Zakaria Abou El Houda, Abdelhakim Hafid, Lyes Khoukhi
With the exponential growth in the number of insecure devices, the impact of Distributed Denial-of-Service (DDoS) attacks is growing rapidly. Existing DDoS mitigation schemes are facing obstacles due to low flexibility, lack of resources, and high cost. The new emerging technologies, such as blockchain, introduce new opportunities for low-cost, efficient and flexible DDoS attacks mitigation across multiple domains. In this paper, we propose a blockchain-based approach, called Cochain-SC, which combines two levels of mitigation, intra-domain and inter-domain DDoS mitigation. For intra-domain, we propose an effective DDoS mitigation method in the context of software defined networks (SDN); it consists of three schemes: (1) Intra Entropy-based scheme (I-ES) to measure, using sFlow, the randomness of data inside the domain; (2) Intra Bayes-based scheme (I-BS) to classify, based on entropy values, illegitimate flows; and (3) Intra-domain Mitigation (I-DM) scheme to effectively mitigate illegitimate flows inside the domain. For inter-domain, we propose a collaborative DDoS mitigation scheme based on blockchain; it uses the concept of smart contracts (i.e., Ethereum's smart contracts) to facilitate the collaboration among SDN-based domains (i.e., Autonomous System: AS) to mitigate DDoS attacks. For this aim, we design a novel and secure scheme that allows multiple SDN-based domains to securely collaborate and transfer attack information in a decentralized manner. Combining intra- and inter-domain DDoS mitigation, Cochain-SC allows an efficient mitigation along the path of an ongoing attack and an effective mitigation near the origin of the attack. This allows reducing the enormous cost of forwarding packets, across multiple domains, which consist mostly of useless amplified attack traffic. To the best of our knowledge, Cochain-SC is the first scheme that proposes to deal with both intra-domain and inter-domain DDoS attacks mitigation combining SDN, blockchain and smart contract. The implementation of Cochain-SC is deployed on Ethereum official test network Ropsten. Moreover, we conducted extensive experiments to evaluate our proposed approach; the experimental results show that Cochain-SC achieves flexibility, efficiency, security, cost effectiveness, and high accuracy in detecting illegitimate flows, making it a promising approach to mitigate DDoS attacks.
Davy Preuveneers, Vera Rimmer, Ilias Tsingenopoulos, Jan Spooren · 6 authors
The adoption of machine learning and deep learning is on the rise in the cybersecurity domain where these AI methods help strengthen traditional system monitoring and threat detection solutions. However, adversaries too are becoming more effective in concealing malicious behavior amongst large amounts of benign behavior data. To address the increasing time-to-detection of these stealthy attacks, interconnected and federated learning systems can improve the detection of malicious behavior by joining forces and pooling together monitoring data. The major challenge that we address in this work is that in a federated learning setup, an adversary has many more opportunities to poison one of the local machine learning models with malicious training samples, thereby influencing the outcome of the federated learning and evading detection. We present a solution where contributing parties in federated learning can be held accountable and have their model updates audited. We describe a permissioned blockchain-based federated learning method where incremental updates to an anomaly detection machine learning model are chained together on the distributed ledger. By integrating federated learning with blockchain technology, our solution supports the auditing of machine learning models without the necessity to centralize the training data. Experiments with a realistic intrusion detection use case and an autoencoder for anomaly detection illustrate that the increased complexity caused by blockchain technology has a limited performance impact on the federated learning, varying between 5 and 15%, while providing full transparency over the distributed training process of the neural network. Furthermore, our blockchain-based federated learning solution can be generalized and applied to more sophisticated neural network architectures and other use cases.
