Smart contracts are programs that automatically execute on the blockchain system such as Ethereum. Everybody can write and deploy smart contracts on Ethereum, which causes a large collection of similar contracts via code reuse. In practice, code reuse in smart contract may amplify severe threats like security attacks, resource waste, etc. In this paper, we conduct an empirical study of code reuse in smart contracts for understanding the code reuse practice in the smart contract ecosystem. We first collect 146,452 open-source smart contract projects from Ethereum and then perform a detailed analysis. We first study how often the smart contract projects reuse and then we identify the top reused smart contracts and analyze how the developers revise smart contracts during reuse. Our research suggests that the code reuse in smart contract is quite frequent because about 26% contract code blocks are reused and the average time of reuse is 14.6. And the top reused contracts are almost all related to ERC20 token, which reveals that the current smart contract ecosystem is relatively homogenous. At last, we summarize 7 common types of code revision in smart contracts.
The Internet of Things (IoT) has been revolutionizing this world by introducing exciting applications almost in all walks of daily life, such as healthcare, smart cities, smart environments, safety, remote sensing, and many more. This paper proposes a new framework based on the blockchain and deep learning model to provide more security for Android IoT devices. Moreover, our framework is capable to find the malware activities in a real-time environment. The proposed deep learning model analyzes various static and dynamic features extracted from thousands of feature of malware and benign apps that are already stored in blockchain distributed ledger. The multi-layer deep learning model makes decisions by analyzing the previous data and follow some steps. Firstly, it divides the malware feature into multiple level clusters. Secondly, it chooses a unique deep learning model for each malware feature set or cluster. Finally, it produces the decision by combining the results generated from all cluster levels. Furthermore, the decisions and multiple-level clustering data are stored in a blockchain that can be further used to train every specialized cluster for unique data distribution. Also, a customized smart contract is designed to detect deceptive applications through the blockchain framework. The smart contract verifies the malicious application both during the uploading and downloading process of Android apps on the network. Consequently, the proposed framework provides flexibility to features for run-time security regarding malware detection on heterogeneous IoT devices. Finally, the smart contract helps to approve or deny to uploading and downloading harmful Android applications.
Identity is a crucial property of Internet of Things (IoT) devices. Due to rapid growth and high numbers of similar devices, reliable identification of those devices is a problem. The origin and history of an IoT device is especially important in security relevant environments. Our research addresses this issue by proposing an approach based on blockchain and decentralized identifiers (DID). It is inspired by the concepts of self-sovereign identity (SSI) and bootstrapping of remote secure key infrastructures (BRSKI). Devices are equipped by the manufacturer with an identity stored in a trusted execution environment (TEE) and secured by a blockchain. This identity can be used to trace back the origin of the device. During the bootstrapping process on the customer side, the identity registration of the device is updated in the blockchain. This process is performed by a so-called registrar. Smart contracts prevent unsolicited transfer of ownership and track the history of the device. Besides proof of origin and device security our concept can be used for device inventory and firmware upgrade. A prototype implementation was realized to validate the concept. All six use cases have been implemented and tested using an Ethereum blockchain infrastructure. JSON Web Tokens (JWT) have been used as signed artefacts to transfer information between the stakeholders. This enables an asynchronous communication needed for example in an environment with no direct internet access. Such an infrastructure can be provided by an independent association and can be used by all manufacturers. Depending on the environment, a registration of devices can be optional or mandatory.
