In the current medical insurance claims process, there are problems of low efficiency and complex services. When a patient applies for medical insurance claims, he/she must go to the hospital to apply for a diagnosis certificate and receipt and then send the relevant application documents to the insurance company. The patient will not receive compensation until the company completes the verification with the patient’s hospital. However, we can improve the current dilemma through blockchain technology. Blockchain technology can effectively open up the information channels of the insurance industry and medical institutions, promote industry integration, and enhance the ability of insurance companies to obtain information. In this research, we used blockchain and smart contract technology to make the following contributions to the development of Internet insurance. First, blockchain and smart contract technology can effectively solve the problem of online underwriting. Second, it is conducive to improving supervision. Third, it is conducive to solving risk control problems. Fourth, it is conducive to effective anti-money laundering. The proposed scheme fulfills the following security requirements: mutual authentication of identities, non-repudiation between each of two roles, and other major blockchain-based security requirements. In the event of a dispute, we also proposed an arbitration mechanism to divide responsibilities.
A smart Ponzi scheme is a new form of economic crime that uses Ethereum smart contract account and cryptocurrency to implement Ponzi scheme. The smart Ponzi scheme has harmed the interests of many investors, but researches on smart Ponzi scheme detection is still very limited. The existing smart Ponzi scheme detection methods have the problems of requiring many human resources in feature engineering and poor model portability. To solve these problems, we propose a data-driven smart Ponzi scheme detection system in this paper. The system uses dynamic graph embedding technology to automatically learn the representation of an account based on multi-source and multi-modal data related to account transactions. Compared with traditional methods, the proposed system requires very limited human-computer interaction. To the best of our knowledge, this is the first work to implement smart Ponzi scheme detection through dynamic graph embedding. Experimental results show that this method is significantly better than the existing smart Ponzi scheme detection methods.
In recent years, a lot of vulnerabilities of smart contracts have been found. Hackers used these vulnerabilities to attack the corresponding contracts developed in the blockchain system such as Ethereum, and it has caused lots of economic losses. Therefore, it is very important to find out the potential problems of the smart contracts and develop more secure smart contracts. As blockchain security events have raised more important issues, more and more smart contract security analysis methods have been developed. Most of these methods are based on traditional static analysis or dynamic analysis methods. There are only a few methods that use emerging technologies, such as machine learning. Some models that use machine learning to detect smart contract vulnerabilities cost much time in extracting features manually. In this paper, we introduce a novel machine learning-based analysis model by introducing the shared child nodes for smart contract vulnerabilities. We build the Abstract-Syntax-Tree (AST) for smart contracts with some vulnerabilities from two data sets including SmartBugs and SolidiFI-benchmark. Then, we build the Abstract-Syntax-Tree (AST) of the labeled smart contract for data sets named Smartbugs-wilds. Next, we get the shared child nodes from both of the ASTs to obtain the structural similarity, and then, we construct a feature vector composed of the values that measure structural similarity automatically to build our machine learning model. Finally, we get a KNN model that can predict eight types of vulnerabilities including Re-entrancy, Arithmetic, Access Control, Denial of Service, Unchecked Low Level Calls, Bad Randomness, Front Running, and Denial of Service. The accuracy, recall, and precision of our KNN model are all higher than 90%. In addition, compared with some other analysis tools including Oyente and SmartCheck, our model has higher accuracy. In addition, we spent less time for training .
Currently, life cannot be imagined without the use of bank cards for purchases or money transfers; however, their use provides new opportunities for money launderers and terrorist organizations. This paper proposes a blockchain-enabled transaction scanning (BTS) method for the detection of anomalous actions. The BTS method specifies the rules for outlier detection and rapid movements of funds, which restrict anomalous actions in transactions. The specified rules determine the specific patterns of malicious activities in the transactions. Furthermore, the rules of the BTS method scan the transaction history and provide a list of entities that receive money suspiciously. Finally, the blockchain-enabled process is used to restrict money laundering. To validate the performance of the proposed BTS method, a Spring Boot application is built based on the Java programming language. Based on experimental results, the proposed BTS method automates the process of investigating transactions and restricts money laundering incidents.
Security attacks in smart contracts have drawn extensive attention due to the financial loss and erosion of trust caused by vulnerabilities. Even worse, smart contract is a tamper proof digital agreement and fixing bugs in it is difficult, so it is necessary for developers to detect security vulnerabilities in smart contract before deployment. Researchers have proposed several methods on smart contract vulnerability detection. However, despite the numerous vulnerability-finding tools, few of them have ideal detection performance because most of them rely on fixed rules, which is inefficient. In this paper, a modularized and systematic Deep Learning-based framework is proposed to automatically detect smart contracts vulnerability, called DeeSCVHunter. Particularly, we focus on two types of smart contract vulnerabilities: reentrancy and time dependence. And we propose a novel notion of Vulnerability Candidate Slice (VCS) to help models capture the key point of vulnerability. We conduct experiments on real-world dataset and the results prove the effectiveness of VCS, which leads to 25.76% improvement in F1-score at most. And extensive experiments also show that our proposed framework significantly outperforms state-of-the-art methods.
