Ui-Jun Baek, Se-Hyun Ji, Jee- Tae Park, Min‐Seob Lee · 6 authors
Since the inception of Bitcoin, the first cryptocurrency to implement blockchain technology, the cryptocurrency market has experienced significant growth.However, this growth has also brought about numerous vulnerabilities and attacks that pose a threat to the Bitcoin ecosystem.These attacks are not only focused on the Bitcoin network itself but also extend to the services that utilize it.Recent surveys have indicated the need to analyze and identify Distributed Denial of Service (DDoS) attacks, considering the interconnectedness between network-level data and service-level DDoS attacks within the Bitcoin system.Typically, the Bitcoin network is considered resilient against DDoS attacks due to the decentralized nature of its ledger.Nevertheless, there are potential vulnerabilities that could be exploited, such as message spoofing using the Transmission Control Protocol (TCP).Additionally, DDoS attacks often target services associated with Bitcoin usage rather than directly impacting the network's performance or stealing currency.Although these service-level attacks may not have an immediate impact, they can ultimately undermine the value of Bitcoin, leading to depreciation.The majority of DDoS attacks on Bitcoin-related services occur on exchanges and mining pools.Our approach involves evaluating experimental outcomes based on proposed metrics to establish a correlation between network-level data and service-level DDoS attacks in the Bitcoin system.By doing so, we aim to detect and analyze these attacks, thereby identifying potential associations.Furthermore, we posit that the methodology employed in this study could be applicable to other blockchain systems, extending its usefulness beyond the Bitcoin network.
Background: Millions of smart contracts have been deployed to Ethereum for providing various applications. Recent studies discovered many severe security and performance issues in smart contracts by applying static program analysis techniques to them. Given a smart contract, the majority of these analysis techniques need to first construct its control flow graph, which connects basic blocks through control flow transfers (CFTs), before conducting further analysis. Aims: The objective of this work is to understand the capabilities of static program analysis techniques to identify CFTs, and to investigate how static program analysis techniques can be improved if the CFTs are complemented. Method: We perform a comprehensive empirical study on six widely-used tools for smart contract analysis by using all deployed smart contracts to understand their capabilities to recognize CFTs. We capture all execution traces of all smart contracts to evaluate the number of CFTs covered by traces that are not found by those tools. We enhance a state-of-the-art tool, OYENTE for discovering vulnerabilities in smart contracts with the CFTs covered by traces to investigate how the tool is improved. Results: These studied tools fail to identify all CFTs due to several reasons, e.g., incomplete code patterns. Execution traces effectively complement these tool in recognizing CFTs. By including the CFTs covered by traces, the false negative rate of OYENTE can be reduced by up to 30%. Conclusions: Our study underlines the ineffectiveness of static analysis techniques due to the incapabilities of CFT identification.
Meryam Essaid, Daeyong Kim, Soo Hoon Maeng, Sejin Park · 5 authors
Recently Distributed Denial-of-Service (DDoS) are becoming more and more sophisticated, which makes the existing defence systems not capable of tolerating by themselves against wide-ranging attacks. Thus, collaborative protection mitigation has become a needed alternative to extend defence mechanisms. However, the existing coordinated DDoS mitigation approaches either they require a complex configuration or are highly-priced. Blockchain technology offers a solution that reduces the complexity of signalling DDoS system, as well as a platform where many autonomous systems (Ass) can share hardware resources and defence capabilities for an effective DDoS defence. In this work, we also used a Deep learning DDoS detection system; we identify individual DDoS attack class and also define whether the incoming traffic is legitimate or attack. By classifying the attack traffic flow separately, our proposed mitigation technique could deny only the specific traffic causing the attack, instead of blocking all the traffic coming towards the victim(s).
Sunbeom So, Myungho Lee, Jisu Park, Heejo Lee · 5 authors
We present VERISMART, a highly precise verifier for ensuring arithmetic safety of Ethereum smart contracts. Writing safe smart contracts without unintended behavior is critically important because smart contracts are immutable and even a single flaw can cause huge financial damage. In particular, ensuring that arithmetic operations are safe is one of the most important and common security concerns of Ethereum smart contracts nowadays. In response, several safety analyzers have been proposed over the past few years, but state-of-the-art is still unsatisfactory; no existing tools achieve high precision and recall at the same time, inherently limited to producing annoying false alarms or missing critical bugs. By contrast, VERISMART aims for an uncompromising analyzer that performs exhaustive verification without compromising precision or scalability, thereby greatly reducing the burden of manually checking undiscovered or incorrectly-reported issues. To achieve this goal, we present a new domain-specific algorithm for verifying smart contracts, which is able to automatically discover and leverage transaction invariants that are essential for precisely analyzing smart contracts. Evaluation with real-world smart contracts shows that VERISMART can detect all arithmetic bugs with a negligible number of false alarms, far outperforming existing analyzers.
