Radhesh Krishnan Konoth, Rolf van Wegberg, Veelasha Moonsamy, Herbert Bos
In this study, we examine the behavior and profitability of modern malware that mines cryptocurrency. Unlike previous studies, we look at the cryptocurrency market as a whole, rather than just Bitcoin. We not only consider PCs, but also mobile phones, and IoT devices. In the past few years, criminals have attacked all these platforms for the purpose of cryptocurrency mining. The question is: how much money do they make? It is common knowledge that mining Bitcoin is now very difficult, so why do the criminals even target low-end devices for mining purposes? By analyzing the most important families of malicious cryptocurrency miners that were active between 2014 and 2017, we are able to report how they work, which currency they mine, and how profitable it is to do so. We will see that the evolution of the cryptocurrency market with many new cryptocurrencies that are still CPU minable and offer better privacy to criminals and have contributed to making mining malware attractive again -- with attackers generating a continuous stream of profit that in some cases may reach in the millions.
Hany F. Atlam, Robert John Walters, Gary Wills, Joshua Daniel
Abstract The Internet of Things (IoT) is becoming the future of the Internet with a large number of connected devices that are predicted to reach about 50 billion by 2020. With proliferation of IoT devices and need to increase information sharing in IoT applications, risk-based access control model has become the best candidate for both academic and commercial organizations to address access control issues. This model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. This model solves challenges related to flexibility and scalability of the IoT system. Therefore, we propose an adaptive risk-based access control model for the IoT. This model uses real-time contextual information associated with the requesting user to calculate the security risk regarding each access request. It uses user attributes while making the access request, action severity, resource sensitivity and user risk history as inputs to analyze and calculate the risk value to determine the access decision. To detect abnormal and malicious actions, smart contracts are used to track and monitor user activities during the access session to detect and prevent potential security violations. In addition, as the risk estimation process is the essential stage to build a risk-based model, this paper provides a discussion of common risk estimation methods and then proposes the fuzzy inference system with expert judgment as to be the optimal approach to handle risk estimation process of the proposed risk-based model in the IoT system.
Crypto-mining attacks have emerged as a new generation of web-based attacks which have seen cybercriminals eschew the infamous crypto ransomware. The watering hole attack vector has by far been the most widely employed attack methodology but it faces the task of luring the victim to the infected web resources. However, cryptojacking injection presents a paradigm shift to web-based crypto-mining attacks in that it eliminates the need for a pivotal third-party such as the exploitable web server. Thus, instead of attacking credit card and other private information of e-commerce users, attackers seek to maliciously abuse a victim’s CPU to generate cryptocurrency. In this paper, we investigate and evaluate cryptojacking injection – a state-of-the-art web-centric attack vector in the crypto-mining attacks landscape. We formulate an attack model based on finite state machines which depicts the various breaches of confidentiality, integrity and availability in the web system as the attack progresses. We show how this new attack vector attacks some of the core components of e-commerce (URL, HTTP and HTML) to generate Monero crypto currency from benign web users. We evaluate our modeling approach with a series of experiments with two attack scenarios using different operating systems. Results show that the attack is indeed cross-platform and feasible on any operating system of a browser-capable device. We analyze the generated network traffic during the attack and draw features such as URLs and the parsed files, the associated cryptographic hashes, and the IP addresses of the crypto-mining domains. These, together with host-based features such as exhaustive CPU usage can be used as indicators of compromise and subsequently act as feed into intrusion detection systems.
Elie Kfoury, Jose Gomez, Jorge Crichigno, Elias Bou‐Harb · 5 authors
Network Address Translation (NAT) is a method that enables devices with private IP addresses to connect to the Internet by sharing a public IP address. Traversing the NAT device remains a challenge for a wide range of applications such as Voice over IP (VoIP) and Internet of Things (IoT). The Port Control Protocol (PCP) is a relatively new protocol standardized by the Internet Engineering Task Force (IETF) to solve the NAT traversal issues. It allows a NATed device to request and manage a mapping between its private IP address and transport-layer port to a public IP address and port. As PCP requires an application-dependent method for distributing the mappings to remote hosts, several attacks can target the distributing server and render the communication channel vulnerable. In this paper, we propose and implement a decentralized Blockchain-based approach for distributing PCP-mappings, enabling secure end-to-end (e2e) direct communications without any trusted third party server. NATed devices register their PCP mappings and public keys into the Blockchain, and other peers can then learn about these mappings to establish end-to-end secure direct communications. The implementation verifies that the system is feasible in terms of transactions fees, can simplify and secure end-to-end direct communications, and can interwork with conventional security methods.