Digital forensic in Internet-of-Thing (IoT) paradigm is critical due to its heterogeneity and lack of transparency of evidence processing. Moreover, cross-border legalization makes a hindrance in such process pertaining to the cloud forensic issues. This urges a forensic framework for IoT which provides distributed computing, decentralization, and transparency of forensic investigation of digital evidences in cross-border perspectives. To this end, we propose a framework for IoT forensics that addresses the above mentioned issues. The proposed solution called Internet-of-Forensics (IoF) considers a blockchain tailored IoT framework for digital forensics. It provides a transparent view of the investigation process that involves all the stakeholders (e.g., heterogeneous devices, and cloud service providers) in a single framework. It uses blockchain-based case chain to deal with the investigation process including chain-of-custody and evidence chain. Consensus is used for consortium to solve the problems of cross-border legalization. This is also beneficial for a transparent and ease of forensic reference. The programmable lattice-based cryptographic primitives produce reduced complexities. It shows benefits for power-aware devices and puts an add-on to the novelty of the presented idea. IoF is generic; hence, it can be used by autonomous security operation centers, cyber-forensic investigators and manually initiated evidences under chain-of-custody for man-made crimes. Security services are assured as required by the framework. IoF is experimented and compared with the other state-of-the-art frameworks. The outcomes and analysis prove the efficiency of IoF concerning complexity, time consumption, memory and CPU utilization, gas consumption, and energy analysis.
Ryan Song, Zihan Zhao, Yuxi Cai, Andreas Veneris · 5 authors
This paper presents SigVM, a novel blockchain virtual machine that supports an event-driven execution model, enabling developers to build fully autonomous smart contracts. SigVM introduces another way for a contract to interact with another. Contracts in SigVM can emit signal events, on which other contracts can listen. Once an event is triggered, corresponding handler functions are automatically executed as signal transactions. We built an end-to-end blockchain platform SigChain and a contract language compiler SigSolid to realize the potential of SigVM. Experimental results show that SigVM enables contracts in our benchmark applications to be reimplemented in a fully autonomous way, eliminating the dependency on unreliable mechanisms like off-chain relay servers. SigVM can significantly simplify the execution flow of our benchmark applications, and can avoid security risks such as front-run attacks.
Zihan Zhao, Sidi Mohamed Beillahi, Ryan Song, Yuxi Cai · 6 authors
This paper presents SigVM, a novel blockchain virtual machine that supports an event-driven execution model, enabling developers to build autonomous smart contracts. Contracts in SigVM can emit signal events, on which other contracts can listen. Once an event is triggered, corresponding handler functions are automatically executed as signal transactions. We build an end-to-end blockchain platform SigChain and a contract language compiler SigSolid to realize the potential of SigVM. Experimental results show that our benchmark applications can be reimplemented with SigVM in an autonomous way, eliminating the dependency on unreliable mechanisms like off-chain relay servers. The development effort of reimplementing these contracts with SigVM is small, i.e., we modified on average 2.6% of the contract code.
Cryptocurrencies have emerged as a new form of digital money that has not escaped the eyes of cyber-attackers. Traditionally, they have been maliciously used as a medium of exchange for proceeds of crime in the cyber dark-market by cyber-criminals. However, cyber-criminals have devised an exploitative technique of directly acquiring cryptocurrencies from benign users' CPUs without their knowledge through a process called crypto mining. The presence of crypto mining activities in a network is often an indicator of compromise of illegal usage of network resources for crypto mining purposes. Crypto mining has had a financial toll on victims such as corporate networks and individual home users. This paper addresses the detection of crypto mining attacks in a generic network environment using dynamic network characteristics. It tackles an in-depth overview of crypto mining operational details and proposes a semi-supervised machine learning approach to detection using various crypto mining features derived from complex network characteristics. The results demonstrate that the integration of semi-supervised learning with complex network theory modeling is effective at detecting crypto mining activities in a network environment. Such an approach is helpful during security mitigation by network security administrators and law enforcement agencies.
