Blockchain Papers

Raúl Riesco, Xavier Larriva-Novo, Víctor A. Villagrá

No abstract is available for this record.

Jeong Hoon Jo, Shailendra Rathore, Vincenzo Loia, Jong Hyuk Park

Purpose The purpose of this paper is to propose a trusted security zone architecture that uses a blockchain technology to provide secure sharing of data in the security zone while maintaining the integrity, confidentiality and availability of data. The blockchain uses a distributed network to ensure data availability and uses public ledgers to ensure the integrity and confidentiality of data. Design/methodology/approach The proposed architecture uses a blockchain technology to provide secure sharing of data in the security zone while maintaining the integrity, confidentiality and availability of data. The blockchain uses a distributed network to ensure data availability and uses public ledgers to ensure the integrity and confidentiality of data. Findings Analysis of the proposed architecture with a use case scenario demonstrates that it provides a robust security measure against unauthorized network intrusions. Originality/value Unlike the existing security zone, this paper adopts a method of storing data by using blockchain. It meets the need to study integrated authentication management methods of future research.

Saar Tochner, Stefan Schmid, Aviv Zohar

Off-chain transaction networks can mitigate the scalability issues of today's trustless electronic cash systems such as Bitcoin. However, these peer-to-peer networks also introduce a new attack surface which is not well-understood today. This paper identifies and analyzes, a novel Denial-of-Service attack which is based on route hijacking, i.e., which exploits the way transactions are routed and executed along the created channels of the network. This attack is conceptually interesting as even a limited attacker that manipulates the topology through the creation of new channels can navigate tradeoffs related to the way it attacks the network. Furthermore, the attack also highlights a fundamental design tradeoff for the defender (who determines its own routes): to become less predictable and hence secure, a rational node has to pay higher fees to nodes that forward its payments. We find that the three most common implementations for payment channels in Bitcoin (lnd, C-lightning, Eclair) approach routing differently. We begin by surveying the current state of the Lightning network and explore the routes chosen by these implementations. We find that in the current network nearly 60\% of all routes pass through only five nodes, while 80\% go through only 10 nodes. Thus, a relatively small number of colluding nodes can deny service to a large fraction of the network. We then turn to study an external attacker who creates links to the network and draws more routes through its nodes by asking for lower fees. We find that just five new links are enough to draw the majority (65\% - 75\%) of the traffic regardless of the implementation being used. The cost of creating these links is very low. We discuss the differences between implementations and eventually derive our own suggested routing policy, which is based on a novel combination of existing approaches.

Michał Kędziora, Patryk Kozłowski, Michał Szczepanik, Piotr Jóźwiak

No abstract is available for this record.

Vikram Kanth

As the threat of cyber attack grows ever larger, new approaches to security are required. While there are several different types of intrusion detection systems (IDS), collaborative IDS (CIDS) offers particular promise in identifying distributed, coordinated attacks that might otherwise elude detection. Even for this type of IDS, there are unresolved issues associated with trusting participants and aggregating data. Blockchain technology appears capable of addressing those issues. This thesis is focused on presenting a proof-of-concept experiment leveraging an Ethereum-based private blockchain for a CIDS that uses pluggable authentication modules (PAM) to track login activity toward detection of doorknob rattling attacks.

Zohaib Ahmed, Syed Muhammad Danish, Hassaan Khaliq Qureshi, Marios Lestas

The exponential growth of Internet of Things (IoT) devices with limited computing resources and poor security configurations make them vulnerable to different cyber-attacks. Mirai Botnet malware exploits vulnerabilities of IoT devices resulting in massive Distributed Denial of Service (DDoS) attacks. Various techniques have been proposed to mitigate Mirai botnet attacks, but most of them are centralized or just provide precautionary steps to secure the IoT devices. This paper addresses IoT security against Mirai Botnet attacks using a novel blockchain based architecture. In our proposed approach, the network is divided into different Autonomous Systems (AS), through which host connectivity is established. Blockchains are used to store and share a list of Internet Protocol (IP) addresses of different hosts connected to an AS, indicating which of these have been identified as malicious. Every AS monitors the communication activity inside the network using the proposed approach and determines whether a host is infected with malware or not by comparing the total number of packets sent by the host with a specified threshold value. The proposed approach is simulated on a custom developed simulator which is used to determine a suitable value for the malicious threshold. The results indicate that the proposed solution works effectively in blocking malicious packets from the infected host so that they do not affect the response time of the victim. Furthermore, a scalability analysis is conducted and the block propagation delay is evaluated for different AS sizes and consensus algorithms.

