With the faster maturity and stability of digitization, connectivity and edge technologies, the number of the Internet of Things (IoT) devices and sensors is flourishing fast in important junctions such as homes, hotels, hospitals, retail stores, manufacturing floors, railway stations, airports, oil wells, warehouses, etc. However, in this extremely connected world, the security implications for IoT devices are getting worse with the constant rise in malicious cyberattacks. The challenge is how to secure IoT sensors, services and data. The blockchain technology, a prominent distributed ledger technology (DLT), is being pronounced as the way forward for safeguarding IoT devices and data. The Directed Acyclic Graph (DAG)-based DLT has the inherent potential to realize the benefits of blockchain with better performance. IOTA is a DAG-based blockchain implementation for the IoT era. The Tangle, the IOTA’s network immutably records the exchange of data and value. It ensures that the information is trustworthy and cannot be tampered with nor destroyed. In this work, we depict a thorough analysis of the existing security studies for IOTA. Then, we identify the gaps and the limitations of these security solution schemes, and finally, propose future security research recommendations that can potentially fill these gaps to secure DLT-enabled IoT devices.
We present a methodology to develop verified smart contracts. We write smart contracts, their specifications and implementations in the verification-friendly language Dafny. In our methodology the ability to write specifications, implementations and to reason about correctness is a primary concern. We propose a simple, concise yet powerful solution to reasoning about contracts that have external calls. This includes arbitrary re-entrancy which is a major source of bugs and attacks in smart contracts. Although we do not yet have a compiler from Dafny to EVM bytecode, the results we obtain on the Dafny code can reasonably be assumed to hold on Solidity code: the translation of the Dafny code to Solidity is straightforward. As a result our approach can readily be used to develop and deploy safer contracts.
Wilson S. Melo, Lucas S. Dos Santos, Lucila M. S. Bento, Paulo R. Nascimento · 6 authors
The monitoring and protection of critical infrastructures, especially the ones involving physical assets (e.g., dams, nuclear energy facilities, governmental buildings), constitute a challenging problem. The failure and collapse of these infrastructures can cause untold consequences. Recent works have proposed blockchains as a tool to improve monitoring systems in different critical infrastructures. However, most previous works lack on presenting a more in-depth discussion about how to implement these solutions. In this paper, we develop a practical approach. We propose a comprehensive framework that describes how to implement a blockchain-based system to monitor and protect critical infrastructures. We implement our framework in two distinct blockchain platforms: Ethereum and Hyperledger Fabric. We compare both implementations and discuss their differences in terms of performance, easiness of development, security, privacy, complexity, and costs. We believe that our results can be valuable for professionals interested in applying blockchain-based solutions to protect critical infrastructures.
Da Chen, Lin Feng, Yuqi Fan, Siyuan Shang · 5 authors
It is imperative to assure the security of smart contracts via intelligent vulnerability detection tools before deploying smart contracts on blockchains. The existing deep learning-based approaches fail to effectively capture the rich syntax and semantic information embedded in smart contracts. In this paper, we detect smart contract vulnerabilities at the function level by constructing a novel semantic graph (SG) for each function and learning the SGs using a new graph convolutional network EA-RGCN. Our proposed method consists of three stages. In the first stage, we create the SG which characterizes rich data-data, instruction-instruction and instruction-data relationships in the function code. In the second stage, we propose EA-RGCN which contains three parts: node and edge representation via word2vec, content feature extraction with a residual GCN (RGCN) module, and semantic feature extraction using an edge attention (EA) module. Finally, we concatenate the code content features and the semantic features to obtain the global code feature and use a Multilayer Perceptron (MLP) to identify whether the function is vulnerable. We conduct experiments on the dataset constructed from real-world smart contracts. Experimental results demonstrate that the proposed semantic graph and the EA-RGCN model can achieve superior performance.
