Background: Executing, verifying and enforcing credible transactions on permissionless blockchains is done using smart contracts. A key challenge with smart contracts is ensuring their correctness and security. Several test input generation techniques for detecting vulnerabilities in smart contracts have been proposed in the last few years. However, a comparison of proposed techniques to gauge their effectiveness is missing. Aim: This paper conducts an empirical evaluation of testing techniques for smart contracts. The testing techniques we evaluated are: (1) Blackbox fuzzing, (2) Adaptive fuzzing, (3) Coverage-guided fuzzing with an SMT solver and (4) Genetic algorithm. We do not consider static analysis tools, as several recent studies have assessed and compared effectiveness of these tools. Method: We evaluate effectiveness of the test generation techniques using (1) Coverage achieved - we use four code coverage metrics targeting smart contracts, (2) Fault finding ability - using artificially seeded and real security vulnerabilities of different types. We used two datasets in our evaluation - one with 1665 real smart contracts from Etherscan, and another with 90 real contracts with known vulnerabilities to assess fault finding ability. Result: We find Adaptive fuzzing performs best in terms of coverage and fault finding over contracts in both datasets. Conclusion: However, we believe considering dependencies between functions and handling Solidity specific features will help improve the performance of all techniques considerably.
Testing is an important technique to improve the quality of Ethereum smart contract programs. However, current work on testing smart contract only focus on static problems of smart contract programs. A data flow oriented test case generation approach for dynamic testing of smart contract programs is still missing. To address this problem, this paper proposes a novel test case generation approach, called ADF-GA (All-uses Data Flow criterion based test case generation using Genetic Algorithm), for Solidity based Ethereum smart contract programs. ADF-GA aims to efficiently generate a valid set of test cases via three stages. First, the corresponding program control flow graph is constructed from the source codes. Second, the generated control flow graph is analyzed to obtain the variable information in the Solidity programs, locate the require statements, and also get the definition-use pairs to be tested. Finally, a genetic algorithm is used to generate test cases, in which an improved fitness function is proposed to calculate the definition-use pairs coverage of each test case with program instrumentation. Experimental studies are performed on several representative Solidity programs. The results show that ADF-GA can effectively generate test cases, achieve better coverage, and reduce the number of iterations in genetic algorithm.
Decentralized applications development on the Ethereum platform is becoming very popular in last few years. However, it requires developer to have knowledge and skills to integrate large number of components, such as smart contracts programming, IPFS decentralized storage, RPC calls or True for smart contracts management and various JavaScript libraries (e.g. Web3.js, TrueContract, JS-IPFS). This makes the development process very complex and dicult. At the same time, the developer has multiple front-end frameworks available, which however lack the ability to easily integrate the majority of previously mentioned components. To solve this problem, there are integration tools which address above issues and are intended to support a comprehensive development of decentralized applications (e.g. Drizzle, Vortex, Web3-React). The paper focuses on these integration tools and analyses the code complexity of decentralized application development using such tools. The analysis of code complexity was performed using multiple code complexity metric assessment methods.
The Rapid growth of agile gadgets has led to tremendous increase in digital media utilization, mostly for mobile video in ease of marketing. As encryption provides better user confidentiality and perseveration, greater number of online movement is associated with end-to-end encryption form. Irrevlant content such as unreal, violent and unconstitutional videos are being circulated online without being identified its truthfulness creating a platform for intruders and attackers. It is necessary for users to identify and report the contents of the video. Sometimes these videos act as evidence in courts to prove the guilty and the proper state and contents recorded in it .We aim a system to detect and classify the video's truthfulness to solve these problems. A detailed collection of studies has been toted to demonstrate the efficacy of new program over current literature.
Open access
Advanced Steganography and Watermarking Techniques
Smart Contracts are computer programs which implement and execute transactions and manage business logic on a decentralized public ledger. Smart Contracts can be written in different programming languages and for different Blockchains. Currently the most used language for Smart Contracts is Solidity and the most used platform is the Ethereum Blockchain. Assessing the quality of Smart Contract programs is an important task required to professional programmers, especially when a programming language has so powerful economic implications. It is therefore crucial to provide professional programmers with tools for the evaluation of Smart Contracts. In software engineering, software metrics has been defined and used to measure software quality and, more in general, to qualify software under the principle “You Can't Manage What You Don't Measure”. For the Solidity programming language there are only a few Standalone Applications to analyse the Smart Contract metrics. The aim of this paper is first to build a tool for the practical computation of a specific set of Solidity source code metrics, so that the set will be extensible in the future according also to Solidity compiler evolution, second to fully enable a web-based usage of the tool to access the metrics of the Solidity programming language. The tool, PASO, differently from the existing application, is able to give software metrics values for Smart Contracts written in Solidity programming language just using a web browser.