Ning Lu, Bin Wang, Yongxin Zhang, Wenbo Shi · 5 authors
Summary Ethereum is one of the currently popular trading platform, where any one can exchange, buy, or sell cryptocurrencies. Smart contract, a computer program, can help Ethereum to encode rules or scripts for processing transactions. Because the smart contract usually handles large number of cryptocurrencies worth billions of dollars apiece, its security has gained considerable attention. In this paper, we first investigate the security of smart contracts running on the Ethereum and introduce several new security vulnerabilities that allow adversaries to exploit and gain financial benefits. Then, we propose a more practical smart contract analysis tool termed NeuCheck, in which we introduce the syntax tree in the syntactical analyzer to complete the transformation from source code to intermediate representation, and then adopt the open source library working with XML to analyze such tree. We have built a prototype of NeuCheck for Ethereum and evaluate it with over 52 000 existing Ethereum smart contracts. The results show that (1) our new documented vulnerabilities are prevalent; (2) NeuCheck improves the analysis speed by at least 17.2 times compared to other popular analysis tools (eg, Securify and Mythril; and (3) allows for cross‐platform deployment.
Ethereum has become a widely used platform to enable secure, Blockchain-based financial and business transactions. However, a major concern in Ethereum is the security of its smart contracts. Many identified bugs and vulnerabilities in smart contracts not only present challenges to maintenance of blockchain, but also lead to serious financial loses. There is a significant need to better assist developers in checking smart contracts and ensuring their reliability.In this paper, we propose a web service tool, named SmartEmbed, which can help Solidity developers to find repetitive contract code and clone-related bugs in smart contracts. Our tool is based on code embeddings and similarity checking techniques. By comparing the similarities among the code embedding vectors for existing solidity code in the Ethereum blockchain and known bugs, we are able to efficiently identify code clones and clone-related bugs for any solidity code given by users, which can help to improve the users' confidence in the reliability of their code. In addition to the uses by individual developers, SmartEmbed can also be applied to studies of smart contracts in a large scale. When applied to more than 22K solidity contracts collected from the Ethereum blockchain, we found that the clone ratio of solidity code is close to 90\%, much higher than traditional software, and 194 clone-related bugs can be identified efficiently and accurately based on our small bug database with a precision of 96\%. SmartEmbed can be accessed at \url{http://www.smartembed.net}. A demo video of SmartEmbed is at \url{https://youtu.be/o9ylyOpYFq8}
Purathani Praitheeshan, Lei Pan, Jiangshan Yu, Joseph K. Liu · 5 authors
Smart contracts are software programs featuring both traditional applications\nand distributed data storage on blockchains. Ethereum is a prominent blockchain\nplatform with the support of smart contracts. The smart contracts act as\nautonomous agents in critical decentralized applications and hold a significant\namount of cryptocurrency to perform trusted transactions and agreements.\nMillions of dollars as part of the assets held by the smart contracts were\nstolen or frozen through the notorious attacks just between 2016 and 2018, such\nas the DAO attack, Parity Multi-Sig Wallet attack, and the integer\nunderflow/overflow attacks. These attacks were caused by a combination of\ntechnical flaws in designing and implementing software codes. However, many\nmore vulnerabilities of less severity are to be discovered because of the\nscripting natures of the Solidity language and the non-updateable feature of\nblockchains. Hence, we surveyed 16 security vulnerabilities in smart contract\nprograms, and some vulnerabilities do not have a proper solution. This survey\naims to identify the key vulnerabilities in smart contracts on Ethereum in the\nperspectives of their internal mechanisms and software security\nvulnerabilities. By correlating 16 Ethereum vulnerabilities and 19 software\nsecurity issues, we predict that many attacks are yet to be exploited. And we\nhave explored many software tools to detect the security vulnerabilities of\nsmart contracts in terms of static analysis, dynamic analysis, and formal\nverification. This survey presents the security problems in smart contracts\ntogether with the available analysis tools and the detection methods. We also\ninvestigated the limitations of the tools or analysis methods with respect to\nthe identified security vulnerabilities of the smart contracts.\n
Huashan Chen, Marcus Pendleton, Laurent Njilla, Shouhuai Xu
The blockchain technology is believed by many to be a game changer in many application domains, especially financial applications. While the first generation of blockchain technology (i.e., Blockchain 1.0) is almost exclusively used for cryptocurrency purposes, the second generation (i.e., Blockchain 2.0), as represented by Ethereum, is an open and decentralized platform enabling a new paradigm of computing --- Decentralized Applications (DApps) running on top of blockchains. The rich applications and semantics of DApps inevitably introduce many security vulnerabilities, which have no counterparts in pure cryptocurrency systems like Bitcoin. Since Ethereum is a new, yet complex, system, it is imperative to have a systematic and comprehensive understanding on its security from a holistic perspective, which is unavailable. To the best of our knowledge, the present survey, which can also be used as a tutorial, fills this void. In particular, we systematize three aspects of Ethereum systems security: vulnerabilities, attacks, and defenses. We draw insights into, among other things, vulnerability root causes, attack consequences, and defense capabilities, which shed light on future research directions.