A blockchain is a list of data blocks as a publicly distributed ledger, which are linked together using cryptography. By allowing Turing-complete programming languages to implement smart contracts, recent blockchains such as Ethereum can reduce needs in trusted intermediators, arbitrations and enforcement costs. However, subtle errors in smart contracts have induced an enormous financial loss—for examples, the DAO attack, Parity multisignature wallet attacks, and integer underflow/overflow attacks. To identify such errors in smart contracts, various researches are performed, which are based on static analysis and theorem proving. However, they only support inspection for pre-defined error patterns, or they cannot explore the whole searching space exhaustively or be fully automatic. Hence, in this paper, we propose a novel formal verification technique to analyze blockchain smart contracts by using ATL model checking. In our methodology, we represent the interaction between users and smart contracts into a two-player game and verify properties we want to check using MCMAS that is an efficient ATL model checker for multi-agent systems. Moreover, we present three case studies to show that our proposal can successfully identify subtle flaws in real world smart contracts.
A smart contract is a computer program which is automatically executed with some conditional statements such as “if/then”. Since smart contracts can include some vulnerable program codes, smart contract exploit was recently highlighted as one of the severe threats to Ethereum blockchain. As one of the efficient and effective smart contract vulnerability detection methods, deep learning methods have been studied due to the fast detection speed and the high detection accuracy. Recently, the deep learning methods using convolutional neural network(CNN) have actively studied to classify images transformed from smart contracts into vulnerable or invulnerable. However, while simply transforming a smart contract into an image and analyzing, semantics and context of the smart contract are ignored to cause false detection alarms. To detect vulnerable smart contracts while maintaining their semantics and context, we propose a new code-targeted CNN architecture, called CodeNet. To improve the performance of CodeNet, we also design a data pre-processing procedure, where a smart contract is transformed into an image while maintaining locality. From the experimental results under various types of vulnerabilities, the proposed CodeNet-based vulnerability detection method shows the good-enough detection performance and detection time compared to well-known state-of-the-art vulnerability detection tools.
Jie Cai, Bin Li, Jiale Zhang, Xiaobing Sun · 5 authors
Smart contract security has drawn extensive attention in recent years because of the enormous economic losses caused by vulnerabilities. Even worse, fixing bugs in a deployed smart contract is difficult, so developers must detect security vulnerabilities in a smart contract before deployment. Existing smart contract vulnerability detection efforts heavily rely on fixed rules defined by experts, which are inefficient and inflexible.To overcome the limitations of existing vulnerability detection approaches, we propose a GNN based approach for smart contract vulnerability detection. First, we construct a graph representation for a smart contract function with syntactic and semantic features by combining abstract syntax tree (AST), control flow graph (CFG), and program dependency graph (PDG). To further strengthen the presentation ability of our approach, we perform program slicing to normalize the graph and eliminate the redundant information unrelated to vulnerabilities. Then, we use a Bidirectional Gated Graph Neural-Network model with hybrid attention pooling to identify potential vulnerabilities in smart contract functions.
Blockchain technology and its applications are gaining popularity day by day. It is a ground-breaking technology that allows users to communicate without the need of a trusted middleman. A smart contract (self-executable code) is deployed on the blockchain and auto executes due to a triggering condition. In a no-trust contracting environment, smart contracts can establish trust among parties. Terms and conditions embedded in smart contracts will be imposed immediately when specified criteria have been fulfilled. Due to this, the malicious assailants have a special interest in smart contracts. Blockchains are immutable means if some transaction is deployed or recorded on the blockchain, it becomes unalterable. Thus, smart contracts must be analyzed to ensure zero security vulnerabilities or flaws before deploying the same on the blockchain because a single vulnerability can lead to the loss of millions. For analyzing the security vulnerabilities of smart contracts, various analysis tools have been developed to create safe and secure smart contracts. This paper presents a systematic review on Ethereum smart contracts analysis tools. Initially, these tools are categorized into static and dynamic analysis tools. Thereafter, different sources code analysis techniques are studied such as taint analysis, symbolic execution, and fuzzing techniques. In total, 86 security analysis tools developed for Ethereum blockchain smart contract are analyzed regardless of tool type and analysis approach. Finally, the paper highlights some challenges and future recommendations in the field of Ethereum smart contracts.