Wilfridus Bambang Triadi Handaya, Mohd Najwadi Yusoff, Aman Jantan
Abstract Cybercrime is the highest threat to every private company and government agency in the world. Using synergistic threats to attack provides many success alternatives that lead to the same goal, which is to take over the network and carry out illegal mining activities using CPU resources from the victim’s computer. One of the main motives for the success of this criminal business is its relatively low cost and high return of investment. Using the infection chain method in carrying out cryptocurrency mining malware attacks with fileless techniques involves loading malicious code into system memory. Monero (XMR) is by far the highest popular cryptocurrency among threat actor installing mining malware because it comes with full anonymity and resistance to an application-specific circuit mining (ASIC). This work proposes a better method for classifying conventional malware and cryptocurrency mining malware. On the other hand, grouping specific of suitable features extracted from the sources of EMBER dataset shown as malware and need to categorize as a cryptocurrency mining malware. The proposed approach is defining a better algorithm for enhancing accuracy and efficiency for cryptocurrency mining malware detection.
In recent years, many smart contracts on the ethereum platform are increasingly closer to our life. The existence of smart contract enables us to complete complicated transactions without depending on the third party. It should be not only fast, but also secure guaranteed. When the smart contract is requested to execute, the action is performed by ethereum virtual machine (EVM). If EVM occurs errors in the process of implementation, the contract execution result will also have mistaken. Therefore, ensuring the correctness of the EVM is very important. In this work, we propose a framework to formally verify EVM instruction implementations by model checking to check whether the instruction operation behaviors working on EVM is the same as the expected definitions in the ethereum yellow paper. In addition, we also define a set of interfaces specifically for EVM instruction verification to achieve the reusability of our proposed verification environment. The experimental results indicate that the formal verification method used in this work is more trustworthy than the conventional testing method. It can exactly capture the errors in the design which may be undetected by testing/simulation methods. The defined instructions are divided into 11 categories, and our work has completed to verify 7 categories, including 92 instructions of total 134, in 50 hours.
Smart contracts, programs running on blockchain systems, leverage diverse decentralized applications (DApps). Unfortunately, well-known smart contract platforms, Ethereum for example, face serious security problems. Exploits to contracts may cause enormous financial losses, which emphasize the importance of smart contract testing. However, current exploit generation tools have difficulty to solve hard constraints in execution paths and cannot simulate the blockchain behaviors very well. These problems cause a loss of coverage and accuracy of exploit generation. To overcome the problems, we design and implement EthPloit, a smart contract exploit generator based on fuzzing. EthPloit adopts static taint analysis to generate exploit-targeted transaction sequences, a dynamic seed strategy to pass hard constraints and an instrumented Ethereum Virtual Machine to simulate blockchain behaviors. We evaluate EthPloit on 45,308 smart contracts and discovered 554 exploitable contracts. EthPloit automatically generated 644 exploits without any false positive and 306 of them cannot be generated by previous exploit generation tools.
The immutable feature of blockchain determines that traditional security response mechanisms (e.g., code patching) must change to remedy insecure smart contracts. The only proper way to protect a smart contract is to fix potential risks in its code before it is deployed to the blockchain. However, existing tools for smart contract security analysis focus on the detection of bugs but seldom consider the code fix issues. Meanwhile, it is often time-consuming and error-prone for a developer to understand and fix flawed code manually. In this paper we propose SMARTSHIELD, a bytecode rectification system, to fix three typical security-related bugs (i.e., state changes after external calls, missing checks for out-of-bound arithmetic operations, and missing checks for failing external calls) in smart contracts automatically and help developers release secure contracts. Moreover, SMARTSHIELD guarantees that the rectified contract is not only immune to certain attacks but also gas-friendly (i.e., a slightly increase of gas cost). To evaluate the effectiveness and efficiency of SMARTSHIELD, we applied it to 28,621 real-world buggy contracts on Ethereum blockchain (as of January 2nd2019). Experiment results demonstrated that among 95,502 insecure cases in those contracts, 87,346 (91.5%) of them were automatically fixed by SMARTSHIELD. A following test with both program analysis and real-world exploits further testified that the rectified contracts were secure against common attacks. Moreover, the rectification only introduced a 0.2 % gas increment for each contract on average.
