Blockchains are composed of a network of computing entities which maintain an immutable distributed ledger thus facilitating auditability and accountability of transactions. The process of Cryptocurrency mining involves miners verifying transactions and adding them to the ledger. While Cryp-tocurrency mining prevents random nodes from creating and appending blocks, it incurs a negative impact on the embedded devices due to their resource-constrained nature. Thus, a need for profiling the power consumption of cryptocurrency mining platforms for embedded devices becomes necessary. In this work, we comparatively study the performance and power consumption of a suite of commonly used cryptocurrency mining platforms and analyze energy-performance trade-offs. In particular, our analysis is based on the power consumption during mining, changes in the power behavior and their impact on the overall system. Experiments conducted using real devices indicate that mining incurs a 2-fold increase in power consumption compared to those without mining. Our insights can be used to further investigate the impact of cryptocurrency malware on power consumption as well as design algorithms for energy efficient mining.
Zakaria Abou El Houda, Abdelhakim Hafid, Lyes Khoukhi
The recent proliferation of Internet of Things (IoT) is paving the way for the emergence of smart cities, where billions of IoT devices are interconnected to provide novel pervasive services and automate our daily lives tasks (e.g., smart healthcare, smart home). However, as the number of insecure IoT devices continues to grow at a rapid rate, the impact of Distributed Denial-of-Service (DDoS) attacks is growing rapidly. With the advent of IoT botnets such as Mirai, the view towards IoT has changed from enabler of smart cities into a powerful amplifying tool for cyberattacks. This motivates the development of new techniques to provide flexibility and efficiency of decision making on the attack collaboration in a software defined networks (SDN) context. The new emerging technologies, such as SDN and blockchain, introduce new opportunities for low-cost, efficient and flexible DDoS attacks collaboration for the IoT based environment. In this paper, we propose Co-IoT, a blockchain-based framework for collaborative DDoS mitigation; it uses the concept of smart contracts (i.e., Ethereum's smart contracts) to facilitate the collaboration among SDN-based domains and transfer attacks information in a decentralized manner. The implementation of Co-IoT is deployed on Ethereum official test network Ropsten [1]. The experimental results confirm that Co-IoT achieves flexibility, efficiency, security and cost effectiveness making it a promising approach to mitigate large scale DDoS attacks.
Abstract Distributed Denial of Service (DDoS) attacks cause devastating effects on the web services and hence harm the digital availability. The DDoS attackers use vulnerabilities exposed through new networking technologies like wireless, mobile, IoT, and associated protocol weaknesses for bringing down the networks and servers. Owing to availability of easily available tools and botnet armies, the DDoS attack incidences in the internet world are increasing day by day. Several techniques have been proposed by the researchers against DDoS attacks. This paper concentrates on the utilization of one of the latest and most promising technologies, that is, blockchain technology against DDoS attacks. The blockchain technology is rapidly finding use in various applications ranging from financial to gaming; this is because of its stable, decentralized, and secure architecture. The DDoS solutions based on blockchain are still in infancy and some solutions provide only architectural details without bothering about the implementation details. This paper presents a study of the blockchain‐based DDoS solutions. It also compares the existing blockchain‐based techniques against DDoS attacks and analyses them. This paper facilitates the development of future research proposals in this emerging area of blockchain technology.
The recent substantial increase of Internet connected devices can be attributed to the new paradigm known as Internet of Things (IoT). IoT refers to objects that are connected and able to smartly function together to achieve a goal without human intervention. IoT systems have many weaknesses concerning confidentiality, security, privacy, and data integrity. This is due to having a large number of devices on a network, leading to the creation of anomalous behavior and security problems. For this reason, researchers have recently integrated IoT with Blockchain. Blockchain technology, a security by design technology that aims to overcome IoT weaknesses. This is because Blockchain permits validation, non-repudiation, reliability, controls authorization and automation of networks. However, Blockchain-based systems/networks may still face malicious attacks that threaten their security. This paper proposes using a link-mining tool based on anomaly detection within Blockchain networks. Aiming at gathering Meta-data in the form of forks (i.e. divergent paths from the Blockchain protocol) in order to find the semantic interpretation of anomalous paths/activities, through mutual information based measure. This tool will aid in the prevention of malicious attacks and improve the security of the Blockchain network and IoT devices.
