The current open cryptocurrency markets pose varied challenges on a prospective investor (PI), such as pseudoanonymity of cryptocurrency transactions, selection criteria for investments in crowdfunding schemes (CF), modus-operandi for these schemes, non-transparency of money generation and distribution among peers, and untraceable scams. PIs are susceptible to monetary losses in the open market due to the aforementioned issues. The fraudsters could be both internal (operator of the scheme) and external (financial institutions (FI), such as banks, money-lenders, and insurance companies). The centrality of trust among stakeholders like PI, CF, and FI is a prime concern. Motivated from these facts, this paper proposes a decentralized framework, KaRuNa, A Blockchain-based Sentiment analysis framework for Fraud Cryptocurrency schemes. KaRuNa operates on public blockchain three phases of trust modeling among stakeholders. In the first phase, transactions are performed on the blockchain that offers trust, auditability, and transparency among stakeholders. In the second phase, sentiment analysis (SA) of cryptocurrencies is proposed based on a novel algorithm of hash addresses to generate classification scores (CS). Parameters like social trends, rise/fall in cryptocurrency price, measured standard deviation, peak and low are selected to fed to proposed novel Long-short term memory (LSTM) classifier to generate recommendations based on CS. An accuracy of 98.99% is achieved using LSTM over generated CS to evaluate risks in the investment. Results demonstrate that KaRuNa achieves more scalability compared to conventional approaches.
Self-sovereign identity is a new identity management paradigm that allows entities to really have the ownership of their identity data and control their use without involving any intermediary. Blockchain is an enabling technology for building self-sovereign identity systems by providing a neutral and trustable storage and computing infrastructure, and can be viewed as a component of the systems. Both blockchain and self-sovereign identity are emerging technologies which could present a steep learning curve for architects. We collect and propose 12 design patterns for blockchain-based self-sovereign identity systems to help the architects understand and easily apply the concepts in system design. Based on the lifecycles of three main objects involved in self-sovereign identity, we categorise the patterns into three groups: key management patterns, decentralised identifier management patterns, and credential design patterns. The proposed patterns provide a systematic and holistic guide for architects to design the architecture of blockchain-based self-sovereign identity systems.
Lei Wu, Siwei Wu, Yajin Zhou, Runhuai Li · 8 authors
As one of the representative blockchain platforms, Ethereum has attracted lots of attacks. Due to the existed financial loss, there is a pressing need to perform timely investigation and detect more attack instances. Though multiple systems have been proposed, they suffer from the scalability issue due to the following reasons. First, the tight coupling between malicious contract detection and blockchain data importing makes them infeasible to repeatedly detect different attacks. Second, the coarse-grained archive data makes them inefficient to replay transactions. Third, the separation between malicious contract detection and runtime state recovery consumes lots of storage. In this paper, we present the design of a scalable attack detection framework on Ethereum. It overcomes the scalability issue by saving the Ethereum state into a database and providing an efficient way to locate suspicious transactions. The saved state is fine-grained to support the replay of arbitrary transactions. The state is well-designed to avoid saving unnecessary state to optimize the storage consumption. We implement a prototype named EthScope and solve three technical challenges, i.e., incomplete Ethereum state, scalability, and extensibility. The performance evaluation shows that our system can solve the scalability issue, i.e., efficiently performing a large-scale analysis on billions of transactions, and a speedup of around 2,300x when replaying transactions. It also has lower storage consumption compared with existing systems. The result with three different types of information as inputs shows that our system can help an analyst understand attack behaviors and further detect more attacks. To engage the community, we will release our system and the dataset of detected attacks.