Wei Wang, J. J. Song, Guangquan Xu, Yidong Li · 6 authors
Smart contracts are decentralized applications running on Blockchain. A very large number of smart contracts has been deployed on Ethereum. Meanwhile, security flaws of contracts have led to huge pecuniary losses and destroyed the ecological stability of contract layer on Blockchain. It is thus an emerging yet crucial issue to effectively and efficiently detect vulnerabilities in contracts. Existing detection methods like Oyente and Securify are mainly based on symbolic execution or analysis. These methods are very time-consuming, as the symbolic execution requires the exploration of all executable paths or the analysis of dependency graphs in a contract. In this work, we propose ContractWard to detect vulnerabilities in smart contracts with machine learning techniques. First, we extract bigram features from simplified operation codes of smart contracts. Second, we employ five machine learning algorithms and two sampling algorithms to build the models. ContractWard is evaluated with 49502 real-world smart contracts running on Ethereum. The experimental results demonstrate the effectiveness and efficiency of ContractWard. The predictive Micro-F1 and Macro-F1 of ContractWard are over 96% and the average detection time is 4 seconds on each smart contract when we use XGBoost for training the models and SMOTETomek for balancing the training sets.
Abstract Port Knocking is a method for authenticating clients through a closed stance firewall, and authorising their requested actions, enabling severs to offer services to authenticated clients, without opening ports on the firewall. Advances in port knocking have resulted in an increase in complexity in design, preventing port knocking solutions from realising their potential. This paper proposes a novel port knocking solution, named Crucible, which is a secure method of authentication, with high usability and features of stealth, allowing servers and services to remain hidden and protected. Crucible is a stateless solution, only requiring the client memorise a command, the server’s IP and a chosen password. The solution is forwarded as a method for protecting servers against attacks ranging from port scans, to zero-day exploitation. To act as a random oracle for both client and server, cryptographic hashes were generated through chaotic systems.
Zhipeng Gao, Lingxiao Jiang, Xin Xia, David Lo · 5 authors
Smart contracts have been increasingly used together with blockchains to automate financial and business transactions. However, many bugs and vulnerabilities have been identified in many contracts which raises serious concerns about smart contract security, not to mention that the blockchain systems on which the smart contracts are built can be buggy. Thus, there is a significant need to better maintain smart contract code and ensure its high reliability. In this paper, we propose an automated approach to learn characteristics of smart contracts in Solidity, which is useful for clone detection, bug detection and contract validation on smart contracts. Our new approach is based on word embeddings and vector space comparison. We parse smart contract code into word streams with code structural information, convert code elements (e.g., statements, functions) into numerical vectors that are supposed to encode the code syntax and semantics, and compare the similarities among the vectors encoding code and known bugs, to identify potential issues. We have implemented the approach in a prototype, named SmartEmbed,11.The anonymous replication packages can be accessed at:https://drive.google.com/file/d/1kauLT3y2IiHPkUlVx4FSTda-dVAyL4za/view?usp=sharing.and evaluated it with more than 22,000 smart contracts collected from the Ethereum blockchain. Results show that our tool can effectively identify many repetitive instances of Solidity code, where the clone ratio is around 90 percent. Code clones such as type-III or even type-IV semantic clones can also be detected accurately. Our tool can identify more than 1000 clone related bugs based on our bug databases efficiently and accurately. Our tool can also help to efficiently validate any given smart contract against a known set of bugs, which can help to improve the users’ confidence in the reliability of the contract.
The challenge of automatically determining the correctness of test executions is referred to as the test oracle problem and is one of the key remaining issues for automated testing. The goal in this paper is to solve the test oracle problem in a way that is general, scalable and accurate. To achieve this, we use supervised learning over test execution traces. We label a small fraction of the execution traces with their verdict of pass or fail. We use the labelled traces to train a neural network (NN) model to learn to distinguish runtime patterns for passing versus failing executions for a given program. Our approach for building this NN model involves the following steps, 1. Instrument the program to record execution traces as sequences of method invocations and global state, 2. Label a small fraction of the execution traces with their verdicts, 3. Designing a NN component that embeds information in execution traces to fixed length vectors, 4. Design a NN model that uses the trace information for classification, 5. Evaluate the inferred classification model on unseen execution traces from the program. We evaluate our approach using case studies from different application domains: 1. Module from Ethereum Blockchain, 2. Module from PyTorch deep learning framework, 3. Microsoft SEAL encryption library components, 4. Sed stream editor, 5. Value pointer library and 6. Nine network protocols from Linux packet identifier, L7-Filter. We found the classification models for all subject programs resulted in high precision, recall and specificity, over 95%, while only training with an average 9% of the total traces. Our experiments show that the proposed neural network model is highly effective as a test oracle and is able to learn runtime patterns to distinguish passing and failing test executions for systems and tests from different application domains.