Leon Böck, Νικόλαος Αλεξόπουλος, Emine Saracoglu, Max Mühlhäuser · 5 authors
Time and time again the security community has faced novel threats that were previously never analyzed, sometimes with catastrophic results. To avoid this, proactive analysis of envisioned threats is of great importance. One such threat is blockchain-based botnets. Bitcoin, and blockchain-based decentralized cryptocurrencies in general, promise a fair and more transparent financial system. They do so by implementing an open and censorship-resistant atomic broadcast protocol that enables the maintenance of a global transaction ledger, known as a blockchain. In this paper, we consider how this broadcast protocol may be used for malicious behavior as a botnet command and control (C2) channel. Botmasters have been known to misuse broadcasting platforms, like social media, as C2 channels. However, these platforms lack the integral censorship-resistant property of decentralized cryptocurrencies. In this paper, we provide a comprehensive systematization of knowledge study on using blockchains as botnet C2 channels, generating a number of important insights. We set off by providing a critical analysis of the state of the art of blockchain-based botnets, along with an abstract model of such a system. We then examine the inherent limitations of the design, in an attempt to challenge the feasibility of such a botnet. With such limitations in mind, we move forward with an experimental analysis of the detectability of such botnets and discuss potential countermeasures. Contrary to previous work that proposed such botnets, we provide a broad overview of the associated risk and view the problem in relation to other existing botnet C2 channels. We conclude that despite its limitations, the blockchain, as a backup mechanism, practically renders attempts to suppress the control channel of a botnet futile. Thus, more focus should be put on detecting and disinfecting machines at the network edge (router) or even per-bot level.
Blockchain has been said to be one of the technologies for the future, and researchers have argued that this technology is going to disrupt many industries in the coming years, and democratic elections are one of the key areas blockchain is going to transform. Several organizations have begun experimenting on blockchain-enabled e-voting platforms, such as Democratic Earth, Horizon State and Follow My Vote. This study seeks to conceptualize a blockchain architecture for the storage of election results that provide trust, transparency, and immutability using distributed ledger technology (DLT). One of the main issues with elections in Ghana and other sub-Saharan African countries is the inaccurate recording of votes from polling stations, constituencies and at the national office. There are instances where votes recorded at the polling station changes at the constituencies either intentionally or accidentally. The study discussed the basic properties of the blockchain, such as distributed ledger, consensus mechanisms and cryptographic hash function, and how it can be used to address the current challenges in vote recording during elections. The study evaluates current blockchain-enabled e-voting systems and designs a blockchain-based vote recording system that provides immutability, trust, and transparency. The proposed design addresses the issues of vote tempering because transactions added to the block are secure with a cryptographic hash function which makes tempering of the votes stored in the blockchain nearly impossible and make it immutable.
J.R. James, Daniel Hawthorne, Katherine Duncan, Aaron St. Leger · 6 authors
Power grids around the world have experienced a growing number of malicious cyber attacks. This paper provides an overview of recent use of the Hyperledger Fabric distributed operating system to prototype use of a permissioned blockchain consensus algorithm to trust shared state estimation and control data and another effort to alter local sensor data to destroy the integrity of the shared data. The paper also provides justification for an experiment to prototype use of Babble, a peer-to-peer network plugin using the hashgraph consensus algorithm, to share the state estimation and control data through transactions recorded in a hashgraph. A key claim of the hashgraph documentation, which is unsubstantiated without a proper academic analysis, is that the algorithm is asynchronous Byzantine fault tolerance (ABFT). Also, while the Hyperledger Fabric implementation supports thousands of transactions per second, the hashgraph algorithm documentation claims orders of magnitude more. Our experiment seeks to measure the hashgraph transaction speed and determine its suitability for improving the resilience of wide area control of the smart grid. The previous resilience research of the Anomaly Detection of Cyber Physical Systems (ADCPS) team includes research into inadvertent cyber and physical failures as well as malicious attacks. We conclude with some speculations concerning the potential impact of fast, fair, and secure sharing of data across a network of blockchains potentially interfaced using hashgraph distributed ledger technology (DLT).