Evidence destruction and tempering is a time-tested tactic to protect the\npowerful perpetrators, criminals, and corrupt officials. Countries where law\nenforcing institutions and judicial system can be comprised, and evidence\ndestroyed or tampered, ordinary citizens feel disengaged with the investigation\nor prosecution process, and in some instances, intimidated due to the\nvulnerability to exposure and retribution. Using Distributed Ledger\nTechnologies (DLT), such as blockchain, as the underpinning technology, here we\npropose a conceptual model - 'EvidenceChain', through which citizens can\nanonymously upload digital evidence, having assurance that the integrity of the\nevidence will be preserved in an immutable and indestructible manner. Person\nuploading the evidence can anonymously share it with investigating authorities\nor openly with public, if coerced by the perpetrators or authorities.\nTransferring the ownership of evidence from authority to ordinary citizen, and\ncustodianship of evidence from susceptible centralized repository to an\nimmutable and indestructible distributed repository, can cause a paradigm shift\nof power that not only can minimize spoliation of evidence but human rights\nabuse too. Here the conceptual model was theoretically tested against some\nhigh-profile spoliation of evidence cases from four South Asian developing\ncountries that often rank high in global corruption index and low in human\nrights index.\n
The rapid growth in the number of services invites exponentially increasing malicious traffic which aims to overwhelm a server. This attempt to exhaust the server of its resources is called a Distributed Denial-of-Service (DDoS) attack. The pseudonymity (pseudo-anonymity) of Blockchain can be either desirable or undesirable to society and this unique feature put together with the elimination of trusted intermediaries that smart contracts offer, appeals to the illegal side of the world. This paper sheds light on the “dark side” of smart contracts, i.e., how they are used to stimulate criminal activity, specifically, a contract to allow the terms and execution of a DDoS to take place in a secure community. Though this proposal endeavors to release a DDoS attack, it can be extended to other real-world crimes as well. Apart from this, our work also covers how this framework could be used for Selfish Mining.
To execute transactional operations in the financial trading industry, cryptocurrencies like as bitcoin make use of decentralization, traceability, and anonymity properties. These digital currencies, which are based on new blockchain technology, are serving as the foundation for some of the world's biggest unregulated marketplaces. A variety of regulatory difficulties arise as a result, including the illegal acquisition of narcotics and weapons, money laundering, and the support of terrorist operations, among others. This chapter examines a variety of legal and ethical implications, as well as their consequences and potential solutions to the fundamental problems that policymakers and regulators are today confronted with on a daily basis. The authors present the findings of an analysis of 30 recently published peer-reviewed scientific publications, and they propose a number of mechanisms that can aid in the detection and prevention of illegal activities, which currently account for a significant portion of cryptocurrency trading at this time. These researchers propose methodologies and apps that may be used to detect dark markets in the future, should the need arise.
Bitcoin has a peer to peer system that is in contrast to financial system by eliminating third parties in transactions. Countries in the world have different positions on Bitcoin, there are countries that are accept, reject or not both, so that understanding is needed more in depth to the factors that determine the position of the country above Bitcoin. This study aims to look for the influence of the development of Bitcoin, the performance of fiat money and the governance systems of countries in the world in determining its position on the legality of Bitcoin. Theories and concepts used inside this research is the international financial system and the state management system; with a quantitative approach as well as multinomial logistic regression analysis supported with secondary data. The results of the analysis in this study revealed that of the nine factors affecting the country's top position Bitcoin; it's just that the significance is different. Influencing Factors significant in determining the country's position on Bitcoin are factors political and economic factors have no significant effect. So it can be said that state acceptance of Bitcoin tends to be caused political reasons compared to the economy, even though Bitcoin itself is located on economic aspects. If Bitcoin acceptance is legalized, then the countries in the world still must accompany the role of government because Bitcoin is judged not to have clear rules and potentially detrimental to others.