A smart public transport system is expected to be an integral part of our human lives to improve our mobility and reduce the effect of our carbon footprint. The safety and ongoing maintenance of the smart public transport system from cyberattacks are vitally important. To provide more comprehensive protection against potential cyberattacks, we propose a novel approach that combines blockchain technology and a deep learning method that can better protect the smart public transport system. By the creation of signed and verified blockchain blocks and chaining of hashed blocks, the blockchain in our proposal can withstand unauthorized integrity attack that tries to forge sensitive transport maintenance data and transactions associated with it. A hybrid deep learning-based method, which combines autoencoder (AE) and multi-layer perceptron (MLP), in our proposal can effectively detect distributed denial of service (DDoS) attempts that can halt or block the urgent and critical exchange of transport maintenance data across the stakeholders. The experimental results of the hybrid deep learning evaluated on three different datasets (i.e., CICDDoS2019, CIC-IDS2017, and BoT-IoT) show that our deep learning model is effective to detect a wide range of DDoS attacks achieving more than 95% F1-score across all three datasets in average. The comparison of our approach with other similar methods confirms that our approach covers a more comprehensive range of security properties for the smart public transport system.
Kai Wang, Jun Pang, Ding-Jie Chen, Yu Zhao · 7 authors
Exploiting the anonymous mechanism of Bitcoin, ransomware activities demanding ransom in bitcoins have become rampant in recent years. Several existing studies quantify the impact of ransomware activities, mostly focusing on the amount of ransom. However, victims’ reactions in Bitcoin that can well reflect the impact of ransomware activities are somehow largely neglected. Besides, existing studies track ransom transfers at the Bitcoin address level, making it difficult for them to uncover the patterns of ransom transfers from a macro perspective beyond Bitcoin addresses. In this article, we conduct a large-scale analysis of ransom payments, ransom transfers, and victim migrations in Bitcoin from 2012 to 2021. First, we develop a fine-grained address clustering method to cluster Bitcoin addresses into users, which enables us to identify more addresses controlled by ransomware criminals. Second, motivated by the fact that Bitcoin activities and their participants already formed stable industries, such as Darknet and Miner , we train a multi-label classification model to identify the industry identifiers of users. Third, we identify ransom payment transactions and then quantify the amount of ransom and the number of victims in 63 ransomware activities. Finally, after we analyze the trajectories of ransom transferred across different industries and track victims’ migrations across industries, we find out that to obscure the purposes of their transfer trajectories, most ransomware criminals (e.g., operators of Locky and Wannacry) prefer to spread ransom into multiple industries instead of utilizing the services of Bitcoin mixers. Compared with other industries, Investment is highly resilient to ransomware activities in the sense that the number of users in Investment remains relatively stable. Moreover, we also observe that a few victims become active in the Darknet after paying ransom. Our findings in this work can help authorities deeply understand ransomware activities in Bitcoin. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal activities that have similarly adopted bitcoins as their payments.
Abdul Razaque, Bandar Alotaibi, Munif Alotaibi, Fathi Amsaad · 8 authors
When people use social networks, they often fall prey to a clickbait scam. The scammer attempts to create a striking headline that attracts the majority of users and attaches a link. The user follows the link and can be redirected to a fraudulent resource where the user easily loses personal data. To solve this problem, a Blockchain-enabled deep recurrent neural network (BDRNN) is proposed to detect the nature safe and malicious clickbait from the contents. The proposed BDRNN consists of three phases: analysis of clickbait and source rating, clickbait search process and multi-layered clickbait detection. The analysis of clickbait and source rating phase helps to analyze different sources to detect the clickbait and also rating the content-sources. To achieve the clickbait analysis and source rating, the detection of blocklisted/allowlisted source and source rating check algorithms are introduced. The clickbait search process is accomplished by incorporating the binary search features for a faster and more efficient search process for malicious content-detection. The multi-layered clickbait detection is main phase of the proposed BDRNN that consists of three models: content-to-vector model (layer-1), deep neural network model(layer-2), and Blockchain-enabled malicious content detection model (layer-3). These models collectively detect the malicious and safe clickbait from the contents. The extensive experiments are conducted to determine the effectiveness of the proposed BDRNN model and compared with the existing state-of-the-art neural network models designed for clickbait detection, and the result demonstrates that the proposed BDRNN model outperforms the counterparts from the, accuracy, link detection, memory usage, analogous perspectives, and attacker’s successful content capturing rate.
