Jordi Zayuelas i Munoz, José Suárez‐Varela, Pere Barlet‐Ros
In the last few years, cryptocurrency mining has become more and more important on the Internet activity and nowadays is even having a noticeable impact on the global economy. This has motivated the emergence of a new malicious activity called cryptojacking, which consists of compromising other machines connected to the Internet and leverage their resources to mine cryptocurrencies. In this context, it is of particular interest for network administrators to detect possible cryptocurrency miners using network resources without permission. Currently, it is possible to detect them using IP address lists from known mining pools, processing information from DNS traffic, or directly performing Deep Packet Inspection (DPI) over all the traffic. However, all these methods are still ineffective to detect miners using unknown mining servers or result too expensive to be deployed in real-world networks with large traffic volume. In this paper, we present a machine learning-based method able to detect cryptocurrency miners using NetFlow/IPFIX network measurements. Our method does not require to inspect the packets' payload; as a result, it achieves cost-efficient miner detection with similar accuracy than DPI-based techniques.
Ransomware represents a class of malicious applications that encrypts the files of infected system and demands from victims a payment in cryptocurrency in order to receive the decryption key. The mainstream adoption of cryptocurrencies increased the number of ransomware attack. The outbreaks had risen in complexity and received mass-media attention in 2017 when two destructive campaigns crippled companies and institutions around the world. These outbreaks continue at an accelerated pace even though efforts are made to improve the detection and mitigation of ransomware. The purpose of this research is to assess the efficiency of current malware analysis methods and technologies in the detection of ransomware. The experiments presented here were performed using antivirus engines and dynamic malware analysis against live obfuscated ransomware samples.
With the prevalence of blockchain, more and more Decentralized Applications (DApps) are deployed on Ethereum to achieve the goal of communicating without supervision. Users habits may be leaked while these applications adopt SSL/TLS to encrypt their transmission data. Encrypted protocol and the same blockchain platform bring challenges to the traffic classification of DApps. Existing encrypted traffic classification methods suffer from low accuracy in the situation of DApps.
2 source records
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Networks (Autonomous Systems-AS) allocate or revoke IP prefixes with the intervention of official Internet resource number authorities, and select and advertise policy-compliant paths towards these prefixes using the inter-domain routing system and its primary enabler, the Border Gateway Protocol (BGP). Securing BGP has been a long-term objective of several research and industrial efforts during the last decades, that have culminated in the Resource Public Key Infrastructure (RPKI) for the cryptographic verification of prefix-to-AS assignments. However, there is still no widely adopted solution for securing IP prefixes and the (AS-)paths leading to them; approaches such as BGPsec have seen minuscule deployment. In this work, we design and implement a Blockchain-based system that (i) can be used to validate both of these resource types, (ii) can work passively and does not require any changes in the inter-domain routing system (BGP, RPKI), and (iii) can be combined with currently available systems for the detection and mitigation of routing attacks. We present early results and insights w.r.t. scalability.
Hang Xu, Jing Cao, Jian Zhang, Liangyi Gong · 5 authors
The following topics are dealt with: learning (artificial intelligence); data mining; social networking (online); pattern classification; text analysis; security of data; feature extraction; Internet; graph theory; computer network security.
Software Defined Networking (SDN) technology increases the evolution of Internet and network development. SDN, with its logical centralization of controllers and global network overview changes the network's characteristics, on term of flexibility, availability and programmability. However, this development increased the network communication security challenges. To enhance the SDN security, we propose the BCFR solution to avoid false flow rules injection in SDN data layer devices. In this solution, we use the blockchain technology to provide the controller authentication and the integrity of the traffic flow circulated between the controller and the other network elements. This work is implemented using OpenStack platform and Onos controller. The evaluation results show the effectiveness of our proposal.
Following the birth of cryptocurrencies back in 2008, internet investment platforms called exchanges were created to constellate these cryptocurrencies. Allowing investors to sell and buy assets equitable and agile over a single interface. Exchanges now have become popular and carry out over 99% of all daily transactions, totaling hundreds of millions of dollars. Despite that exchanges handling enormous quantities of money, the industry remains mostly unregulated.\n\nAs long as these exchanges remain unregulated, they are and will continue to be susceptible to price manipulation schemes since they are legal to perform by law. Over the years, exchanges have grown into an attractive field where scammers execute various frauds that aims to leech assets from ordinary investors. One particular scheme has risen in popularity over the years and often observed at exchanges, and that is pump-and-dump. This scheme has a history from all the way back in 1700 and is still active and troublesome for investors today.\n\nIn this thesis, we present Limelight, a system that seeks to detect pump-and-dump in real-time using deep learning. Throughout this thesis, we retrieved, prepared, labeled, and processed a dataset to train a model that identifies pump-and-dumps. With high accuracy, the model surpasses previously proposed models in the detection of pump-and-dumps.