Lei Wu, Siwei Wu, Yajin Zhou, Runhuai Li · 8 authors
As one of the representative blockchain platforms, Ethereum has attracted
lots of attacks. Due to the potential financial loss, there is a pressing need
to detect malicious smart contracts and understand their behaviors. Though
there exist multiple systems for smart contract analysis, they cannot
efficiently analyze a large number of transactions and re-execute smart
contracts to introspect malicious behaviors. In this paper, we urge for a transaction-centric security analytics framework
for Ethereum, which provides an efficient way to quickly locate suspicious ones
from a large number of transactions and extensible way to detect malicious
smart contracts with analyst-provided scripts. We present the system design in
the paper, which solves three technical challenges, i.e., incomplete states,
scalability and extensibility. We have implemented a prototype system named
EthScope to solve these challenges. In particular, the first component Data
Aggregator collects and recovers critical blockchain states. The second
component Replay Engine is able to {replay} arbitrary and a large number of
transactions. The third component Instrumentation Framework exposes interfaces
for an analyst to dynamically instrument smart contracts and introspect the
execution of suspicious transactions. The comprehensive evaluation with six
types of attacks demonstrated the effectiveness of our system. The performance
evaluation shows that our system can perform a large-scale analysis on
suspicious transactions (more than 8 million ones) and has a speed up of around
2,300x compared with the JSTracer provided by Go-Ethereum. To engage the
community, we will release our system and a dataset of detected attacks on
https://github.com/zjuicsr/ethscope.
Paulo Silva, David Vavřička, João Barreto, Miguel Matos
Given the large adoption and economical impact of permissionless blockchains, the complexity of the underlying systems and the adversarial environment in which they operate, it is fundamental to properly study and understand the emergent behavior and properties of these systems. We describe our experience on a detailed, one-month study of the Ethereum network from several geographically dispersed observation points. We leverage multiple geographic vantage points to assess the key pillars of Ethereum, namely geographical dispersion, network efficiency, blockchain efficiency and security, and the impact of mining pools. Among other new findings, we identify previously undocumented forms of selfish behavior and show that the prevalence of powerful mining pools exacerbates the geographical impact on block propagation delays. Furthermore, we provide a set of open measurement and processing tools, as well as the data set of the collected measurements, in order to promote further research on understanding permissionless blockchains.
Double-spending is a potential flaw in cryptocurrencies. In recent years, double-spend attacks have caused severe economic damage to many Bitcoin consumers, thus double-spending problems have attracted wide attention. Studying related countermeasures and mitigations against such attacks is imperative. In this article, we briefly introduce a new form of combined attack: double-spending with a Sybil attack in the Bitcoin network and discuss how to mitigate it. We propose two mitigations such as charging an identity fee and setting a deadline to defend against this attack, and we evaluate the effect of these two mitigations through an economic analysis.
Cong T. Nguyen, Diep N. Nguyen, Hoang Thai Dinh, Hoang-Anh Pham · 7 authors
Mobile service providers (MSPs) are particularly vulnerable to roaming frauds, especially ones that exploit the long delay in the data exchange process of the contemporary roaming management systems, causing multi-billion dollars loss each year. In this paper, we introduce BlockRoam, a novel blockchain-based roaming management system that provides an efficient data exchange platform among MSPs and mobile subscribers. Utilizing the Proof-of-Stake (PoS) consensus mechanism and smart contracts, BlockRoam can significantly shorten the information exchanging delay, thereby addressing the roaming fraud problems. Through intensive analysis, we show that the security and performance of such PoS-based blockchain network can be further enhanced by incentivizing more users (e.g., subscribers) to participate in the network. Moreover, users in such networks often join stake pools (e.g., formed by MSPs) to increase their profits. Therefore, we develop an economic model based on Stackelberg game to jointly maximize the profits of the network users and the stake pool, thereby encouraging user participation. We also propose an effective method to guarantee the uniqueness of this game's equilibrium. The performance evaluations show that the proposed economic model helps the MSPs to earn additional profits, attracts more investment to the blockchain network, and enhances the network's security and performance.