In recent years, the Internet of Things (IoT) has made great progress. The interconnection between IoT and the Internet enables real-time information processing and transaction implementation through heterogeneous intelligent devices. But the security, the privacy, and the reliability of IoT are key challenges that limit its development. The features of the blockchain, such as decentralization, consensus mechanism, data encryption, and smart contracts, are suitable for building distributed IoT systems to prevent potential attacks and to reduce transaction costs. As a decentralized and transparent database platform, blockchain has the potential to raise the performance of IoT security to a higher level. This article systematically analyzes state of the art of IoT security based on the blockchain, paying special attention to the security features, issues, technologies, approaches, and related scenarios in blockchain-embedded IoT. The integration and interoperation of blockchain and IoT is an important and foreseeable development in the computational communication system.
Stefan Driessen, Dario Di Nucci, Geert Monsieur, Damian A. Tamburri · 5 authors
Blockchain and smart contract technology are novel approaches to data and\ncode management that facilitate trusted computing by allowing for development\nin a distributed and decentralized manner. Testing smart contracts comes with\nits own set of challenges which have not yet been fully identified and\nexplored. Although existing tools can identify and discover known\nvulnerabilities and their interactions on the Ethereum blockchain through\nrandom search or symbolic execution, these tools generally do not produce test\nsuites suitable for human oracles. In this paper, we present AGSOLT (Automated\nGenerator of Solidity Test Suites). We demonstrate its efficiency by\nimplementing two search algorithms to automatically generate test suites for\nstand-alone Solidity smart contracts, taking into account some of the\nblockchain-specific challenges. To test AGSOLT, we compared a random search\nalgorithm and a genetic algorithm on a set of 36 real-world smart contracts. We\nfound that AGSOLT is capable of achieving high branch coverage with both\napproaches and even discovered some errors in some of the most popular Solidity\nsmart contracts on Github.\n
Stefan Driessen, Dario Di Nucci, Geert Monsieur, Willem‐Jan van den Heuvel
Blockchain and smart contract technology are novel approaches to data and code management, that facilitate trusted computing by allowing for development in a distributed and decentralized manner. Testing smart contracts comes with its own set of challenges which have not yet been fully identified and explored. Although existing tools can identify and discover known vulnerabilities and their interactions on the Ethereum blockchain through random search or symbolic execution, no framework exists for applying advanced, multi-objective algorithms to create test suites for such smart contracts. In this paper, we present AGSolT (Automated Generator of Solidity Test Suites). We demonstrate its efficiency by implementing two search algorithms to automatically generate test suites for stand-alone Solidity smart contracts, taking into account some of the blockchain-specific challenges. To test AGSolT, we compared a random search algorithm and a genetic algorithm on a set of 36 real-world smart contracts. We found that AGSolT is capable of achieving high branch overage with both approaches and even discovered some errors in some of the most popular Solidity smart contracts on Github.
Bitcoin is the most popular digital currency. It is not controlled by any sort of central bank or government institution and is the preferred payment method requested by cyber criminals through ransomware. This type of malware encrypts a victim's files and forces them to pay a ransom in order to regain access. In this short paper, Bitcoin transaction data of tenyears is analyzed by generating a K-Means clustering model, using it to predict each sample's cluster, and then creating a confusion matrix and evaluating the results (Rand Score).
Konrad Wrona, Frank Micevski Scharf, Michał Jarosz
Security accreditation is a vital process used by governmental, military, and international organizations to verify a proper security posture of communication and information systems. Currently, it is a largely manual, time consuming, and highly repetitive process. Smart contracts could offer an opportunity to automate some parts of the security review, increasing speed, transparency, and predictability of the security accreditation, as well as software approval. We analyze the feasibility of supporting security accreditation with smart contracts and present our proof-of-concept implementation based on Hyperledger Fabric.