Electronic transactions with cryptocurrency systems based on blockchain in our days have become very popular due to the good reputation of this technology. However, that good reputation cannot deny the serious anomalies and the risks that can cause these cryptocurrencies. In this work, we propose a new model for anomaly detection over bitcoin electronic transactions. We used in our proposal two machine learning algorithms, namely the One Class Support Vector Machines (OCSVM) algorithm to detect outliers and the K-Means algorithm in order to group the similar outliers with the same type of anomalies. We evaluated our work by generating detection results and we obtained high performance results on accuracy.
Unsolicited, and most likely spoofed, robot calls are not just an annoyance, but also carry a potential threat with the onset of automation, impersonation, and even voice manipulation technologies as malicious elements attempt to use deception to steal sensitive information or invoke action. Despite steps taken to protect consumers, the issue appears to be far from under control. In this paper, we propose a solution to use blockchain as a platform to share spam transactions through a peer-to-peer mechanism that will maintain a global database of reported spam transactions in order to identify and trace spam activity effectively. Storing spam transactions on a distributed ledger with consensus-based approval of transactions adds reliability to the data and can optimize the data points that will be available to spam detection algorithms in order to fight spam effectively. As this is peer to peer-based sharing, there is no need to rely on thirdparty providers for storing and sharing this data to the users. Every spam call received will be added as a detailed transaction on the blockchain to execute a smart contract that will calculate the trustworthiness of the caller. Call records are used to identify spam transactions while the blockchain ledgers store this data. We discuss the relevance and advantages of a distributed ledger to store these transactions. This paper does not aim at solving the spam problem with an optimized detection algorithm but evaluates the characteristics and performance of the blockchain as a distributed ledger and its relevance to serve as a platform for peer-to-peer spam detection mechanisms. We evaluate different blockchain metrics like transaction processing rates, gas costs and ledger sizes and discuss how they scale in order to store the spam reports data on the blockchain.
Νικόλαος Αλεξόπουλος, Emmanouil Vasilomanolakis, Stéphane Le Roux, Steven Rowe · 5 authors
Sophisticated mass attacks, especially when exploiting zero-day vulnerabilities, have the potential to cause destructive damage to organizations and critical infrastructure. To timely detect and contain such attacks, collaboration among the defenders is critical. By correlating real-time detection information (alerts) from multiple sources (collaborative intrusion detection), defenders can detect attacks and take the appropriate defensive measures in time. However, although the technical tools to facilitate collaboration exist, real-world adoption of such collaborative security mechanisms is still underwhelming. This is largely due to a lack of trust and participation incentives for companies and organizations. This paper proposes TRIDEnT, a novel collaborative platform that aims to enable and incentivize parties to exchange network alert data, thus increasing their overall detection capabilities. TRIDEnT allows parties that may be in a competitive relationship, to selectively advertise, sell and acquire security alerts in the form of (near) real-time peer-to-peer streams. To validate the basic principles behind TRIDEnT, we present an intuitive game-theoretic model of alert sharing, that is of independent interest, and show that collaboration is bound to take place infinitely often. Furthermore, to demonstrate the feasibility of our approach, we instantiate our design in a decentralized manner using Ethereum smart contracts and provide a fully functional prototype.
Gabriel Antonio F. Rebello, Gustavo F. Camilo, Leonardo G. C. Silva, Lucas C. B. Guimarães · 7 authors
Network slicing, network function virtualization (NFV), and software defined network (SDN) technologies provide agile on-demand end-to-end services. The identification of a faulty virtual function becomes mandatory because services allocate resources across a distributed and trustless environment composed by multi-tenant competing service providers. In this paper, we propose and develop a blockchain-based architecture to provide auditability to orchestration operations of network slices and to provide secure VNF configuration updates while ensuring isolation and privacy between network slices. A proof of concept prototype using the Hyperledger Fabric platform was developed in which network slice runs on an isolated channel. The results show that we can secure a network slice creation, but that the consensus and the number of transaction required by the slices are a great challenge.
Routing on the Internet is defined among autonomous systems (ASes) based on a weak trust model where it is assumed that ASes are honest. While this trust model strengthens the connectivity among ASes, it results in an attack surface which is exploited by malicious entities to hijacking routing paths. One such attack is known as the BGP prefix hijacking, in which a malicious AS broadcasts IP prefixes that belong to a target AS, thereby hijacking its traffic. In this paper, we proposeRouteChain: a blockchain-based secure BGP routing system that counters BGP hijacking and maintains a consistent view of the Internet routing paths. Towards that, we leverage provenance assurance and tamper-proof properties of blockchains to augment trust among ASes. We group ASes based on their geographical (network) proximity and construct a bihierarchical blockchain model that detects false prefixes prior to their spread over the Internet. We validate strengths of our design by simulations and show its effectiveness by drawing a case study with the Youtube hijacking of 2008. Our proposed scheme is a standalone service that can be incrementally deployed without the need of a central authority.