Rachit Agarwal, Tanmay Thapliyal, Sandeep K. Shukla
Smart Contracts (SCs) in Ethereum can automate tasks and provide different functionalities to a user. Such automation is enabled by the `Turing-complete' nature of the programming language (Solidity) in which SCs are written. This also opens up different vulnerabilities and bugs in SCs that malicious actors exploit to carry out malicious or illegal activities on the cryptocurrency platform. In this work, we study the correlation between malicious activities and the vulnerabilities present in SCs and find that some malicious activities are correlated with certain types of vulnerabilities. We then develop and study the feasibility of a scoring mechanism that corresponds to the severity of the vulnerabilities present in SCs to determine if it is a relevant feature to identify suspicious SCs. We analyze the utility of severity score towards detection of suspicious SCs using unsupervised machine learning (ML) algorithms across different temporal granularities and identify behavioral changes. In our experiments with on-chain SCs, we were able to find a total of 1094 benign SCs across different granularities which behave similar to malicious SCs, with the inclusion of the smart contract vulnerability scores in the feature set.
Rohit Kumar Sachan, Rachit Agarwal, Sandeep K. Shukla
The rise in the adoption of blockchain technology has led to increased illegal activities by cybercriminals costing billions of dollars. Many machine learning algorithms are applied to detect such illegal behavior. These algorithms are often trained on the transaction behavior and, in some cases, trained on the vulnerabilities that exist in the system. In our approach, we study the feasibility of using the Domain Name (DN) associated with the account in the blockchain and identify whether an account should be tagged malicious or not. Here, we leverage the temporal aspects attached to the DN. Our approach achieves 89.53% balanced-accuracy in detecting malicious blockchain DNs. While our results identify 73769 blockchain DNs that show malicious behavior at least once, out of these, 34171 blockchain DNs show persistent malicious behavior, resulting in 2479 malicious blockchain DNs over time. Nonetheless, none of these identified malicious DNs were reported in new officially tagged malicious blockchain DNs.
Rachit Agarwal, Tanmay Thapliyal, Sandeep K. Shukla
Smart Contracts (SCs) in Ethereum can automate tasks and provide different\nfunctionalities to a user. Such automation is enabled by the `Turing-complete'\nnature of the programming language (Solidity) in which SCs are written. This\nalso opens up different vulnerabilities and bugs in SCs that malicious actors\nexploit to carry out malicious or illegal activities on the cryptocurrency\nplatform. In this work, we study the correlation between malicious activities\nand the vulnerabilities present in SCs and find that some malicious activities\nare correlated with certain types of vulnerabilities. We then develop and study\nthe feasibility of a scoring mechanism that corresponds to the severity of the\nvulnerabilities present in SCs to determine if it is a relevant feature to\nidentify suspicious SCs. We analyze the utility of severity score towards\ndetection of suspicious SCs using unsupervised machine learning (ML) algorithms\nacross different temporal granularities and identify behavioral changes. In our\nexperiments with on-chain SCs, we were able to find a total of 1094 benign SCs\nacross different granularities which behave similar to malicious SCs, with the\ninclusion of the smart contract vulnerability scores in the feature set.\n
Decentralized Finance (DeFi) took shape in 2020. An unprecedented amount of over 14 billion USD moved into DeFi projects offering trading, loans and insurance. But its growth has also drawn the attention of malicious actors. Many projects were exploited as quickly as they launched and millions of USD were lost. While many developers understand integer overflows and reentrancy attacks, security threats to the DeFi ecosystem are more complex and still poorly understood. In this paper we provide the first overview of in-the-wild DeFi security incidents. We observe that many of these exploits are market attacks, weaponizing weakly implemented business logic in one protocol with credit provided by another to inflate appropriations. Rather than misusing individual protocols, attackers increasingly use DeFi's strength of permissionless composability against itself. By providing the first holistic analysis of real-world security incidents within the nascent financial ecosystem DeFi is, we hope to inform threat modeling in decentralized cryptoeconomic initiatives in the years ahead.
With its unique advantages such as decentralization and immutability, blockchain technology has been widely used in various fields in recent years. The smart contract running on the blockchain is also playing an increasingly important role in decentralized application scenarios. Therefore, the automatic detection of security vulnerabilities in smart contracts has become an urgent problem in the application of blockchain technology. Hyperledger Fabric is a smart contract platform based on enterprise-level licensed distributed ledger technology. However, the research on the vulnerability detection technology of Hyperledger Fabric smart contracts is still in its infancy. In this paper, we propose HFContractFuzzer, a method based on Fuzzing technology to detect Hyperledger Fabric smart contracts, which combines a Fuzzing tool for golang named go-fuzz and smart contracts written by golang. We use HFContractFuzzer to detect vulnerabilities in five contracts from typical sources and discover that four of them have security vulnerabilities, proving the effectiveness of the proposed method.
The research designs a new integrated system for the security enhancement of a decentralized network by preventing damages from attackers, particularly for the 51 percent attack. The concept of multiple layered design based on Blockchain Governance Games frameworks could handle multiple number of networks analytically. The Multi-Layered Blockchain Governance Game is an innovative analytical model to find the best strategies for executing a safety operation to protect whole multiple layered network systems from attackers. This research fully analyzes a complex network with the compact mathematical forms and theoretically tractable results for predicting the moment of a safety operation execution are fully obtained. Additionally, simulation results are demonstrated to obtain the optimal values of configuring parameters of a blockchain-based security network. The Matlab codes for the simulations are publicly available to help those whom are constructing an enhanced decentralized security network architecture through this proposed integrated theoretical framework.