Cryptocurrencies have enhanced financial transactions, but being decentralized, they pose numerous security threats to their users, warranting new anomaly detection systems for fraud prevention.The present research focuses on the machine learning (ML) techniques used in detecting suspicious activities in cryptocurrency networks, focusing on their contribution to AML and CFT compliance.The paper also compares supervised and unsupervised learning techniques and their merits and demerits.The supervised learning techniques, including Decision Trees, SVMs, and Neural Networks, are presented for their accuracy and flexibility, and, on the other hand, the unsupervised learning approaches, including Clustering, Isolation Forests, and Autoencoders are considered for their potential to discover new fraud patterns even if the training data is not labeled.An analysis of the use of explainability tools such as LIME and SHAP in artificial intelligence systems is also carried out to improve how users understand the results given to them by the AI models.These models have their real-life application illustrated by case studies, which prove helpful in identifying anomalies in Bitcoin and Ethereum transactions.New research directions suggest improvements in machine learning methods, the connection of the results with analysis tools based on blockchain, and cooperation with relevant authorities to improve the identification of threats and conformity with established guidelines.The potential of applying the idea of this work in traditional finance and cybersecurity is discussed, highlighting the possibility of applying ML in multiple fields to enhance security and compliance.The study then informs the significance of continued research and collaboration among disciplines to combat the emerging issues of financial fraud and cybercrimes related to cryptocurrencies.
Distributed Denial of Service (DDoS) attack is a major threat impeding service to legitimate requests on any network. Although the first DDoS attack was reported in 1996, the complexity and sophistication of these attacks has been ever increasing. A 2 TBps attack was reported in mid-August 2020 directed towards critical infrastructure, such as finance, amidst the COVID-19 pandemic. It is estimated that these attacks will double, reaching over 15 million, in the next 2 years. A number of mitigation schemes have been designed and developed since its inception but the increasing complexity demands advanced solutions based on emerging technologies. Blockchain has emerged as a promising and viable technology for DDoS mitigation. The inherent and fundamental characteristics of blockchain such as decentralization, internal and external trustless attitude, immutability, integrity, anonymity and verifiability have proven to be strong candidates, in tackling this deadly cyber threat. This survey discusses different approaches for DDoS mitigation using blockchain in varied domains to date. The paper aims at providing a comprehensive review, highlighting all necessary details, strengths, challenges and limitations of different approaches. It is intended to serve as a single platform to understand the mechanics of current approaches to enhance research and development in the DDoS mitigation domain.
Blockchain technology is increasingly finding traction in diverse areas such as finance, supply-chain management, and cloud services because of its ability to provide robust cybersecurity inherent in its system of having decentralized data storage. The rising complexity in the architecture of popular blockchain platforms create barriers to correct adoption of the technology. It becomes imperative that pedagogical tools are inducted in the blockchain ecosystem to address this perceived or real impediments for the uptake of the technology. We propose one of the first such pedagogical tool for training in blockchain using an adversarial sandbox adaptive serious game approach for students and technology professionals. We further propose use of AI to enhance NPC interactivity based on player’s responses. We plan to evaluate this serious game on a subjective metrics that is based on a game experience questionnaire.