To implement a blockchain, we need a blockchain protocol for all the nodes to follow. To design a blockchain protocol, we need a block publisher selection mechanism and a chain selection rule. In Proof-of-Stake (PoS) based blockchain protocols, block publisher selection mechanism selects the node to publish the next block based on the relative stake held by the node. However, PoS protocols, such as Ouroboros v1, may face vulnerability to fully adaptive corruptions. In this paper, we propose a novel PoS-based blockchain protocol, QuickSync, to achieve security against fully adaptive corruptions while improving on performance. We propose a metric called block power, a value defined for each block, derived from the output of the verifiable random function based on the digital signature of the block publisher. With this metric, we compute chain power, the sum of block powers of all the blocks comprising the chain, for all the valid chains. These metrics are a function of the block publisher's stake to enable the PoS aspect of the protocol. The chain selection rule selects the chain with the highest chain power as the one to extend. This chain selection rule hence determines the selected block publisher of the previous block. When we use metrics to define the chain selection rule, it may lead to vulnerabilities against Sybil attacks. QuickSync uses a Sybil attack resistant function implemented using histogram matching. We prove that QuickSync satisfies common prefix, chain growth, and chain quality properties and hence it is secure. We also show that it is resilient to different types of adversarial attack strategies. Our analysis demonstrates that QuickSync performs better than Bitcoin by an order of magnitude on both transactions per second and time to finality, and better than Ouroboros v1 by a factor of three on time to finality.
With rise of cryptocurrency popularity and value, more and more cybercriminals seek to profit using that new technology. Most common ways to obtain illegitimate profit using cryptocurrencies are ransomware and cryptojacking also known as malicious mining. And while ransomware is well-known and well-studied threat which is obvious by design, cryptojacking is often neglected because it's less harmful and much harder to detect. This article considers question of cryptojacking detection. Brief history and definition of cryptojacking are described as well as reasons for designing custom detection technique. We also propose complex detection technique based on CPU load by an application, which can be applied to both browser-based and executable-type cryptojacking samples. Prototype detection program based on our technique was designed using decision tree algorithm. The program was tested in a controlled virtual machine environment and achieved 82% success rate against selected number of cryptojacking samples. Finally, we'll discuss generalization of proposed technique for future work.
Christof Ferreira Torres, Mathis Baden, Radu State
The Ethereum blockchain enables the execution of so-called smart contracts. These are programs that facilitate the automated transfer of funds according to a given business logic without the participants requiring to trust one another. However, recently attackers started using smart contracts to lure users into traps by deploying contracts that pretend to give away funds but in fact contain hidden traps. This new type of scam is commonly referred to as honeypots. In this paper, we propose a system that aims to protect users from falling into these traps. The system consists of a plugin for MetaMask and a back-end service that continuously scans the Ethereum blockchain for honeypots. Whenever a user is about to perform a transaction through MetaMask, our plugin sends a request to the back-end and warns the user if the target contract is a honeypot.
Cong T. Nguyen, Diep N. Nguyen, Dinh Thai Hoang, Hoang-Anh Pham · 6 authors
Roaming fraud is one of the most significant financial losses for mobile service providers. The inefficiency of current exchanging data management methods among mobile service providers is the main obstacle for roaming fraud prevention. In this paper, we introduce a novel blockchain-based data exchange management system to address roaming fraud problems in mobile networks. This system provides a secure and automatic data exchange service among mobile service providers and mobile subscribers. In addition, we introduce an emerging Proof-of-Stake (PoS) consensus mechanism for the proposed blockchain-based roaming fraud prevention system, which can significantly reduce the delay in exchanging information as well as implementation costs for mobile service providers. To further enhance benefits and security efficiency for the proposed blockchain system, we develop an economic model based on Stackelberg game. This game model is very effective in maximizing profits for both the stakeholders and stake pool and useful in designing a robust blockchain-based mobile roaming management system. Through performance analysis and numerical results, we show that our proposed framework not only provides an effective solution to prevent mobile roaming fraud but also opens many business opportunities for future mobile networks.
Blockchain is a service operated by a peer-to-peer type distributed network, and protocol control such as JSON-RPC is implemented as the interface for flexibility and operability. However, attacks that use protocol control against vulnerable and unmanaged interfaces have been reported. One of the methods to track cyber attacks on such a malicious user's network service is a honeypot that imitates the service and acquires attacker's behavior information. In this research, focusing on the Ethereum network, the behavior of malicious users is clarified using malicious communication history sent to simple honeypots installed in nine countries, Ethereum network information and darknet arrival packets. By analyzing these, the behavior of attackers and the tendency of requests were elucidated, and primary safety measures were established.