Blockchain is a revolutionary technology that is being used in many applications, including supply chain management. Although, the primary motive of using a blockchain for supply chain management is to reduce the overall production cost while providing the comprehensive security to the system. However, current blockchain-based supply-chain management (BC-SCM) systems still hold the possibility of cyber attacks. Therefore, the goal of this study is to investigate practical threats and vulnerabilities in the design of BC-SCM systems. As a starting point, we first establish key requirements for the reliability and security of supply chain management systems, i.e., transparency, privacy and traceability, and then discern a threat model that includes two distinctive but practical threats including computational (i.e., the ones that threaten the functionality of the application) and communication (i.e., the ones that threaten information exchange among interconnected services of the application). For investigation, we follow a unique approach based on the hypothesis that reliability is pre-requisite of security and identify the threats considering (i) design of smart contracts and associated supply chain management applications, (ii) underlying blockchain execution environment and (iii) trust between all interconnected supply management services. Moreover, we consider both academic and industry solutions to identify the threats. We identify several challenges that hinder to establish reliability and security of the BC-SCM systems. Importantly, we also highlight research gaps that can help to establish desired security of the BC-SCM. To the best of our knowledge, this paper is the first effort that identifies practical threats to blockchain-based supply chain management systems and provides their counter measures. Finally, this work establishes foundation for future investigation towards practical security of BC-SCM system.
With the development of blockchain technologies, the number of smart contracts deployed on blockchain platforms is growing exponentially, which makes it difficult for users to find desired services by manual screening. The automatic classification of smart contracts can provide blockchain users with keyword-based contract searching and helps to manage smart contracts effectively. Current research on smart contract classification focuses on Natural Language Processing (NLP) solutions which are based on contract source code. However, more than 94% of smart contracts are not open-source, so the application scenarios of NLP methods are very limited. Meanwhile, NLP models are vulnerable to adversarial attacks. This paper proposes a classification model based on features from contract bytecode instead of source code to solve these problems. We also use feature selection and ensemble learning to optimize the model. Our experimental studies on over 11K real-world Ethereum smart contracts show that our model can classify smart contracts without source code and has better performance than baseline models. Our model also has good resistance to adversarial attacks compared with NLP-based models. In addition, our analysis reveals that account features used in many smart contract classification models have little effect on classification and can be excluded.
Ponzi schemes are financial scams that lure users under the promise of high profits. With the prosperity of Bitcoin and blockchain technologies, there has been growing anecdotal evidence that this classic fraud has emerged in the blockchain ecosystem. Existing studies have proposed machine-learning based approaches for detecting Ponzi schemes, i.e., either based on the operation codes (opcodes) of the smart contract binaries or the transaction patterns of addresses. However, state-of-the-art approaches face several major limitations, including lacking interpretability and high false positive rates. Moreover, machine-learning based methods are susceptible to evasion techniques, and transaction-based techniques do not work on smart contracts that have a small number of transactions. These limitations render existing methods for detecting Ponzi schemes ineffective. In this paper, we propose SADPonzi, a semantic-aware detection approach for identifying Ponzi schemes in Ethereum smart contracts. Specifically, by strictly following the definition of Ponzi schemes, we propose a heuristic-guided symbolic execution technique to first generate the semantic information for each feasible path in smart contracts and then identify investor-related transfer behaviors and the distribution strategies adopted. Experimental result on a well-labelled benchmark suggests that SADPonzi can achieve 100% precision and recall, outperforming all existing machine-learning based techniques. We further apply SADPonzi to all 3.4 million smart contracts deployed by EOAs in Ethereum and identify 835 Ponzi scheme contracts, with over 17 million US Dollars invested by victims. Our observations confirm the urgency of identifying and mitigating Ponzi schemes in the blockchain ecosystem.
3 source records
Blockchain Technology Applications and Security
Spam and Phishing Detection
Advanced Steganography and Watermarking Techniques
Tsuyoshi Taniguchi, Harm Griffioen, Christian Doerr
Malware, like all products and services, evolves with bursts of innovation. These advances usually happen whenever security controls get ''good enough'' to significantly impact the revenue stream of malicious actors, and in the past we have seen the malware ecosystem to adopt concepts such as code obfuscation, polymorphism, domain-generation algorithms (DGAs), as well as virtual machine and sandbox evasion whenever defenses were able to perform consistent and pervasive suppression of these threats.