Internet of Things (IoT) is a fast growing technology in the digitalised world where each device in the network interconnect and interact with other device to collect the information and automate tasks.A lot of vulnerabilities are exposed in IoT devices, which can be exploited to compromise the devices and an infected device can disrupt all other nodes in the network. The severeness of the vulnerabilities can vary from launching a Distributed Denial of Service (DDOS) attack to entirely draining the batteries of a heart pacemaker. Although IoT providers constantly working on reducing the vulnerabilities, an Intrusion Detection (ID) system can be built to find, whether the nodes are behaving abnormally or not. ID system can be built with a centralized architecture, but compromising the centralized entity can result in compromising the entire network. For storing data and running ID system in a decentralized manner, blockchain technology is executed to increase trust between the peers. With this decentralized blockchain architecture each node will be able to find out whether the peers in the group are malicious or not. So, we propose a architecture, IDBIoT (Intrusion Detector for Blockchain based IoT networks) for Intrusion detection in an IoT environment, that mainly focuses on the securing the network by detecting intruders, using statistical significance while preventing Goldfinger attack.
Zakaria Abou El Houda, Lyes Khoukhi, Abdelhakim Hafid
Nowadays, blockchain is seen as one of the main technological innovations. Many applications can rely on the blockchain to secure their exchanges. However, applications with private interest cannot rely on public blockchains. First, in a public blockchain, anyone can read the whole data of the blockchain. Second, anyone can participate to the "consensus process"; the process for determining the validity of each transaction. Consortium and fully private blockchains aim to combine forcefulness of blockchains with controlled consensus process and stricter permissions for deploying a node and joining the blockchain network. In both consortium and fully private blockchains, the number of peers on the blockchain network is very small in comparison with public blockchain. Nonetheless, by targeting the nodes of blockchains, an attacker can easily manage the whole blockchain and takes control of the consensus process to validate his illegitimate transactions. In this paper, to defend blockchain nodes from DNS amplification attacks, we propose a scalable and proactive solution in the context of software defined networks (SDN), named ChainSecure. ChainSecure consists of 3 schemes: (1) StateMap, a novel stateful mapping scheme (SMS) to perform a mapping one-to-one between DNS request and response; (2) Entropy calculation scheme (ECS) to measure the disorder / randomness of data using sFlow in order to detect illegitimate flows; (3) DNS DDoS Mitigation (DDM) module to effectively mitigate illegitimate DNS requests. The experimental results show that ChainSecure protects blockchain nodes and can detect/mitigate the attack quickly to achieve high accuracy in detecting illegitimate DNS traffic making it a promising solution to protect blockchain nodes from DNS amplification attacks.
Wesley Joon-Wie Tann, Xing Han, Sourav Sen Gupta, Yew-Soon Ong
Symbolic analysis of security exploits in smart contracts has demonstrated to be valuable for analyzing predefined vulnerability properties. While some symbolic tools perform complex analysis steps, they require a predetermined invocation depth to search vulnerable execution paths, and the search time increases with depth. The number of contracts on blockchains like Ethereum has increased 176 fold since December 2015. If these symbolic tools fail to analyze the increasingly large number of contracts in time, entire classes of exploits could cause irrevocable damage. In this paper, we aim to have safer smart contracts against emerging threats. We propose the approach of sequential learning of smart contract weaknesses using machine learning---long-short term memory (LSTM)---that allows us to be able to detect new attack trends relatively quickly, leading to safer smart contracts. Our experimental studies on 620,000 smart contracts prove that our model can easily scale to analyze a massive amount of contracts; that is, the LSTM maintains near constant analysis time as contracts increase in complexity. In addition, our approach achieves $99\%$ test accuracy and correctly analyzes contracts that were false positive (FP) errors made by a symbolic tool.
A blockchain provides a securedparadigm to achieve consensus using a distributed and peer-to-peer network in which no trusted central party is required. As a result, it has the potential to resolve many challenges that are faced with current centralized controllers in globally distributed applications. To date, the blockchain technology has been used for recording transactions and tracking objects in which multiple participants reach a consensus on whether a transaction is valid or not. This paper introduces the novel paradigm of probabilistic blockchains, an extension of the current blockchains that allows building efficient and distributed risk assessment and decision-making applications in which multiple untrusting parties collaborate but may not completely agree on the outcome. The paradigm is particularly useful for risk assessment, where a group of decision-makersneeds to decide or analyze an event based on imperfect information. The proposed approach can be used in applications like intrusion detections, stock market predictions, insurance, and recommendation systems. The paper presents and analyzes the application of probabilistic blockchains for intrusion detection systems for computer networks. The results show the feasibility and efficiency of the proposed paradigm in making such decisions.