Over the past few years, there has been a growth in activity, public knowledge, and awareness of cryptocurrencies and related blockchain technology. As the industry has grown, there has also been an increase in scams looking to steal unsuspecting individuals' cryptocurrency. Many of the scams operate on visually similar but seemingly unconnected websites, advertised by malicious social media accounts, which either attempt an advance-fee scam or operate as phishing websites. This paper analyses public online and blockchain-based data to provide a deeper understanding of these cryptocurrency scams. The clustering technique DBSCAN is applied to the content of scam websites to discover a typology of advance-fee and phishing scams. It is found that the same entities are running multiple instances of similar scams, revealed by their online infrastructure and blockchain activity. The entities also manufacture public blockchain activity to create the appearance that their scams are genuine. Through source and destination of funds analysis, it is observed that victims usually send funds from fiat-accepting exchanges. The entities running these scams cash-out or launder their proceeds using a variety of avenues including exchanges, gambling sites, and mixers.
Ramiro Daniel Camino, Christof Ferreira Torres, Mathis Baden, Radu State
Ethereum smart contracts have recently drawn a considerable amount of attention from the media, the financial industry and academia. With the increase in popularity, malicious users found new opportunities to profit by deceiving newcomers. Consequently, attackers started luring other attackers into contracts that seem to have exploitable flaws, but that actually contain a complex hidden trap that in the end benefits the contract creator. In the blockchain community, these contracts are known as honeypots. A recent study presented a tool called HONEYBADGER that uses symbolic execution to detect honeypots by analyzing contract bytecode. In this paper, we present a data science detection approach based foremost on the contract transaction behavior. We create a partition of all the possible cases of fund movements between the contract creator, the contract, the transaction sender and other participants. To this end, we add transaction aggregated features, such as the number of transactions and the corresponding mean value and other contract features, for example compilation information and source code length. We find that all aforementioned categories of features contain useful information for the detection of honeypots. Moreover, our approach allows us to detect new, previously undetected honeypots of already known techniques. We furthermore employ our method to test the detection of unknown honeypot techniques by sequentially removing one technique from the training set. We show that our method is capable of discovering the removed honeypot techniques. Finally, we discovered two new techniques that were previously not known.
Bitcoin paper gave birth to a new era; cryptocurrencies aiming distributed trust model. Almost all the cryptocurrencies require their users individually manage their own cryptographic keys, provide or recommend use of cryptocurrency wallets. A wallet, which at least stores public-private keys and addresses, is one of the key points for end-users' security. Since the authentication of a transaction strictly depends on private keys, any adversary who gains access to a wallet may seize all the coins within. Hence, cryptocurrency wallet solutions should be carefully analyzed and better to be certified if possible. In this study, we aim to define the security problems and objectives necessary for the development of a certified product that can stand against the known attacks within the Framework of Common Criteria (CC). We believe this would be a brief source for cryptocurrency wallet Protection Profile (PP) and Security Target (ST) documents.
Ralph Holz, Diego Perino, Matteo Varvello, Johanna Amann · 9 authors
In late 2017, a sudden proliferation of malicious JavaScript was reported on the Web: browser-based mining exploited the CPU time of website visitors to mine the cryptocurrency Monero. Several studies measured the deployment of such code and developed defenses. However, previous work did not establish how many users were really exposed to the identified mining sites and whether there was a real risk given common user browsing behavior. In this paper, we present a retroactive analysis to close this research gap. We pool large-scale, longitudinal data from several vantage points, gathered during the prime time of illicit cryptomining, to measure the impact on web users. We leverage data from passive traffic monitoring of university networks and a large European ISP, with suspected mining sites identified in previous active scans. We corroborate our results with data from a browser extension with a large user base that tracks site visits. We also monitor open HTTP proxies and the Tor network for malicious injection of code. We find that the risk for most Web users was always very low, much lower than what deployment scans suggested. Any exposure period was also very brief. However, we also identify a previously unknown and exploited attack vector on mobile devices.