Jawad Ali, Ahmad Shahrafidz Khalid, Eiad Yafi, Shahrulniza Musa · 5 authors
Internet of Things (IoT) occupies a vital aspect of our everyday lives. IoT networks composed of smart-devices which communicate and transfer the information without the physical intervention of humans. Due to such proliferation and autonomous nature of IoT systems make these devices threatened and prone to a severe kind of threats. In this paper, we introduces a behavior capturing, and verification procedures in blockchain supported smart-IoT systems that can be able to show the trust-level confidence to outside networks. We defined a custom \emph{Behavior Monitor} and implement on a selected node that can extract the activity of each device and analyzes the behavior using deep machine learning strategy. Besides, we deploy Trusted Execution Technology (TEE) which can be used to provide a secure execution environment (enclave) for sensitive application code and data on the blockchain. Finally, in the evaluation phase we analyze various IoT devices data that is infected by Mirai attack. The evaluation results show the strength of our proposed method in terms of accuracy and time required for detection.
A cyber attack necessitates preventing the spread of damage by quickly responding to the incident. To investigate the situation accurately, we must collect, manage, and maintain log data on devices related to the system. We herein propose a distributed management method for logs using a blockchain scheme. The blockchain scheme has the following two features. One makes managed data tamper resistant. The other makes access to the same data possible with multiple terminals, thereby increasing access availability. A log management method that adapts these features can provide log data that are guaranteed to be complete when needed. This paper presents our evaluation of the feasibility of our method in a prototype.
Safi Ur Rehman, Muhammad Usman Shahid Khan, Mazhar Ali
The blockchain is an intelligent and cryptographically secure technology. Blockchain provides data integrity, security, and anonymity without any third-party enabling immutable database technology with a built-in trust mechanism. In this paper, we focused on utilizing blockchain technology for proving the origin of digital media by enhancing the functionality of an existing solution. This research improves the functionality of the existing solution by using perceptual hashing. Perceptual hashing ables to differentiate similar digital media and ensures the explicit relationship between the digital media and the content creator. Experimental results show that perceptual hashing gives better performance in the detection of image alteration and sensitive to small changes.
Blockchain has a strong capacity to monitor and retain educational records. The paperless future has yet to become a reality, even with the ability to digitally generate documents. Physical copy of records are still regularly printed which makes them susceptible to document fraud. Thus, the issue of fake certificates and academic records has risen drastically. In this paper, we have made a reliable verification method to avoid academic frauds. The idea presented here is developed over Hyperledger. The University or The Educational Institute is responsible for issuing the certificates, mark-sheets, transcripts, etc. and mining it over the blockchain. The student is provided with the hash number which is the reference number. This number serves the reference of the data. The Organization or the Industry Personal using the hash number checks for the integrity of the submitted document. The present study discusses about importance of block chain and it’s applicability especially for the applications like verification of Academic Records.
991012879763303412 HKUST Electronic Theses Coverage-directed differential testing of EVM implementations by Hang Xu thesis 2020 x, 37 pages : illustrations ; 30 cm Ethereum virtual machine(EVM) is the heart of the Ethereum infrastructure and functions as the runtime environment for…Read more ›
Since the birth of Blockchain technology in 2008, it has been widely implemented in areas of finance, most notably as a cryptocurrency which now has real-world monetary value. The rise of blockchain can be attributed to its unique characteristics: being trust-less, immutable and decentralized. There are companies who adopt private blockchains in general. However, with the emergence of special products such as Infrastructure as a Service that ease blockchain implementation issues, the public blockchains are steadily garnering interests not just from companies but from aspiring blockchain developers as well. \nThis project will develop a mobile application using Ethereum, an open-source and public blockchain platform that enables developers to create decentralized applications with it along with Android Studio to create the application for mobile usage. Then, security testing is performed on the application. Using the observations from the tests, we will be able to identify threats that the blockchain environment can and cannot prevent.
In recent years, Internet-of-Things (IoT) has been rising in trend, converting all traditional appliance into smart connected appliance. The amount of IoT devices present not only in household, but also offices and in public are increasingly fast. As for software, blockchain technology is also on the rise, with the innovative decentralized cryptocurrency that derives from such technology, has a value in the market. Users could earn cryptocurrency by using their hardware to perform cryptocurrency mining but to stay in the competition against people with better resources requires more money. In view of the increasing number of IoT devices being used, it could tempt users to utilize the IoT devices that are not owned by them to perform the mining on behalf, this is known as cryptojacking. \nIn this report, we experiment on the feasibility of implementing cryptocurrency mining software on an embedded system in IoT devices and to form a botnet to perform cryptocurrency mining. We also respond to the feasibility with countermeasures by measuring the overhead imposed on the devices such as resource utilization on CPU and memory usage as well as the network traffic.