Γεώργιος Σπαθούλας, Nikos Giachoudis, Georgios-Paraskevas Damiris, Georgios Theodoridis
Internet of Things is one of the most significant latest developments in computer science. It is common for modern computing infrastructures to partially consist of numerous low power devices that are characterized by high diversity in both hardware and software. Existing security models, approaches and solutions are not able to sufficiently protect such systems. In this paper we propose the use of lightweight agents installed at multiple internet of things (IoT) installations (e.g., smart-homes), in order to collaboratively detect distributed denial of service (DDoS) attacks conducted by the use of IoT devices botnets. Specifically, agents exchange outbound traffic information in order to identify possible victims of DDoS attacks. This information exchange is governed by a blockchain smart contract, that ensures the integrity of both the procedure and the information. A simulation of the operation of the proposed methodology has been conducted in order to evaluate both its detection efficiency and its resilience against malicious agents that aim to falsify results.
Purpose This paper aims to demonstrate the utility of a target-centric approach to intelligence collection and analysis in the prevention and investigation of ransomware attacks that involve cryptocurrencies. The paper uses the May 2017 WannaCry ransomware usage of the Bitcoin ecosystem as a case study. The approach proves particularly beneficial in facilitating information sharing and an integrated analysis across intelligence domains. Design/methodology/approach This study conducted data collection and analysis of the component Bitcoin elements of the WannaCry ransomware attack. A note of both technicalities of Bitcoin operations and current models for sharing cyber intelligence was made. Our analysis builds on and further develops current definitions and strategies for sharing cyber threat intelligence. It uses the problem definition model (PDM) and generic target network model (TNM) to create an analytic framework for the WannaCry ransomware attack scenario, allowing analysts the ability to test their hypotheses and integrate and share data for collaborative investigation. Findings Using a target-centric intelligence approach to WannaCry 2.0 shows that it is possible to model the intelligence problem of collecting and analysing data related to inflows and outflows of Bitcoin-related ransomware transactions. Bitcoin transactions form graph networks and allow to build a target network model for collecting, analysing and sharing intelligence with multiple stakeholders. Although attribution and anonymity prevail under cryptocurrency usage, there is a means for developing transaction walks using this method to target nefarious cryptocurrency exchanges where criminals are inclined to cash out their proceeds of crime. Originality/value The application of a target-centric intelligence approach to the cryptocurrency components of a ransomware attack provides a framework for intelligence units to break down the problem in the financial domain and model the network behaviour of illicit Bitcoin transactions relating to ransomware.
Out-of-gas errors occur when smart contract programs are provided with inputs that cause excessive gas consumption and which will be easily exploited to perform Denial-of-Service attacks. Various approaches have been proposed to estimate the gas limit of a function in smart contracts to avoid such error. However, underestimation often occurs when the contract is complex In this work, we propose V-Gas, which automatically generates inputs that maximize the gas cost and reduce underestimation. V-Gas is designed based on static analysis and feedback-directed mutational fuzz testing. First, V-Gas builds the gas weighted control flow graph of functions in smart contracts. Then, V-Gas develops gas consumption guided selection and mutation strategies to generate the input that maximize the gas consumption. For evaluation, we implement V-Gas based on js-evm, a widely used Ethereum virtual machine written in Javascript, and conduct experiments on 736 real-world transactions recorded on Ethereum. A total of 44.02% of the transactions would have out-of-gas errors based on the estimation results given by solc, meaning that the recorded real gas consumption for those transactions is larger than the gas limit estimated by solc. In comparison, V-Gas could reduce the underestimation ratio to 13.86%. To evaluate the performance of feedback-directed engine in V-Gas, we implemented other directed fuzzing engines and compared their performance with that of V-Gas. The results showed that V-Gas generates the same or higher gas estimation value on 97.8% of the transactions with less time, usually within 5 minutes. Furthermore, V-Gas has exposed 25 previously unknown out-of-gas vulnerabilities in widely used smart contracts, 6 of which have been assigned unique CVE identifiers in the U.S. National Vulnerability Database.