We showcase a graph mining tool, BiVA, for visualization and analysis of the Bitcoin network. It enables data exploration, visualization of subgraphs around nodes of interest, and integrates both standard and new algorithms, including a general algorithm for flow based clustering for directed graphs, and other Bitcoin network specific wallet address aggregation mechanisms. The BiVA user interface makes it easy to get started with a basic visualization that gives insights into nodes of interests, and the tool is modular, allowing easy integration of new algorithms. Its functionalities are demonstrated with a case study of extortion of Ashley Madison data breach victims.
Bitcoin exchanges rely heavily on traditional intrusion detection system to secure their system. However, this reliance has proven to be high risk, since Bitcoin and other blockchain-based transactions are not easily reversible. Many of the attacks have shown that the traditional intrusion detection system is not enough to safeguard against all possible attacks, and most importantly, in some cases, it takes a long time to assess the damage. In this paper, we first describe three types of intrusion models in Bitcoin exchanges and propose a detection and mitigation system using blockchain analysis for each. The proposed detection and mitigation system exploit the decentralized and public nature of Bitcoin blockchain to complement the existing traditional intrusion detection system as a fail-safe. The proposed method provides real-time intrusion detection capability that the existing work cannot provide. Although the proposed method is specifically for Bitcoin blockchain, similar ideas can be extended to other proof-of-work based blockchain cryptocurrencies.
Morit Zwang, Shahar Somin, Alex Pentland, Yaniv Altshuler
The Ethereum blockchain network is a decentralized platform enabling smart contract execution and transactions of Ether (ETH) [1], its designated cryptocurrency. Ethereum is the second most popular cryptocurrency with a market cap of more than 100 billion USD, with hundreds of thousands of transactions executed daily by hundreds of thousands of unique wallets. Tens of thousands of those wallets are newly generated each day. The Ethereum platform enables anyone to freely open multiple new wallets [2] free of charge (resulting in a large number of wallets that are controlled by the same entities). This attribute makes the Ethereum network a breeding space for activity by software robots (bots). The existence of bots is widespread in different digital technologies and there are various approaches to detect their activity such as rule-base, clustering, machine learning and more [3,4]. In this work we demonstrate how bot detection can be implemented using a network theory approach.
Internet of Things (IoT) has already been in the period of rapid development and widespread deployment, while it is still vulnerable to various malicious attacks. Security detection before system installation is not enough to ensure that IoT devices are always secure, because newly emerging vulnerabilities can still be exploited to launch attacks. To address this issue, retrospective detection is often required to trace the security status of IoT systems. Unfortunately, existing centralized detection mechanisms cannot easily provide a comprehensive security analysis. In particular, consumers cannot automatically receive security notification whenever a new vulnerability is uncovered. In this paper, we propose a novel blockchain-powered incentive platform, called SmartRetro, that can incentivize and attract more distributed detectors to participate in retrospective vulnerability detection and contribute their detection results. Leveraging smart contracts, consumers in SmartRetro receive automatic security feedback about their installed IoT systems. We perform the security and theoretical analysis to demonstrate that SmartRetro achieves our desirable security goals.We further implement SmartRetro prototype on Ethereum to evaluate its performance. Our experimental results show SmartRetro is technically feasible and economically beneficial.