Smart contract is a special program that manages digital assets on blockchain. It is difficult to recover the loss if users make transactions through buggy smart contracts, which cannot be directly fixed. Hence, it is important to ensure the correctness of smart contracts before deploying them. This paper proposes a systematic framework to mutation testing for smart contracts on Ethereum, which is currently the most popular open blockchain for deploying and running smart contracts. Fifteen novel mutation operators have been designed for Ethereum Smart Contracts (ESC), in terms of keyword, global variable/function, variable unit, and error handling. An empirical study on 26 smart contracts in four Ethereum DApps has been conducted to evaluate the effectiveness of mutation testing. The experimental results show that our approach can outperform the coverage-based approach on defect detection rate (96.01% vs. 55.68%). The ESC mutation operators are effective to reveal real defects and we found 117 out of 729 real bug reports are related to our operators. These show the great potential of using mutation testing for quality assurance of ESC.
Marius Musch, Christian Wressnegger, Martin Johns, Konrad Rieck
With the introduction of memory-bound cryptocurrencies, such as Monero, the implementation of mining code in browser-based JavaScript has become a worthwhile alternative to dedicated mining rigs. Based on this technology, a new form of parasitic computing, widely called cryptojacking or drive-by mining, has gained momentum in the web. A cryptojacking site abuses the computing resources of its visitors to covertly mine for cryptocurrencies. In this paper, we systematically explore this phenomenon. For this, we propose a 3-phase analysis approach, which enables us to identify mining scripts and conduct a large-scale study on the prevalence of cryptojacking in the Alexa 1 million websites. We find that cryptojacking is common, with currently 1 out of 500 sites hosting a mining script. Moreover, we perform several secondary analyses to gain insight into the cryptojacking landscape, including a measurement of code characteristics, an estimate of expected mining revenue, and an evaluation of current blacklist-based countermeasures.
Aug 9, 2019·Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
Ethereum Virtual Machine (EVM) is the run-time environment for smart contracts and its vulnerabilities may lead to serious problems to the Ethereum ecology. With lots of techniques being continuously developed for the validation of smart contracts, the testing of EVM remains challenging because of the special test input format and the absence of oracles. In this paper, we propose EVMFuzzer, the first tool that uses differential fuzzing technique to detect vulnerabilities of EVM. The core idea is to continuously generate seed contracts and feed them to the target EVM and the benchmark EVMs, so as to find as many inconsistencies among execution results as possible, eventually discover vulnerabilities with output cross-referencing. Given a target EVM and its APIs, EVMFuzzer generates seed contracts via a set of predefined mutators, and then employs dynamic priority scheduling algorithm to guide seed contracts selection and maximize the inconsistency. Finally, EVMFuzzer leverages benchmark EVMs as cross-referencing oracles to avoid manual checking. With EVMFuzzer, we have found several previously unknown security bugs in four widely used EVMs, and 5 of which had been included in Common Vulnerabilities and Exposures (CVE) IDs in U.S. National Vulnerability Database. The video is presented at https://youtu.be/9Lejgf2GSOk.