Ramiro Daniel Camino, Christof Ferreira Torres, Mathis Baden, Radu State
Ethereum smart contracts have recently drawn a considerable amount of attention from the media, the financial industry and academia. With the increase in popularity, malicious users found new opportunities to profit by deceiving newcomers. Consequently, attackers started luring other attackers into contracts that seem to have exploitable flaws, but that actually contain a complex hidden trap that in the end benefits the contract creator. In the blockchain community, these contracts are known as honeypots. A recent study presented a tool called HONEYBADGER that uses symbolic execution to detect honeypots by analyzing contract bytecode. In this paper, we present a data science detection approach based foremost on the contract transaction behavior. We create a partition of all the possible cases of fund movements between the contract creator, the contract, the transaction sender and other participants. To this end, we add transaction aggregated features, such as the number of transactions and the corresponding mean value and other contract features, for example compilation information and source code length. We find that all aforementioned categories of features contain useful information for the detection of honeypots. Moreover, our approach allows us to detect new, previously undetected honeypots of already known techniques. We furthermore employ our method to test the detection of unknown honeypot techniques by sequentially removing one technique from the training set. We show that our method is capable of discovering the removed honeypot techniques. Finally, we discovered two new techniques that were previously not known.
At present, the software-defined network lacks a complete security mechanism for guarantee stream rule integrity, which contributes to attackers to trigger a variety of destructive network attacks through malicious tampering. Based on the non-tamperable performance of the blockchain technology and the characteristics of decentralization, this paper proposes a blockchain-based SDN security model, which could ensure the integrity of the network information by saving SDN flow rules, node identity and privilege information, and controller global information to the blockchain. The model establishes a distributed authentication mechanism through the blockchain network, which alleviates the problem that traditional centralized authentication is vulnerable to single-point attacks. In addition, the model performs role-based rights management based on data uplink storage and distributed authentication. Also, the Markov model is used to analyze the security performance of the blockchain-based SDN model. Analysis and simulation results show that the model can significantly improve the security performance of SDN.
One of the effective ways of detecting malicious traffic in computer networks is intrusion detection systems (IDS). Though IDS identify malicious activities in a network, it might be difficult to detect distributed or coordinated attacks because they only have single vantage point. To combat this problem, cooperative intrusion detection system was proposed. In this detection system, nodes exchange attack features or signatures with a view of detecting an attack that has previously been detected by one of the other nodes in the system. Exchanging of attack features is necessary because a zero-day attacks (attacks without known signature) experienced in different locations are not the same. Although this solution enhanced the ability of a single IDS to respond to attacks that have been previously identified by cooperating nodes, malicious activities such as fake data injection, data manipulation or deletion and data consistency are problems threatening this approach. In this paper, we propose a solution that leverages blockchain's distributive technology, tamper-proof ability and data immutability to detect and prevent malicious activities and solve data consistency problems facing cooperative intrusion detection. Focusing on extraction, storage and distribution stages of cooperative intrusion detection, we develop a blockchain-based solution that securely extracts features or signatures, adds extra verification step, makes storage of these signatures and features distributive and data sharing secured. Performance evaluation of the system with respect to its response time and resistance to the features/signatures injection is presented. The result shows that the proposed solution prevents stored attack features or signature against malicious data injection, manipulation or deletion and has low latency.