With the revolution and growth of the media industry, and development of new mediums to update citizens with the latest news, in recent years there has been a spurt in the production of articles spreading fake information. Many media channels leverage on the concept of spreading eye-catching malicious news that attracts readers which has been proven to be quite dangerous in most cases. These channels post an exaggerated version of the truth, thus leading to an emerging trend of spreading fake news. To tackle this problem, we propose a two-step solution involving machine learning and block chain. The proposed solution consists of a news verification portal using a two-fold approach, which first detects whether the news article is fake or real leveraging the accuracy of a machine learning algorithm and then verifies the source using human crowd auditors on a block chain platform based on proof-of-stake.
Nahom Aron Dawit, Sujith Samuel Mathew, Kadhim Hayawi
Cyber-security is indispensable as malicious incidents are ubiquitous on the Internet. Intrusion Detection Systems have an important role in detecting and thwarting cyber-attacks. However, it is more effective in a centralized system but not in peer-to-peer networks which makes it subject to central point failure, especially in collaborated intrusion detection systems. The novel blockchain technology assures a fully distributed security system through its powerful features of transparency, immutability, decentralization, and provenance. Therefore, in this paper, we investigate and demonstrate several methods of collaborative intrusion detection with blockchain to analyze the suitability and security of blockchain for collaborative intrusion detection systems. We also studied the difference between the existing means of the integration of intrusion detection systems with blockchain and categorized the major vulnerabilities of blockchain with their potential losses and current enhancements for mitigation.
Flooded by the propagation of false or biased news in the Web, people tend to resort to social networks to read posts from reliable sources, exchange commentaries with trustworthy parties, access first-hand content, or cross-check information that appears in news outlets. However, platform providers like Facebook or Twitter can ultimately decide about the contents exposed to each user. Anecdotal evidence suggests that such platform providers are prone to pressure by political or economical agents, and may be ideologically driven to hide messages or block certain users [2, 12] thereby impairing users' ability to freely access rightful information.
The limitation with smart contracts is that they cannot access external data which might be required to control the execution of business logic. Oracles can be used to provide external data to smart contracts. An oracle is an interface that delivers data from external data outside the blockchain to a smart contract to consume. Oracle can deliver different types of data depending on the industry and requirements. In this paper, we study and describe the widely used blockchain oracles. Then, we elaborate on his potential role, technical architecture, and design patterns. Finally, we discuss the human oracle and his key role in solving the truth problem by reaching a consensus about a certain inquiry and tasks.
As the indispensable trading platforms of the ecosystem, hundreds of cryptocurrency exchanges are emerging to facilitate the trading of digital assets. While, it also attracts the attentions of attackers. A number of scam attacks were reported targeting cryptocurrency exchanges, leading to a huge mount of financial loss. However, no previous work in our research community has systematically studied this problem. In this paper, we make the first effort to identify and characterize the cryptocurrency exchange scams. We first identify over 1,500 scam domains and over 300 fake apps, by collecting existing reports and using typosquatting generation techniques. Then we investigate the relationship between them, and identify 94 scam domain families and 30 fake app families. We further characterize the impacts of such scams, and reveal that these scams have incurred financial loss of 520k US dollars at least. We further observe that the fake apps have been sneaked to major app markets (including Google Play) to infect unsuspicious users. Our findings demonstrate the urgency to identify and prevent cryptocurrency exchange scams. To facilitate future research, we have publicly released all the identified scam domains and fake apps to the community.
Crowdfunding is an innovative way of financing projects that allows anyone to contribute money online and support various initiatives, such as businesses, causes, or solutions. However, traditional crowdfunding platforms face some challenges, such as lack of transparency and security, high fees, and limited control over the funds by the contributors and the project owners. Blockchain technology, which is a P2P, decentralized ledger, which is distributed can offer a more reliable, secure, and transparent solution for crowdfunding. Blockchain-based crowdfunding can leverage smart contracts, which are self-executing agreements that encode the rules and conditions of the funding process and ensure that the funds are released only when the predefined criteria are met. This paper aims to propose a concept for designing efficient smart contracts for crowdfunding, which can enable both the contributors and the project owners to have more control and influence over the funds and the project outcomes. Unlike the existing literature-based ideas, our proposed method not only allows the contributors to invest their own money, but also guarantees them that their token values will be preserved. This method can be integrated without disrupting the existing logic of the blockchain. The methodology provides higher control and transparency for all the parties involved in the crowdfunding process.