Cryptocurrency is a digital asset that works through distributed ledger technology such as a blockchain. Blockchain was dubbed as un-hackable by many, but recent incidents indicate that it is not the case. This paper aims to examine different types of cyberattacks. Attacking cryptocurrencies is much more intriguing to criminals, mainly because of the reason that reverting those funds is a laborious task in itself. This paper surveys 5 different kinds of cryptocurrency attacks and also examines different consensus algorithms used by cryptocurrencies. Despite blockchain being a leading edge technology, the vulnerabilities in the technology has caused difficulties in the past and cannot be ignored.
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
The Voting System in India is often corrupted and altered. The idea is to create an unbiased, secure, fast and efficient Voting System. This project is based on the domain of Block Chain wherein the voting database will be highly secure and processed quickly. The Iris Recognition is another aspect of this system which makes the process flawless. The usage of Blockchain based Database to store the data will make the voting information immutable, reliable and can be quickly accessed. The authorized results tracking makes the voting process more secure, quick and efficient since it is semi-automated. The Iris Recognition identifies the unique patterns of Irises using infrared light and generates an encrypted bit pattern which should match at the time of voting, in order to confirm the individual's identity is true. The process of Iris Scanning is backed up with fingerprint recognition exclusively for blind voting candidates since their Iris pattern may not be measured precisely by the Iris Recognition System.
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
What is the funniest number in cryptography (Episode 2)? 0 [1]. The reason is that $\forall x, x \cdot 0 = 0$, i.e., the equation is satisfied no matter what $x$ is. We'll use zero to attack zero-knowledge proof (ZKP). In particular, we'll discuss a critical issue in a cutting-edge ZKP PLONK [2] C++ implementation which allows an attacker to create a forged proof that all verifiers will accept. We'll show how theory guides the attack's direction. In practice, the attack works like a charm and we'll show how the attack falls through a chain of perfectly aligned software cracks. In the same codebase, there is an independent critical ECDSA bug where (r, s) = (0, 0) is a valid signature for arbitrary keys and messages, but we won't discuss it further because it's a known ECDSA attack vector in the Google Wycheproof cryptanalysis project [3] that I worked on a few years ago. All bugs have been responsibly disclosed through the vendor's bug bounty program with total reward $\sim \$15,000$ (thank you).
The rapid development of the automotive Industrial Internet of Things requires secure networking infrastructure toward digitalization. Cybertwin (CT) is a next-generation networking architecture that serves as a communication, and digital asset owner, and can make the Vehicle-to-Everything (V2X) network flexible and secure. However, CT itself can publish end users’ digital assets to other entities as a service, making data security and privacy major obstacles in the realization of V2X applications. Motivated from the aforementioned discussion, this article presents BDTwin, a blockchain and deep-learning-based integrated framework to enhance security and privacy in CT-driven V2X applications. Specifically, a blockchain scheme is designed to ensure secure communication among vehicles, roadside units, CT-edge server, and cloud server using a smart contract-based enhance-Proof-of-Work (ePoW) and Zero Knowledge Proof (ZKP)-based verification process. Smart contracts are used to enforce rules and regulations that govern the behavior of V2X entities in a nondeniable and automated manner. In a deep-learning scheme, an autoregressive-deep variational autoencoder model is combined with attention-based bidirectional long short-term memory (A-BLSTM) for automatic feature extraction and attack detection by analyzing CT-edge servers data in a V2X environment. Security analysis and experimental results using two different sources, ToN-IoT and CICIDS-2017 show the superiority of the proposed BDTwin framework over some baseline and recent state-of-the-art techniques.
A smart contract cannot be modified once deployed. Bugs in deployed smart contracts may cause devastating consequences. For example, the infamous reentrancy bug in the DAO contract allows attackers to arbitrarily withdraw ethers, which caused millions of dollars loss. Currently, the main countermeasure against contract bugs is to thoroughly detect and verify contracts before deployment, which, however, cannot defend against unknown bugs. These detection methods also suffer from possible false negative results.