Jonathan Oakley, Carl Worley, Lu Yu, Richard R. Brooks · 5 authors
With the rise of cryptographic ransomware, Bitcoin has found a niche as the standard currency for ransoms. While Bitcoin is pseudonymous, it provides no guarantee of untraceability. As a result, another niche has arisen-Bitcoin money laundering. Hidden Markov Models (HMMs) have previously been used in a number of applications where traditional pattern recognition falls short. In this paper, HMMs are inferred from transactions in the public blockchain in an attempt to link users, events, and enterprises. We introduce a proof-of-concept algorithm to infer HMMs from the Bitcoin blockchain.
Adja Elloh Yves-Christian, Badis Hammi, Ahmed Serhrouchni, Houda Labiod
In the cryptocurrency world, Bitcoin holds the first place in terms of market cap and currency price, which makes it the first target and victim of attack attempts. Indeed, there are various attacks against cryptocurrencies in general and Bitcoin in particular, e.g., block withholding, transaction malleability and the Eclipse attack. The latter, allows an attacker to completely isolate a peer and to monopolize all permanent connections from/to the victim. However, in this attack, the non permanent connections, remains non monopolized by the attacker, which can disturb the attack success. In this paper, we propose (1) a characterization of the misbehavior mechanism applied by Bitcoin and its weaknesses; and (2) a new method to realize the Eclipse attack which monopolizes all the peer's connections, even the non permanent ones, with a minimal number of IP addresses. Our characterization and attack realization, were performed on the main Bitcoin network and on a real client.
Asraful Alam, Sara Mahmoudi Rashid, Md. Abdus Salam, Ariful Islam
This paper proposed an Electric voting (E-voting) model that ensures security, privacy and transparency. Our approach uses blockchain method, a distributed ledger technology where data are shared and distributed into a network. Blockchain system offers transparency, decentralization, irreversibility and reduces the involvement of intermediaries which is crucial for an election process. An optimized algorithm is proposed for blockchain based e-voting system. An internet of things (IOT) based system is designed to exchange data from e-voting devices to the nodes. Moreover, we proposed several possible techniques and improvements for voting scenarios.
Dharmendra Kumar, D. V. Chandini, B. Dinesh Reddy, Debnath Bhattacharyya · 5 authors
The Secure Electronic Voting System using Blockchain Technology is ensured to make the current voting process to take place in an honest, accurate and highly secure way. This system stores the details of the voters and votes in two separate blockchains, which provides transparency into election results by allowing voters to independently audit the ballot box while protecting each voter's right to privacy. All the details of the voters get stored into one Blockchain, and this guarantees greater security by providing a PIN confirmed before the vote is taken into consideration. By casting votes as transactions, we can create another blockchain which keeps track of the tallies of the votes. This way, everyone can count the votes themselves, they can verify that no votes were changed or removed, and no illegitimate votes were added and as a result, is made public everyone can agree upon the final count. This system is only taking the current process of voting in an election and bringing that process entirely online, in an attempt to make it highly secure and also more accessible by allowing the voter to vote at his/her location and also reducing the effort put by staff members.
Open access
2 source records
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
In general, a botnet is a collection of compromised internet computers, controlled by attackers for malicious purposes. To increase attacks' success chance and resilience against defence mechanisms, modern botnets have often a decentralized P2P structure. Here, IoT devices are playing a critical role, becoming one of the major tools for malicious parties to perform attacks. Notable examples are DDoS attacks on Krebs on Security and DYN, which have been performed by IoT devices part of botnets. We take a first step towards detecting P2P botnets in IoT, by proposing AutoBotCatcher, whose design is driven by the consideration that bots of the same botnet frequently communicate with each other and form communities. As such, the purpose of AutoBotCatcher is to dynamically analyze communities of IoT devices, formed according to their network traffic flows, to detect botnets. AutoBotCatcher exploits a permissioned Byzantine Fault Tolerant (BFT) blockchain, as a state transition machine that allows collaboration of a set of pre-identified parties without trust, in order to perform collaborative and dynamic botnet detection by collecting and auditing IoT devices' network traffic flows as blockchain transactions. In this paper, we focus on the design of the AutoBotCatcher by first defining the blockchain structure underlying AutoBotCatcher, then discussing its components.