Blockchain is a decentralized distributed database. It is among the new generation technologies and its popularity is increasing day by day due to its attractive advantages. Although it was introduced in 1992 it was first used in 2008 with the Bitcoin virtual currency, which was laid experimentally by a developer codenamed Satoshi Nakamoto. After Bitcoin's success, Blockchain technology has been used in different fields. Not only in the financial sector; In many sectors such as health, energy, agriculture and supply chain management, applications have been developed in line with the needs. Security, first-hand operation, transparency and privacy advantages are the main reasons for the spread of Blockchain technology. By evaluating the advantages it provides, many companies have started to invest in Blokchains technology and the number of Blokchains projects has started to increase. HAVELSAN is a large-scale Defense Industry Software company, researching new generation technologies and conducting studies to create value at both the firm and national level. Blockchain is one of these technologies. Most of the projects and products made before the Blockchain were produced in the traditional structure using the central database. Blockchain still does not provide a central database performance. Although the value added will be added to the projects to be carried out with the block chain, the problem will arise where high transaction performance is important. Currently, Blockchain; ensures the accuracy, security and integrity of the data. However, as the Blockchain network grows, productivity decreases and is difficult to manage. The proposed solution to improve performance is to establish a hybrid model and to ensure that a centralized database works together with the Blockchain network. In this study, how to design a hybrid structure using Blockchain and central database, installation of the system and the problems encountered will be explained.
The Session Initiation Protocol (SIP) is an application-layer control protocol for creating, modifying, and terminating Voice/Video over IP sessions. While deployed globally to facilitate multimedia communications, SIP is subject to various attacks. The defense against SIP attacks, however, often lack expertise due to the limited resources within the organization. When there is a large footprint of SIP systems, scaling and keeping up SIP defense becomes crucial in safeguarding these systems. This paper proposes SIPchain, a distributed SIP defense cluster system that leverages Blockchain technology as a distributed, highly-available, and permanent ledger of Indicator of Compromise (IOC). Each node in this cluster is a sensor and shares attack intelligence with other nodes via Blockchain. Each node reads information from the Blockchain and implements the appropriate firewall rule based on this information. This approach scales the defense because each node can leverage the actionable intelligence provided by other nodes and does not have to perform detection on their own. Experiments have been performed using a cluster of three SIP nodes in three different countries (US, UK, and Singapore) and the Ethereum Blockchain network. The result shows that when a node detected an attack, it produced and stored the IOC information at the Ethererum. Fellow SIP nodes retrieved this information, implemented firewall rule based on this information, and were proactively prepared when the same attack was launched against them. This SIPchain approach scales the SIP defense effort by utilizing Blockchain technology to secure the ever-growing footprint of SIP systems within the organization.
Mohib Hirani, Malka N. Halgamuge, Pham Duong Thu Hang
This study investigates a range of data security models developed to achieve data security using blockchain technology for different industrial domains. Current industries utilize data-driven mechanisms for decision making with concern focussed on ensuring data security. Blockchain has the potential to secure data by integrating different information systems since data is decentralized, encrypted and validated by the whole network. This study includes an analysis of blockchain security models using data extracted from 30 peer-reviewed scientific publications over two years (2017-2019). This study analyzed three components of the publications, including the process involved in securing data, the stage of development for securing data and in which industry a model is best applied. Results of the research show that the majority of articles (51.11%) cited Blockchain as a key feature of data security for improvising the data sharing process in industries. This study also finds that the stage of implementation most commonly featured is the proposal stage with potential architectures yet to be implemented (30%). Finally, this study shows that models are applied in industrial domains such as enterprises using data analytics, finance, Internet of Things (IoT), healthcare, education, and cloud service providers. This study finds that security models are most often applied to industries and supply chain management models (28.13%). It is recommended that industry professionals conduct further research to customize the data security models in their own domain. This study gives clear guidelines to researchers of suitable frameworks, processes and consensus mechanism to utilize Blockchain in Industries for data security.
Thiago Luiz Gontijo de Almeida, Pierre François, Stéphane Frénot
The following topics are dealt with: storage management; cloud computing; decision making; peer-to-peer computing; distributed databases; cryptocurrencies; distributed processing; cryptography; data privacy; data mining.
