hyperledger Fabric smart contracts using fuzzing tools AFL++ and Honggfuzz and presented the results.
Distributed Denial of Service (DDoS) attacks is always one of the major problems for service providers. Using blockchain to detect DDoS attacks is one of the current popular methods. However, the problems of high time overhead and cost exist in the most of the blockchain methods for detecting DDoS attacks. This paper proposes a blockchain-based collaborative detection method for DDoS attacks. First, the trained DDoS attack detection model is encrypted by the Intel Software Guard Extensions (SGX), which provides high security for uploading the DDoS attack detection model to the blockchain. Secondly, the service provider uploads the encrypted model to Inter Planetary File System (IPFS) and then a corresponding Content-ID (CID) is generated by IPFS which greatly saves the cost of uploading encrypted models to the blockchain. In addition, due to the small amount of model data, the time cost of uploading the DDoS attack detection model is greatly reduced. Finally, through the blockchain and smart contracts, the CID is distributed to other service providers, who can use the CID to download the corresponding DDoS attack detection model from IPFS. Blockchain provides a decentralized, trusted and tamper-proof environment for service providers. Besides, smart contracts and IPFS greatly improve the distribution efficiency of the model, while the distribution of CID greatly improves the efficiency of the transmission on the blockchain. In this way, the purpose of collaborative detection can be achieved, and the time cost of transmission on blockchain and IPFS can be considerably saved. We designed a blockchain-based DDoS attack collaborative detection framework to improve the data transmission efficiency on the blockchain, and use IPFS to greatly reduce the cost of the distribution model. In the experiment, compared with most blockchain-based method for DDoS attack detection, the proposed model using blockchain distribution shows the advantages of low cost and latency. The remote authentication mechanism of Intel SGX provides high security and integrity, and ensures the availability of distributed models.
Phuc Nguyen Trong, Hong Khanh Vo, Huong Hoang Luong, Khiem Huynh Gia · 13 authors
YouTube connects people with each other through an online video sharing service platform. With the great devel-opment of the entertainment industry, content on YouTube is accessible to many people of different ages. However, verifying the content posted on YouTube is clean or not is a difficult problem. Dirty content is violent, pornographic and vulgar content that causes serious psychological harm to the segment of users under the age of 18, i.e., especially those of an age who are not yet aware of the harmful effects of content. Toxic will bring to the child’s behavior. Agree that Google (i.e., YouTube) has developed a YouTube Kid application where the videos are only for children under the age of 13. However, cultural and educational differences between regions strongly influence the choice of children. Select content for children. Therefore, the content restrictions on the YouTube Kid application have not yet met all the requirements of parents around the world. There have been many development directions to identify videos containing malicious content based on deep learning. However, there is no method to build a tool to support parents of children to share and identify videos with objectionable content (e.g., violence, pornography, obscene words) on the YouTube platform. In this research paper, we introduce YVC, a YouTube-verified content platform by applying blockchain’s distributed, public validation. This tool helps parents validate YouTube content and issue a report to reduce dirty content on YouTube. To demonstrate the effectiveness of our approach, we implement the proof-of-concept in the three most popular EVM platforms: Ethereum, Fantom, and the Binance smart chain. Compared to the YouTube Kids (i.e., the most common shared video platform for the under 13-year-old kid), our approach is able to capture the video preferences of the parents covering the difference areas/countries.
Oliver Stengele, Christina Westermeyer, Hannes Hartenstein
Software can be described, like human users and other objects, through attributes. For this work, we define software attributes as humanly verifiable, falsifiable, or judgeable statements regarding characteristics of said software. Much like attributes in general, software attributes require robust identities for their source but also for their target, meaning a software in general or a binary in particular. As software can be of critical importance, performing an independent review of attribute claims appears beneficial. We posit that decentralized platforms that were developed and refined over the past decade can bridge the gap between existing tools and methods for software review and their open, transparent, and accountable use for the benefit of users. In this work, we explore the feasibility and implications of decentralizing an independent review of software attribute claims. We envision the decentralization of a review process from initialization and execution to the persistent recording of results. We sketch the available design space by decomposing the overall process into a modular design and describe how each component covers overarching objectives. To illustrate practical implications and trade-offs, we present ETHDPR, a proof of concept implementation based on Ethereum and IPFS. Through a quantitative and qualitative evaluation, we show that a decentralized software review is practically feasible. We illustrate the flexibility of the proposed approach using a toy example of a software component in automotive systems. Lastly, we provide a discussion on fundamental limits and open issues of facilitating independent reviews via technological means.
Hanan E. Alhazmi, Fathy Eassa, Suhelah M. Sandokji
The world is facing a growth in the amount and variety of data generated by both users and machines. Despite the exponential increases, the tools and technologies developed to manage these data volumes are not intended to meet security and data protection requirements. Additionally, most of the current big data security systems are offered by a centralized third party, which is vulnerable to many security threats. Blockchain technology plays a significant role by addressing modern technology concerns such as decentralization, non-tampering, trust, data ownership, and traceability, making it great potential to protect personal information. This research presents a new big data security solution empowered by blockchain technology and incorporates fragmentation, encryption, and access control techniques. Our proposed fragmentation algorithm takes into account the data owner’s demand for encryption to be added to the fragmentation process. Furthermore, data fragments will be stored in the distributed manner offered by the big data environment, resulting in an additional layer of data protection. In order to achieve an optimal security solution, we aim to enhance big data security with acceptable overhead and avoid the encryption overhead for non-sensitive and low-sensitive data portions. We present the results of our implemented techniques to highlight that the overheads (in terms of computation time) introduced by our solution are negligible relative to its security and privacy gains.