Purpose Nowadays, to operate securely and legally and to achieve business objectives, secure valuable assets and support uninterrupted business processes, all organizations need to match a lot of internal and external compliance regulations such as laws, standards, guidelines, policies, specifications and procedures. An integrated system able to manage information security (IS) for their intranets in the new cyberspace while processing tremendous amounts of IS-related data coming in various formats is required as never before. These data, after being collected and analyzed, should be evaluated in real-time from an IS incident viewpoint, to identify an incident’s source, consider its type, weigh its consequences, visualize its vector, associate all target systems, prioritize countermeasures and offer mitigation solutions with weighted impact relevance. Different security information and event management (SIEM) systems cope with this routine and usually complicated work by rapid detection of IS incidents and further appropriate response. Modern challenges dictate the need to build these systems using advanced technologies such as the blockchain (BC) technologies (BCTs). The purpose of this study is to design a new BC-based SIEM 3.0 system and propose a methodology for its evaluation. Design/methodology/approach Modern challenges dictate the need to build these systems using advanced technologies such as the BC technologies. Many internet resources argue that the BCT suits the intrusion detection objectives very well, but they do not mention how to implement it. Findings After a brief analysis of the BC concept and the evolution of SIEM systems, this paper presents the main ideas on designing the next-generation BC-based SIEM 3.0 systems, for the first time in open access publications, including a convolution method for solving the scalability issue for ever-growing BC size. This new approach makes it possible not to simply modify SIEM systems in an evolutionary manner, but to bring their next generation to a qualitatively new and higher level of IS event management in the future. Research limitations/implications The most important area of the future work is to bring this proposed system to life. The implementation, deployment and testing onto a real-world network would also allow people to see its viability or show that a more sophisticated model should be worked out. After developing the design basics, we are ready to determine the directions of the most promising studies. What are the main criteria and principles, according to which the organization will select events from PEL for creating one BC block? What is the optimal number of nodes in the organization’s BC, depending on its network assets, services provided and the number of events that occur in its network? How to build and host the SIEM 3.0 BC infrastructure? How to arrange streaming analytics of block’s content containing events taking place in the network? How to design the BC middleware as software that enables staff to interact with BC blocks to provide services like IS events correlation? How to visualize the results obtained to find insights and patterns in historical BC data for better IS management? How to predict the emergence of IS events in the future? This list of questions can be continued indefinitely for a full-fledged design of SIEM 3.0. Practical implications This paper shows the full applicability of the BC concept to the creation of the next-generation SIEM 3.0 systems that are designed to detect IS incidents in a modern, fully interconnected organization’s network environment. The authors’ attempt to begin with a detailed description of the basics for a BC-based SIEM 3.0 system design is presented, as well as the evaluation methodology for the resulting product. Originality/value The authors believe that their new revolutionary approach makes it possible not to simply modify SIEM systems in an evolutionary manner, but to bring their next generation to a qualitatively new and higher level of IS event management in the future. They hope that this paper will evoke a lively response in this segment of the security controls market from both theorists and direct developers of living systems that will implement the above approach.
Without the design for inherent security, the Border Gateway Protocol (BGP) is vulnerable to prefix/subprefix hijacks and other attacks. Though many BGP security approaches have been proposed to prevent or detect such attacks, the unsatisfactory cost-effectiveness frustrates their deployment. In fact, the currently deployed BGP security infrastructure leaves the chance for potential centralized authority misconfiguration and abuse. It actually becomes the critical yield point that demands the logging and auditing of misbehaviors and attacks in BGP security deployments. We propose a blockchain-based Internet number resource authority and trustworthy management solution, named BGPcoin, to facilitate the transparency of BGP security. BGPcoin provides a reliable origin advertisement source for origin authentication by dispensing resource allocations and revocations compliantly against IP prefix hijacking. We perform and audit resource assignments on the tamper-resistant Ethereum blockchain by means of a set of smart contracts, which also interact as one to provide the trustworthy origin route examination for BGP. Compared with RPKI, BGPcoin yields significant benefits in securing origin advertisement and building a dependable infrastructure for the object repository. We demonstrate it through an Ethereum prototype implementation, and we deploy it and do experiment on a locally-simulated network and an official Ethereum test network respectively. The extensive experiment and evaluation demonstrate the incentives to deploy BGPcoin, and the enhanced security provided by BGPcoin is technically and economically feasible.