Christian Killer, Bruno Rodrigues, Burkhard Stiller
A cooperative network defense is one approach to fend off large-scale Distributed Denial-of-Service (DDoS) attacks. In this regard, the Blockchain Signaling System (BloSS) is a multi-domain, blockchain-based, cooperative DDoS defense system, where each Autonomous System (AS) is taking part in the defense alliance. Each AS can exchange attack information about ongoing attacks via the Ethereum blockchain. However, the currently operational implementation of BloSS is not interactive or visualized, but the DDoS mitigation is automated. In realworld defense systems, a human cybersecurity analyst decides whether a DDoS threat should be mitigated or not. Thus, this work presents the design of a security management dashboard for BloSS, designed for interactive use by cyber security analysts.
Gabriel Antonio F. Rebello, Igor D. Alvarenga, Igor Jochem Sanz, Otto Carlos M. B. Duarte
Network Function Virtualization (NFV) and Service Function Chaining (SFC) offer flexible end-to-end services that deploy virtual network functions in clouds of competing providers. Orchestration of virtual network functions occurs in a distributed and trustless environment that must tolerate byzantine failures and collusion attacks. This paper proposes BSec-NFVO, a blockchain-based system that secures orchestration operations in virtualized networks, ensuring auditability, non-repudiation and integrity. We propose an NFV-tailored blockchain and a transaction model. BSec-NFVO provides a modular architecture to secure orchestration in a simple and agile way. We develop a prototype of BSec-NFVO for the Open Platform for Network Function Virtualization (OPNFV) with an adaptation of the normal-case of a collusion-resistant consensus protocol. The results show BSec-NFVO incurs low overhead to the cloud orchestrator and presents stable performance as the number of consensus participants increases.
Multimicrogrid (MMG) systems have the potential to play an increasingly important role in the transformation of existing power grid to smart grid. However, the open and distributed connectivity of MMGs exposes the systems into various cyber-attacks, which may cause serious failures or physical damages, such as power supply interruption and human casualties. Therefore, ensuring the security of MMGs is of paramount importance. To address this issue, a new collaborative intrusion detection (CID) approach using blockchain is proposed in this paper for MMG systems in smart grid. Due to the consensus mechanism of blockchain, the approach is designed without the need of a trusted authority or central server while improving the accuracy of intrusion detection in a collaborative way. It is equipped with a proposal generation method that combines periodic and trigger patterns to generate the detection target of CID, i.e., a proposal. From the generated proposals together with the correlation model of MMGs, a CID is achieved by using the consensus mechanism. The final detection results of CID are stored on blockchain in sequence. The use of an incentive mechanism motivates a single microgrid to participate in consensus. The effectiveness of the presented approach is demonstrated through a case study on an MMG system.
Bruno Rodrigues, Lukas Eisenring, Eder J. Scheid, Thomas Bocek · 5 authors
The volume of traffic generated by modern Distributed Denial-of-Service (DDoS) attacks suggests that centralized defenses are not the most effective approach to counter these attacks. An alternative to reduce the burden of detection and mitigation is to combine centralized defense systems, creating a global and cooperative protection system. However, existing approaches suffer from the complexity of deployment and operation across different systems. Blockchains appear in this scenario as an alternative to simplify the exchange of information in a cooperative defense. This work evaluates in both local and global experimentations the performance of the blockchain system proposed in [8] concerning the latency to perform the signaling of blacklisted addresses.
We performed the first systematic study of a new attack on Ethereum that steals cryptocurrencies. The attack is due to the unprotected JSON-RPC endpoints existed in Ethereum nodes that could be exploited by attackers to transfer the Ether and ERC20 tokens to attackers-controlled accounts. This study aims to shed light on the attack, including malicious behaviors and profits of attackers. Specifically, we first designed and implemented a honeypot that could capture real attacks in the wild. We then deployed the honeypot and reported results of the collected data in a period of six months. In total, our system captured more than 308 million requests from 1,072 distinct IP addresses. We further grouped attackers into 36 groups with 59 distinct Ethereum accounts. Among them, attackers of 34 groups were stealing the Ether, while other 2 groups were targeting ERC20 tokens. The further behavior analysis showed that attackers were following a three-steps pattern to steal the Ether. Moreover, we observed an interesting type of transaction called zero gas transaction, which has been leveraged by attackers to steal ERC20 tokens. At last, we estimated the overall profits of attackers. To engage the whole community, the dataset of captured attacks is released on https://github.com/zjuicsr/eth-honey.