Ui-Jun Baek, Se-Hyun Ji, Jee- Tae Park, Min‐Seob Lee · 6 authors

Since the inception of Bitcoin, the first cryptocurrency to implement blockchain technology, the cryptocurrency market has experienced significant growth.However, this growth has also brought about numerous vulnerabilities and attacks that pose a threat to the Bitcoin ecosystem.These attacks are not only focused on the Bitcoin network itself but also extend to the services that utilize it.Recent surveys have indicated the need to analyze and identify Distributed Denial of Service (DDoS) attacks, considering the interconnectedness between network-level data and service-level DDoS attacks within the Bitcoin system.Typically, the Bitcoin network is considered resilient against DDoS attacks due to the decentralized nature of its ledger.Nevertheless, there are potential vulnerabilities that could be exploited, such as message spoofing using the Transmission Control Protocol (TCP).Additionally, DDoS attacks often target services associated with Bitcoin usage rather than directly impacting the network's performance or stealing currency.Although these service-level attacks may not have an immediate impact, they can ultimately undermine the value of Bitcoin, leading to depreciation.The majority of DDoS attacks on Bitcoin-related services occur on exchanges and mining pools.Our approach involves evaluating experimental outcomes based on proposed metrics to establish a correlation between network-level data and service-level DDoS attacks in the Bitcoin system.By doing so, we aim to detect and analyze these attacks, thereby identifying potential associations.Furthermore, we posit that the methodology employed in this study could be applicable to other blockchain systems, extending its usefulness beyond the Bitcoin network.

Meryam Essaid, Daeyong Kim, Soo Hoon Maeng, Sejin Park · 5 authors

Recently Distributed Denial-of-Service (DDoS) are becoming more and more sophisticated, which makes the existing defence systems not capable of tolerating by themselves against wide-ranging attacks. Thus, collaborative protection mitigation has become a needed alternative to extend defence mechanisms. However, the existing coordinated DDoS mitigation approaches either they require a complex configuration or are highly-priced. Blockchain technology offers a solution that reduces the complexity of signalling DDoS system, as well as a platform where many autonomous systems (Ass) can share hardware resources and defence capabilities for an effective DDoS defence. In this work, we also used a Deep learning DDoS detection system; we identify individual DDoS attack class and also define whether the incoming traffic is legitimate or attack. By classifying the attack traffic flow separately, our proposed mitigation technique could deny only the specific traffic causing the attack, instead of blocking all the traffic coming towards the victim(s).

Vladimír Veselý, Martin Žádník

No abstract is available for this record.

Bruno Rodrigues, Burkhard Stiller

Driven by the increasing number of stationary and portable devices, Distributed Denial-of-Service (DDoS) attacks pose a major threat to Internet availability. While advantages of cooperative defenses have been widely recognized over traditional on-premise defenses, there is not a widespread deployment of such cooperative defenses. This work demonstrates the Blockchain Signaling System (BloSS), a modular, network-agnostic and cooperative DDoS defense system consisting of independent instances working together to mitigate attacks targeted at any member of this alliance.

Weizhi Meng, Wenjuan Li, Laurence T. Yang, Peng Li

No abstract is available for this record.

Lo‐Yao Yeh, Jiun‐Long Huang, T.S. Benedict Yen, Jen-Wei Hu

In this paper, we propose a consortium blockchainbased system sharing malicious IP to prevent further attacks happening among other hosts. In our scheme, every security operation center (SOC) serving as a blockchain-node uploads some suspicious IPs to find the potential attackers' IPs. A smart contract is responsible for comparing the loaded IPs and the existing ones without human interference. If IPs in different lists are matched with certain degree, this system will respond by giving the whole list of malicious IP. By means of these steps, shares of IP lists are achieved and attacks are prevented in advance. Besides, when uploading and sharing, we utilize elliptic curve cryptography to ensure data confidentiality and integrity.

Raja Majid Ali Ujjan, Zeeshan Pervez, Keshav Dahal

Due to the rapid increment of the cyber attacks, intrusion detection system (IDS) is shifting towards collaborative approaches. There is a huge demand for securing larger networking environments for providing a safeguard against threats. In order to optimize the feasible detection performance, Collaborative Intrusion Detection Networks (CIDN) approaches have been adopted in practical scenarios, which enables a group of IDS nodes to mutually share and exchange mandatory information with each other, for example, IDS-signatures, attacks alarms. However, CIDN networks are distributed in nature, such networks still face plenty of implementation problems, especially, insider intruder can easily dominate any of security node and leave the entire security system vulnerable. To achieve the trust-based communication between each of IDS node, the recent advancement in blockchain applications is considered as a good fit to create trust-based communication in CIDN networks. This work converges CIDN network and blockchain in SDN context. Firstly, we investigated existing related work and highlighted challenges and research gap towards blockchain in CIDN networks. Secondly, we utilised three collaborated Snort IDS to receive the latest signature update from Ryu and then to securely share such signatures updates to all other Snort nodes within test-bed. Our work is motivated to detect seven types of common attacks with collaborated signature-based IDS, which feasibly processes more packets to achieve satisfactory detection results. Overall the evaluation results show that with the adoption of blockchain protocols, the proposed CIDN network achieves 96% of TP rate detection rate for TCP, UDP and ICMP packets.