In recent years Industrial Control Systems (ICS) have been targeted increasingly by sophisticated cyberattacks. Improving ICS security has drawn significant attention in the literature that emphasises the importance of Cyber Threat Intelligence (CTI) sharing in accelerating detection, mitigation, and prevention of cyberattacks. However, organisations are reluctant to exchange CTI due to fear of exposure, reputational damage, and lack of incentives. Furthermore, there has been limited discussion about the factors influencing participation in sharing CTI about ICS. The existing CTI-sharing platforms rely on centralised trusted architectures that suffer from a single point of failure and risk companies' privacy as the central node maintains CTI details. In this paper, we address the needs of organisations involved in the management and protection of ICS and present a novel framework that facilitates secure, private, and incentivised exchange of CTI related to ICS using blockchain. We propose a new blockchain-enabled framework that facilitates the secure dissemination of CTI data among multiple stakeholders in ICS. We provide the framework design, technical development and evaluate the framework's feasibility in a real-world application environment using practical use-case scenarios. Our proposed design shows a more practical and efficient framework for a CTI sharing network for ICS, including the bestowal and acknowledgment of data privacy, trust barriers, and security issues ingrained in this domain.
Security problems in smart contracts are considered critical, because they are usually implemented in the field of financial services, such as cryptocurrency management. Although numerous solutions have been proposed recently, most of these are dedicated to the vulnerabilities of the source code of smart contracts before they are deployed and cannot cover runtime security issues. For instance, the deployment of vulnerable smart contracts on Ethereum block chains could cause serious damage at runtime, because contracts deployed on block chains are indestructible and are freely used later in the public domain. In addition, smart contracts are deployed in bytecode, a form that is naturally not human-readable, and thus, users fail to perceive their vulnerabilities. In this paper, ReByte, a runtime monitoring method for security enhancement of smart contracts deployed on Ethereum, is proposed. This method is based on a function-call interceptor for smart contracts that operates at runtime, and it checks the security-related properties of smart contracts and takes the corresponding measures described in a JSON policy file. At the beginning of its runtime, a smart contract bytecode is dynamically rewritten to embed within it the policy enforcement logic. The results of experiments on real-world Ethereum smart contracts on EtherScan [18] show that the ReByte prototype efficiently enhances the safety of smart contracts.
Ethereum is essentially a transaction-driven state machine, and a smart contract is a piece of executable code on Ethereum. Compared with the scripting language on Bitcoin, the smart contract language solidity, which is Turing-complete and the ex-pressive capabilities are very powerful. However, this attribute also brings many potential security threats, vulnerabilities, and various other issues. In this paper, we propose a novel smart contract security technology, named Jyane, to detect the Reentrancy vulnerability, which is one of the most threatening vulnerabilities to smart contracts. More importantly, Our tool-Jyane is the first path profiling solution for smart contracts. Firstly, we use EVM (Ethereum Virtual Machine) binary bytecode to construct control flow graphs (CFG), then use the improved Ball-Larus Path profiling algorithm (BLPP) to generate IDs for acyclic paths. Finally, after profiling the constructed paths, the suspicious paths can be detected successfully. We evaluate Jyane and other technology through comprehensive test and comparison; the results show that Jyane can profile the actual execution path of smart contracts to detect vulnerabilities with a low false-positive rate accurately. From the results of the evaluation, Jyane marked 27 of 1,226 Ethereum smart contracts selected in 2016 and 2017 as vulnerable contracts, included the vulnerability of the DAO contract which once led to a $60 million loss. Furthermore, compared with some other existing detection tools, Jyane shows broader detection range for Reentrancy vulnerabilities with lower time overhead.
Smart contracts are a landmark achievement of blockchain technology 2.0 and are widely adopted in various applications. However, smart contracts are not always secure and there are various vulnerabilities. The reentrancy vulnerability is one of most serious vulnerabilities, and it has caused huge economic losses. Although many methods have been proposed to detect reentrancy vulnerabilities, they all have high false positives. To deal with this problem, we propose a symbolic execution-based detection tool for reentrancy vulnerabilities of smart contracts at the EVM bytecode level. By analyzing a large number of real-world smart contracts, we conclude main patterns of false positives and design five effective path filters to eliminate false positives. We evaluate its performance on real-world datasets in comparison with the state-of-the-art works, and the results show that our tool is more effective in the detection of reentrancy vulnerabilities.