As the value of technical information increases, hacking attacks are trying to steal technical information through hacking. Recently, hacking of cryptocurrency exchanges is much easier to monetize than existing technical information, making it a major attack target for hackers. In the case of technical information, it is required to seize the technical information and sell it to the black market for cashing.In the case of cryptocurrency, most hacking attacks are concentrated on cryptocurrency exchanges because it is easy to cash out and not easy to track when successful hacking. Although technology cannot be hacked, cryptocurrency transactions traded on cryptocurrency exchanges are not recorded on the blockchain which is simply internal exchanges, so insiders may manipulate the quotes and leave gaps or leak out. Therefore, this research analyzes the recent hacking attacks of cryptocurrency exchanges and proposes solutions to secure cryptocurrency trading.
Wireless network virtualization is regarded as a technology to enable sharing of physical wireless infrastructure and RF slices for improving not only wireless network capacity and coverage but also wireless security. This article provides a perspective of fusion of three emerging technologies: SDN, EC, and blockchain technology for wireless network virtualization. SDN, with the help of controllers, allows dynamic configuration of network resources for their efficient management. EC not only helps to process user signals and queries at respective base stations with the shortest possible delay, but also helps to avoid the need of a high-speed backhaul link between a base station and centralized controllers. Blockchain technology protects owners of wireless infrastructures from a double spending attack that allocates the same wireless resource (RF slice) to multiple virtual wireless networks. The proposed approach aims to reduce business friction and increase the trust and transparency in the wireless networking industry.
Internet is a common method of trading business today. The usage of cryptocurrencies has increased these days and it has become a trend to utilize them. Cryptocurrency exchange servicers provide different smartphone apps that unfortunately may become the target of malicious attacks. This paper focuses on how it achieves highest security and proposes the multiple layered security analyses method for cryptocurrency exchange servicers.
Virtual Currencies and cryptocurrency are a trending digital currency method which uses the Blockchain technology. Cryptocurrency is a digital method designed to exchange the asset between the users based on a powerful cryptography which ensures the transaction are safe and controllable. We have various legal areas identified while using the cryptocurrency, as being the virtual currency, the amount of assets used by the users increases rapidly. With the increase in the asset the security breaches are one of the key vulnerable areas to focus. Cryptocurrency mining malware or Cryptojacking remains a trending terminology which identifies the malicious software or malware developed to use the data from the smart phones and computers. The major threat of the Cryptojacking is cryptocurrency mining without user’s approval. This article implemented based on our CCEC Framework method published for Malware detection in SMS’s for the Smartphone users. The article explains about how the Malware detected using the CCEC Framework. Malwares created in various format so identifying the Malware takes time before which user assets remains vulnerable. So, the proposed method ensures we have a reduction in time by using various online data sources to identify the Cryptojacking malware.
This chapter focuses on four blockchain-based Command-and-Control (C&C) mechanisms: ZombieCoin, Floating C&C Server, ChainChannels, and Unblockable Chains. It presents their system architectures and aims to evaluate the extraordinary features of these C&C mechanisms. Blockchain is a decentralized and distributed ledger technique. It contains a chain of inter-connected blocks that record a ledger of transactions. The ingenious creation of Bitcoin block structure makes itself an immutable and decentralized digital cryptocurrency, thus attracting developers to use Bitcoin as a tool for transforming current financial system. In Bitcoin transactions, a cryptocurrency holder needs to use private key to digitally sign transactions data and public key of Bitcoin receiver. ChainChannels proves that some infrastructures of blockchain such as digital signatures can also be used as C&C channels of botnets. For the past decade, attackers have been trying to build up a highly resistant and resilient botnet C&C infrastructures.
This chapter explores the threats that malware, specifically, botnets pose to the mining of cryptocurrencies. The reader will be introduced to the history of botnet-inspired threats, operational mechanisms of botnets, and an in-depth look at significant botnets that have attacked cryptocurrencies. The chapter looks at countermeasures in terms of detection, prevention, and thwarting. It presents implications for growing cryptocurrency usage and therefore, increasing exposure to various security threats, both organized and unintentional, on botnet black markets, Internet-of-thing devices and from unsuspecting users. The chapter describes a general overview of the consensus operation in cryptomining and shows how threats to the consensus mechanisms could affect the cryptocurrency mining process. It provides an overview of the consensus mechanism in cryptomining and significant threats posed by botnets to the consensus mechanism.