The paper presents a BlockChain based distributed framework to manage Antimalware database efficiently. With increased efficiency in computation and network connectivity, systems are delivering better performances day by day. However, the opportunities of initiating malicious activities through malwares are being increased as well. In this work, we propose a distributed framework of Antimalware database management using customized BlockChain that enhances system security by initiating distributed malware prevention program. Due to distributed in nature, BlockChain can ensure better data management without involving any third party.
Distributed Denial of Service (DDoS) attacks have two defense perspectives firstly, to defend your network, resources and other information assets from this disastrous attack. Secondly, to prevent your network to be the part of botnet (botforce) bondage to launch attacks on other networks and resources mainly be controlled from a control center. This work focuses on the development of a botnet prevention system for Internet of Things (IoT) that uses the benefits of both Software Defined Networking (SDN) and Distributed Blockchain (DBC). We simulate and analyze that using blockchain and SDN, how can detect and mitigate botnets and prevent our devices to play into the hands of attackers.
Leyi Shi, Yang Li, Tianxu Liu, Jia Liu · 6 authors
Honeypot technology can be applied to efficiently attract attackers and exhaust their resources. However, the traditional static honeypot is easy to be recognized by anti-honeypot technology. By contrast, most of the dynamic honeypots can simulate the real system in time, thus interacting with an intruder in disguise. In this paper, we employ the dynamic property of honeypot in four kinds of services of our system. However, this dynamic property shows up in a location and identification, indicating that genuine or fake services (honeypots) are changeable in different hosts. Thus, the dynamic property of our system differs from the dynamic honeypot aforementioned. Besides, we adopt the blockchain platform (Ethereum) to decentralize our system and store the port access data by delivering a private chain. To illustrate the effectiveness of our scheme in theory and practice, security analysis, eavesdropping attack, scanning attack, and DoS attack experiments are conducted. The results show that our scheme is valid in safeguarding against network attack.
Johannes Beck, Roberta Huang, David Lindner, Tian Guo · 7 authors
The ability to track and monitor relevant and important news in real-time is of crucial interest in multiple industrial sectors. In this work, we focus on the set of cryptocurrency news, which recently became of emerging interest to the general and financial audience. In order to track relevant news in real-time, we (i) match news from the web with tweets from social media, (ii) track their intraday tweet activity and (iii) explore different machine learning models for predicting the number of the article mentions on Twitter within the first 24 hours after its publication. We compare several machine learning models, such as linear extrapolation, linear and random forest autoregressive models, and a sequence-to-sequence neural network. We find that the random forest autoregressive model behaves comparably to more complex models in the majority of tasks.
Rewriting-history attacks can erase all valid records of blockchain-based systems, which is extremely devastating. To deter such attacks, we design a new smart contract-based secure model to make such attacks ineffective. Each node who creates a new block is required to register with the smart contract to get a voucher required for the subsequent block validation. We introduce the design idea and the structure of the proposed model in detail. We also present the algorithms of the smart contract and analyze the security performance of the proposed model in different cases. To prove the feasibility of the proposed model, we use the Solidity language to implement the smart contract in this model and simulate it on the Ethereum test network. We also show simulation results in terms of runtime and resource consumption.