Nur Widiyasono, Aldy Putra Aldya, Rifan Renanda Ardhian
“Miners” bekerja untuk memecahkan masalah matematika yang kompleks untuk menghasilkan pendapatan dalam bentuk mata uang digital, seperti Bitcoin, Ethereum, Monero, dan lainnya. Proses mining ini membutuhkan perangkat keras yang serius dan sumber daya CPU yang signifikan untuk menciptakan cryptocurrency. Cryptojacking salah satu alat penambangan mata uang digital secara illegal. Cryptojacking dapat memberikan return yang lebih substansial bagi penyerang.Cryptominer jenis ini tidak terlalu membahayakan secara langsung kepada para korbannya, tetapi hanya saja menggunakan akses illegal ke komputer korban dan menggunakan sumber daya korban untuk menambang crypto. Metode yang digunakan adalah dynamic analysis. Dinamic Analysis adalah mencari informasi atau sampel mengenai malware dengan cara menjalankannya. Dengan metode ini dapat terlihat “perilaku” dari malware tersebut sehingga selanjutnya dapat dianalisa dampak yang terjadi. Pengujian malware ini dilakukan dengan 2 cara yaitu pengujian pertama dilakukan dengan javascript injection pada jaringan lokal yang sama dengan korban yaitu wifi publik dan pengujian kedua dengan mengakses website yang terindikasi skrip cryptojacking. Berdasarkan hasil analisis menggunakan dynamic analysis dimana cryptojacking dapat menginfeksi langsung ke website atau melalui jaringan local dengan javascript injection, jika website telah terinfeksi cryptojacking maka pengunjung dari website tersebut akan menjadi korban dan terjadi penambangan tersembunyi yang akan memakan sumber daya korban dan cryptojacking operator dalang dibalik website yang terinfeksi akan menerima keuntungan dalam bentuk mata uang digital dari hasil cryptojacking ini
Nicolas Six, Claudia Negri-Ribalta, Nicolas Herbaut, Camille Salinesi
Blockchain has been praised for its capacity to hold data in a decentralized\nand tamper-proof way. It also supports the execution of code through\nblockchain's smart contracts, adding automation of actions to the network with\nhigh trustability. However, as smart contracts are visible by anybody on the\nnetwork, the business data and logic may be at risk, thus companies could be\nreluctant to use such technology. This paper aims to propose a pattern that\nallows the execution of automatable legal contract clauses, where its execution\nstates are stored in an on-chain smart-contract and the logic needed to enforce\nit wraps it off-chain. An engine completes this pattern by running a business\nprocess that corresponds to the legal contract. We then propose a pattern-based\nsolution based on a real-life use case: transportation of refrigerated goods.\nWe argue that this pattern guarantees companies pseudonymity and data\nconfidentiality while ensuring that an audit trail can be reconstituted through\nthe blockchain smart-contract to identify misbehavior or errors. This paper\npaves the way for a future possible implementation of the solution described,\nas well as its evaluation.\n
Open access
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
Mobile app markets are emerging with the popularity of smartphones. However, they fall short in several aspects, including no transparent app listing, no world-wide app access, and even insecure app downloading. To address these problems, we propose a novel blockchain-based gateway, AGChain, to bridge end users and app markets so that existing app markets could still provide services while users enjoy permanent, distributed, and secure app delegation from AGChain. To this end, we identify two previously under-estimated challenges and propose mechanisms to significantly reduce gas costs in our smart contract and make IPFS (Inter-planetary File System) based file storage really distributed. We also address three AGChain-specific system challenges to make it secure and sustainable. We have implemented an AGChain prototype (https://www.agchain.ltd/) on Ethereum. The evaluation shows that it achieves security and decentralization with minimal gas costs and reasonable performance.
The popularity of smartphones has led to the growth of mobile app markets, creating a need for enhanced transparency, global access, and secure downloading. This paper introduces AGChain, a blockchain-based gateway that enables trustworthy app delegation within existing markets. AGChain ensures that markets can continue providing services while users benefit from permanent, distributed, and secure app delegation. During its development, we address two key challenges: significantly reducing smart contract gas costs and enabling fully distributed IPFS-based file storage. Additionally, we tackle three system issues related to security and sustainability. We have implemented a prototype of AGChain on Ethereum and Polygon blockchains, achieving effective security and decentralization with a minimal gas cost of around 0.002 USD per app upload (no cost for app download). The system also exhibits reasonable performance with an average overhead of 12%.
Aiming at ensure the security and self-control of heterogeneous alliance network, this paper proposes a novel structure of identity authentication based on domestic commercial cryptography with blockchain in the heterogeneous alliance network. The domestic commercial cryptography, such as SM2, SM3, SM4, SM9 and ZUC, is adopted to solve the encryption, decryption, signature and verification of blockchain, whose key steps of data layer are solved by using domestic commercial cryptographic algorithms. In addition, it is the distributed way to produce the public key and private key for the security of the keys. Therefore, the cross domain identity authentication in the heterogeneous alliance network can be executed safely and effectively.