This work proposes an innovative approach, named CapJack, to detect in-browser malicious cryptocurrency mining activities by using the latest CapsNet technology. To the best of our knowledge, this is the first work to introduce CapsNet to the field of malware detection through system behavioral analysis. It is particularly effective to detect malicious miners under multitasking environments where multiple applications run simultaneously. Experimental data show appealing performance of CapJack, with a detection rate of as high as 87% instantly and 99% within a window of 11 seconds.
The Internet of Things (IoT) carries a big promise, to improve our lives through numerous connected devices that interact with one another. Unfortunately, some of these devices are of questionable security, becoming targets of choice for numerous exploits. This can result in compromising the home network, as well as large scale attacks such as the recent Mirai network of botnets that was used in a DDoS attack. The problem is that end users have a hard time assessing the risks induced by connected devices, and often lack the skills and time to administrate their home network. We answer the above challenge by proposing STewARD, a solution that allows users to easily request from their intelligent home network controller the creation of isolated software-defined network slices, to which they assign a required trust level using very simple risk assessment. We build a global trust assessment framework that computes a trust score for each class of devices, based on reported history stored in a blockchain. Network controllers can then leverage this information to connect to slices only those devices that meet the expected trust levels, and can contribute to the crowd-sourced reporting by monitoring the devices' behaviors compared to an expected baseline.
Blockchain technology is considered to be one of the most thriving future Internet technologies with the potential to have a great impact not only on the technical aspects of our lives but also on the social, economic, juristic, security and on many more aspects. Since the appearance of a Bitcoin as the most popular Blockchain based currency a decade ago, the possibilities and strengths of the Blockchain technology have been investigated a lot. The Blockchain technology has a dozen of use cases in different areas of life, whereby one of the most important is Internet of Things and Internet of Everything. This paper concentrates on the vulnerabilities of Blockchain technology, especially on the problem of Byzantine Fault Tolerance. It is one of the crucial problems of Distributed Ledger Technologies in general. Other vulnerabilities of the Blockchain technology analyzed in this paper include the partition and delay attacks.
Bitcoin is a decentralized digital currency introduced in 2008 and launched in 2009. Bitcoin provides a way to transact without any trusted intermediary, but its privacy guarantees are questionable, and multiple deanonymization attacks have been proposed. Cryptocurrency privacy research has been mostly focused on blockchain analysis, i.e., extracting information from the transaction graph. We focus on another vector for privacy attacks: network analysis. We describe the message propagation mechanics in Bitcoin and propose a novel technique for transaction clustering based on network traffic analysis. We show that timings of transaction messages leak information about their origin, which can be exploited by a well connected adversarial node. We implement and evaluate our method in the Bitcoin testnet with a high level of accuracy, deanonymizing our own transactions issued from a desktop wallet (Bitcoin Core) and from a mobile (Mycelium) wallet. Compared to existing approaches, we leverage the propagation information from multiple peers, which allows us to overcome an anti-deanonymization technique (“diffusion”) used in Bitcoin.
Software Defined Networking (SDN) is being extensively adopted by researchers and enterprise networks due to its feature of decoupling data and control planes from network device which enables them to implement new networking ideas. Communication between data and control planes faces various security issues where many users in data plane approach controller device in control plane to gain networking policies. In this paper, we proposed an efficient Zero-knowledge proof based identification scheme for securing SDN controller during data and control plane communication. This scheme ensures that only users who prove their knowledge about secrecy without revealing actual secret or any other information about it can communicate with controller. The computation cost was calculated to validate efficiency of the proposed work and compared with scheme that works in the basis of Kerberos authentication protocol.
Subsequent to the introduction of Bitcoin, the field of cryptocurrency has seen unprecedented growth. Mobile applications known as wallets often facilitate user interaction to these cryptocurrencies. With a perceived real world value these wallets are a target for attackers. Unlike mainstream financial services applications, cryptocurrency wallets are not subject to the same stringent security requirements of their regulated counterparts. In this paper, we examine the security profiles of commonly used Android cryptocurrency applications. We examine these applications for common vulnerabilities outlined by OWASP mobile top 10. We establish a baseline for our tests by evaluating commonly used banking and trading applications. We compare the results from our baseline test and establish the state of security provided by cryptocurrency wallet applications. The paper also examines the possible privacy implications of mobile applications. We report that the conventional financial services applications are only marginally better than cryptocurrency application in security provisions but they provide greater privacy.