Block-chain world is very dynamic and there is need for strong governance and underlying technology architecture to be robust to face challenges. This paper considers Ethereum, a leading block chain. We deep dive into the nature of this block chain, wherein for software upgrades forks are performed. They types of forks and impact is discussed. A specific Ethereum hack led to a hard fork and focus is provided on understanding the hack and overcoming it from a novel approach. The current model has been unable to handle multiple Ethereum attacks. Thus the current approach is compared against a novel approach providing a security and scaling solution. Here the architecture draws upon combining block-chain layers into operating system level. The approach can have tremendous benefits to block chain world and improve the way decentralized application teams perform. The benefits of the novel architecture is discussed. The approach helps safe guard block chain projects, making them safer and chain agnostic.
Data is the input for various artificial intelligence (AI) algorithms to mine valuable features, yet data in Internet is scattered everywhere and controlled by different stakeholders who cannot believe in each other, and usage of the data in complex cyberspace is difficult to authorize or to validate. As a result, it is very difficult to enable data sharing in cyberspace for the real big data, as well as a real powerful AI. In this paper, we propose theSecNet, an architecture that can enable secure data storing, computing, and sharing in the large-scale Internet environment, aiming at a more secure cyberspace with real big data and thus enhanced AI with plenty of data source, by integrating three key components: 1) blockchain-based data sharing with ownership guarantee, which enables trusted data sharing in the large-scale environment to form real big data; 2) AI-based secure computing platform to produce more intelligent security rules, which helps to construct a more trusted cyberspace; 3) trusted value-exchange mechanism for purchasing security service, providing a way for participants to gain economic rewards when giving out their data or service, which promotes the data sharing and thus achieves better performance of AI. Moreover, we discuss the typical use scenario of SecNet as well as its potentially alternative way to deploy, as well as analyze its effectiveness from the aspect of network security and economic revenue.
This study attempts to create a cryptocurrency classification metod and tool for reliability assessment from the point of view of investors and traders. The definition of the reliability of cryptocurrency and classification criteria is formulated. The following emphasizes how, using the support vector method, based on the available open data, it is possible to determine the reliability of Ethereum-based cryptocurrencies. As a result of testing, 15 reliable cryptocurrencies were identified and software was developed that allows you to collect and classify cryptocurrencies.
The Internet of Things (IoT) has been widely used because of its high efficiency and real-time collaboration. A wireless sensor network is the core technology to support the operation of the IoT, and the security problem is becoming more and more serious. Aiming at the problem that the existing malicious node detection methods in wireless sensor networks cannot be guaranteed by fairness and traceability of detection process, we present a blockchain trust model (BTM) for malicious node detection in wireless sensor networks. First, it gives the whole framework of the trust model. Then, it constructs the blockchain data structure which is used to detect malicious nodes. Finally, it realizes the detection of malicious nodes in 3D space by using the blockchain smart contract and the WSNs' quadrilateral measurement localization method, and the voting consensus results are recorded in the blockchain distributed. The simulation results show that the model can effectively detect malicious nodes in WSNs, and it can also ensure the traceability of the detection process.
Jan 1, 2019·Proceedings of the VIth International Workshop 'Critical Infrastructures: Contingency Management, Intelligent, Agent-Based, Cloud Computing and Cyber Security' (IWCI 2019)
Konstantin Mironov, Sergey Trishin, Amir Makhmutov, Vadim Kartak · 5 authors
In this article we consider tasks related to ensuring the integrity and availability of information in the Internet of Things (IoT) sphere. Such systems include sensors and similar devices, which are the sources of data, access points, which transmit data from sensors to the Internet and servers, which store received data and grant access to users. When storing data on a server and providing access to it, it is necessary to ensure its integrity and availability to users. To this end, it is proposed to apply a distributed ledger technology (DLT). One of the applications of DLT for data protection is energetics. Here we consider a system for processing and storing data on the production and consumption of electricity in a decentralized power grid. A review of currently existing projects related to the use of distributed ledger technologies in the energy sector is carried out. An important obstacle to the use of DLT in the IoT is the contradiction between, on the one hand, high memory computational requirements of the DLT, and, on the other hand, limited resources of IoT nodes. Further research directions are proposed that are associated with overcoming this obstacle in applying distributed ledger technologies in the energetics.