Arnab Bose, Gagangeet Singh Aujla, Maninderpal Singh, Neeraj Kumar · 5 authors

Software defined networking (SDN) is one of the most popular network technologies which provides an adaptive, agile and flexible network management and visibility. Although SDN architecture provides manifold benefits but on the same time its dependence on a logically centralized controller lead to the single point of failure. An attacker can easily capture the any forwarding device and restrict the availability of the controller using different prevalent attacks. Distributed denial of service (DDoS) is one of the most popular attack of this category which is quiet prevalent in SDN. Here, the aim of the attackers is to inject false script in the open flow tables through malicious switches which multiply exponentially. Therefore, in this paper, a blockchain as a service framework has been presented wherein BlockSDSec model is designed to provide security as a separate service for the SDN architecture. This work provides a mechanism to prevent the threats of DDoS at the switch level by embedding an security using blockchain onto the interaction channels of data and control planes. The load balancing at the controller level is achieved using a virtual controller. The proposed scheme is simulated using MiniNet Emulator to analyze the delay originating from usage of blockchain.

Oluwaseyi Ajayi, Melvin Cherian, Tarek Saadawi

The proliferation of cloud database has increased its vulnerability to cyberattacks. Despite several proposed methods of securing databases, malicious intruders find ways to exploit their vulnerabilities and gain access to data. This is because cyberattacks are becoming more sophisticated and harder to detect. As a result, it is becoming very difficult for a single or isolated intrusion detection system (IDS) node to detect all attacks. With the adoption of cooperative intrusion detection system, all attacks can be detected by an IDS node with the help of other IDS nodes. In cooperative intrusion detection, IDS nodes exchange attack signatures with the view of promptly detecting any attack that has been detected by other IDS. Therefore, the security of the database that houses these shared attack signatures becomes a huge problem. More specifically, detecting and/or preventing malicious signature injection, manipulation or deletion becomes important. This paper proposed an architecture that securely stores and distribute these attack signatures in real time for the purpose of prompt detection. Our proposed architecture leverages the distributed ledger technology, data immutability and tamper-proof abilities of blockchain technology. The performance of our system was examined by using the latency of the blockchain network.

Abdelouahid Derhab, Mohamed Guerroumi, Abdu Gumaei, Λέανδρος Μαγλαράς · 7 authors

The industrial control systems are facing an increasing number of sophisticated cyber attacks that can have very dangerous consequences on humans and their environments. In order to deal with these issues, novel technologies and approaches should be adopted. In this paper, we focus on the security of commands in industrial IoT against forged commands and misrouting of commands. To this end, we propose a security architecture that integrates the Blockchain and the Software-defined network (SDN) technologies. The proposed security architecture is composed of: (a) an intrusion detection system, namely RSL-KNN, which combines the Random Subspace Learning (RSL) and K-Nearest Neighbor (KNN) to defend against the forged commands, which target the industrial control process, and (b) a Blockchain-based Integrity Checking System (BICS), which can prevent the misrouting attack, which tampers with the OpenFlow rules of the SDN-enabled industrial IoT systems. We test the proposed security solution on an Industrial Control System Cyber attack Dataset and on an experimental platform combining software-defined networking and blockchain technologies. The evaluation results demonstrate the effectiveness and efficiency of the proposed security solution.

Mohamed Amine Ferrag, Λέανδρος Μαγλαράς

In this paper, we propose a novel deep learning and blockchain-based energy framework for smart grids, entitled DeepCoin. The DeepCoin framework uses two schemes, a blockchain-based scheme and a deep learning-based scheme. The blockchain-based scheme consists of five phases: setup phase, agreement phase, creating a block phase and consensus-making phase, and view change phase. It incorporates a novel reliable peer-to-peer energy system that is based on the practical Byzantine fault tolerance algorithm and it achieves high throughput. In order to prevent smart grid attacks, the proposed framework makes the generation of blocks using short signatures and hash functions. The proposed deep learning-based scheme is an intrusion detection system (IDS), which employs recurrent neural networks for detecting network attacks and fraudulent transactions in the blockchain-based energy network. We study the performance of the proposed IDS on three different sources the CICIDS2017 dataset, a power system dataset, and a web robot (Bot)-Internet of Things (IoT) dataset.