Authentication is the issue most talked about nowadays. Comparing with Blockchain we want to research the justification for the blockchain technology to be used in enterprise log analysis and the appearance of blockchain technology to develop and make remarkable change in enterprise log analysis.
George Markowsky, Олег Савенко, Anatoliy Sachenko
The paper proposes the architecture of distributed multilevel detection system of malicious software in local area networks. Its feature is the synthesis of its requirements of distribution, decentralization, multilevel. This allows you to use it autonomously. In addition, the feature of autonomous program modules of the system is the same organization, which allows the exchange of knowledge in the middle of the system, which, unlike the known systems, allows you to use the knowledge gained by separate parts of the system in other parts. The developed system allows to fill it with subsystems of detection of various types of malicious software in local area networks.
The exponential growth of wireless-based solutions, such as those related to the mobile smart devices (e.g., smart-phones and tablets) and Internet of Things (IoT) devices, has lead to countless advantages in every area of our society. Such a scenario has transformed the world a few decades back, dominated by latency, into a new world based on an efficient real-time interaction paradigm.Recently, cryptocurrency have contributed to this technological revolution, the fulcrum of which are a decentralization model and a certification function offered by the so-called blockchain infrastructure, which make it possible to certify the financial transactions, anonymously. However, it should be observed how this challenging scenario has generated new security problems directly related to the involved new technologies (e.g., e-commerce frauds, mobile bot-net attacks, blockchain DoS attacks, cryptocurrency scams, etc.). In this context, we can acknowledge that the scientific community efforts are usually oriented toward specific solutions, instead to exploit all the available technologies, synergistically, in order to define more efficient security paradigms. This paper aims to indicate a possible approach able to improve the security of people and things by introducing a novel paradigm to security defined Internet of Entities (IoE). It is a mechanism for the localization of people and things, which exploits both the huge number of existing wireless-based devices and the blockchain-based distributed ledger technology, overcoming the limits of traditional localization approaches, but without jeopardizing the user privacy. Its operation is based on two core elements with interchangeable roles, entities and trackers, which can be very common elements such as smart-phones, tablets, and IoT devices, and its implementation requires minimal efforts thanks to the existing infrastructures and devices.
Domhnall Carlin, Philip OrKane, Sakir Sezer, Jonah Burgess
With the rise in worth and popularity of cryptocurrencies, a new opportunity for criminal gain is being exploited and with little currently offered in the way of defence. The cost of mining (i.e., earning cryptocurrency through CPU-intensive calculations that underpin the blockchain technology) can be prohibitively expensive, with hardware costs and electrical overheads previously offering a loss compared to the cryptocurrency gained. Off-loading these costs along a distributed network of machines via malware offers an instantly profitable scenario, though standard Anti-virus (AV) products offer some defences against file-based threats. However, newer fileless malicious attacks, occurring through the browser on seemingly legitimate websites, can easily evade detection and surreptitiously engage the victim machine in computationally-expensive cryptomining (cryptojacking). With no current academic literature on the dynamic opcode analysis of cryptomining, to the best of our knowledge, we present the first such experimental study. Indeed, this is the first such work presenting opcode analysis on non-executable files. Our results show that browser-based cryptomining within our dataset can be detected by dynamic opcode analysis, with accuracies of up to 100%. Further to this, our model can distinguish between cryptomining sites, weaponized benign sites, de-weaponized cryptomining sites and real world benign sites. As it is process-based, our technique offers an opportunity to rapidly detect, prevent and mitigate such attacks, a novel contribution which should encourage further future work.