Shailendra Rathore, Byung Wook Kwon, Jong Hyuk Park

No abstract is available for this record.

Yang Chen, Jiamou Liu

Blockchain technology provides a groundbreaking computing paradigm that tackles problems in a completely decentralised manner. As the underlying infrastructure and protocol of blockchain, blockchain networks convey communications and coordination across all involving participants. In extensive application scenarios, conducting community detection over blockchain networks has potential effects on both discovering hidden information and enhancing communicating efficiency. However, the decentralised nature poses a restriction on community detection over blockchain networks. In coping with this restriction, we propose a distributed community detection method based on the Propose-Select-Adjust (PSA) framework that runs in an asynchronous way. We extend the PSA framework using the concept of structural entropy and aim to detect a community structure with low entropy. We test our entropy-based distributed community detection algorithm on both benchmark networks and bitcoin trust networks. Experimental results reveal that our algorithm successfully detects communities with low structural entropy.

Uros Hercog, Andraž Povše

Determining the trust of an individual Bitcoin wallet is a difficult problem. There are no ratings, that offer vendors or exchanges meaningful information about the level of the taint of Bitcoins they are receiving. Lack of such information places exchanges liable in an event when the received Bitcoins are stolen or ill-gotten. In this paper, we try to solve this problem by introducing a Bitcoin address taint score called TaintRank. It provides insight into a specific wallet by taking the addresses it interacted with throughout history into consideration. This ranking method provides such Bitcoin exchange companies insight with whom they are trading.

Gohar Sargsyan, Nicolas Castellon, Raymond Binnendijk, Peter Cozijnsen

With the recent advances of IoT (Internet of Things) new and more robust security frameworks are needed to detect and mitigate new forms of cyber-attacks, which exploit complex and heterogeneity IoT networks, as well as, the existence of many vulnerabilities in IoT devices. With the rise of block chain technologies service providers pay considerable attention to better understand and adopt blockchain technologies in order to have better secure and trusted systems for own organisations and their customers. The present paper introduces a high level guide for the senior officials and decision makers in the organisations and technology managers for blockchain security framework by design principle for trust and adoption in IoT environments. The paper discusses Cyber-Trust project's blockchain technology development as a representative case study for offered security framework. Security and privacy by design approach is introduced as an important consideration in setting up the framework.

S. Erfani, Majid Ahmadi

Bitcoin is a cryptocurrency which acts as an application protocol that works on top of the IP protocol. This paper focuses on distinct Bitcoin security features, including security services, mechanisms, and algorithms. Further, we propose a well-defined security functional architecture to minimize security risks. The security features and requirements of Bitcoin have been structured in layers.

Yan Wu, Anthony Luo, Dianxiang Xu

Bitcoin [1] as a popular digital currency has been a target of theft and other illegal activities. Key to the forensic investigation is to identify bitcoin addresses involved in bitcoin transfers. This paper presents a framework, FABT, for forensic analysis of bitcoin transactions by identifying suspicious bitcoin addresses. It formalizes the clues of a given case as transaction patterns defined over a comprehensive set of features. FABT converts the bitcoin transaction data into a formal model, called Bitcoin Transaction Net (BTN). The traverse of all bitcoin transactions in the order of their occurrences is captured by the firing sequence of all transitions in the BTN. We have applied FABT to identify suspicious addresses in the Mt.Gox case. A subgroup of the suspicious addresses has been found to share many characteristics about the received/transferred amount, number of transactions, and time intervals.

Nicholas Kolokotronis, Sotirios Brotsis, Georgios Germanos, Costas Vassilakis · 5 authors

This paper considers the use of novel technologies for mitigating attacks that aim at compromising intrusion detection systems (IDSs). Solutions based on collaborative intrusion detection networks (CIDNs) could increase the resilience against such attacks as they allow IDS nodes to gain knowledge from each other by sharing information. However, despite the vast research in this area, trust management issues still pose significant challenges and recent works investigate whether these could be addressed by relying on blockchain and related distributed ledger technologies. Towards that direction, the paper proposes the use of a trust-based blockchain in CIDNs, referred to as trust-chain, to protect the integrity of the information shared among the CIDN peers, enhance their accountability, and secure their collaboration by thwarting insider attacks. A consensus protocol is proposed for CIDNs, which is a combination of a proof-of-stake and proof-of-work protocols, to enable collaborative IDS nodes to maintain a reliable and tampered-resistant trust-chain.