Gustavo Betarte, Maximiliano Cristiá, Carlos Luna, Adrián Silveira · 5 authors
Emin Gün Sirer once said: It's clear that writing a robust, secure smart contract requires extreme amounts of diligence. It's more similar to writing code for a nuclear power reactor, than to writing loose web code [...] Yet the current Solidity language and underlying EVM seems designed more for the latter. Formal methods (FM) are mathematics-based software development methods aimed at producing "code for a nuclear power reactor". That is, due application of FM can produce bug-free, zero-defect, correct-by-construction, guaranteed, certified software. However, the software industry seldom use FM. One of the main reasons for such a situation is that there exists the perception (which might well be a fact) that FM increase software costs. On the other hand, FM can be partially applied thus producing high-quality software, although not necessarily bug-free. In this paper we outline some FM related techniques whose application the cryptocurrency community should take into consideration because they could bridge the gap between "loose web code" and "code for a nuclear power reactor".
Lo‐Yao Yeh, Jiun‐Long Huang, T.S. Benedict Yen, Jen-Wei Hu
In this paper, we propose a consortium blockchainbased system sharing malicious IP to prevent further attacks happening among other hosts. In our scheme, every security operation center (SOC) serving as a blockchain-node uploads some suspicious IPs to find the potential attackers' IPs. A smart contract is responsible for comparing the loaded IPs and the existing ones without human interference. If IPs in different lists are matched with certain degree, this system will respond by giving the whole list of malicious IP. By means of these steps, shares of IP lists are achieved and attacks are prevented in advance. Besides, when uploading and sharing, we utilize elliptic curve cryptography to ensure data confidentiality and integrity.
Data stored in different kinds of Database management systems is always prone to tampering through internal or external sources. To detect such malicious changes in the database we use various Database Tampering Detection methods. A major find in this area was to use one-way cryptographic hash functions as well as use of digital watermarking to detect any tamper in the data. But these techniques won't work on Distributed Database. In this paper, we have put forth the idea of using a Distributed Database to store data and we can easily detect any malicious transaction using Blockchain technology in it. It is simply a digital ledger bound using cryptographic principles.
Digital and Cyber Forensics
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
In this paper, we introduce a machine learning predictive model that detects patterns of security vulnerabilities in smart contracts. We adapted two static code analyzers to label more than 1000 smart contracts that were verified and used on the Ethereum platform. Our model predicted a number of major software vulnerabilities with the average accuracy of 95 percent. The model currently supports smart contracts developed in Solidity, however, the approach described in this paper can be applied to other languages and blockchain platforms.
The scale of criminal networks (e.g. drug syndicates and terrorist networks) extends globally and poses national security threat to many nations as they also tend to be technologically advance (e.g. Dark Web and Silk Road cryptocurrency). Therefore, it is critical for law enforcement agencies to be equipped with the latest tools in criminal network analysis (CNA) to obtain key hidden links (relationships) within criminal networks to preempt and disrupt criminal network structures and activities. Current hidden or missing link predictive models that are based on Social Network Analysis models rely on ML techniques to improve the performance of the models in terms of predictive accuracy and computing power. Given the improvement in the recent performance of Deep Reinforcement Learning (DRL) techniques which could train ML models through self-generated dataset, DRL can be usefully applied to domains with relatively smaller dataset such as criminal networks. The objective of this study is to assess the comparative performance of a CNA hidden link prediction model developed using DRL techniques against classical ML models such as gradient boosting machine (GBM), random forest (RF) and support vector machine (SVM). The experiment results exhibit an improvement in the performance of the DRL model of about 7.4% over the next best performing classical RF model trained within 1500 iterations. The performance of these link prediction models can be scaled up with the parallel processing capabilities of graphical processing units (GPUs), to significantly improve the speed of training the model and the prediction of hidden links.
The decentralized nature of blockchain technologies can well match the needs of integrity and provenances of evidences collecting in digital forensics (DF) across jurisdictional borders. In this paper, a novel blockchain-based DF investigation framework in the Internet of Things (IoT) and social systems environment is proposed, which can provide proof of existence and privacy preservation for evidence items examination. To implement such features, we present a block-enabled forensics framework for IoT, namely, IoT forensic chain (IoTFC), which can offer forensic investigation with good authenticity, immutability, traceability, resilience, and distributed trust between evidential entitles as well as examiners. The IoTFC can deliver a guarantee of traceability and track provenance of evidence items. Details of evidence identification, preservation, analysis, and presentation will be recorded in chains of block. The IoTFC can increase trust of both evidence items and examiners by providing transparency of the audit train. The use case demonstrated the effectiveness of the proposed method.
Seonghyeon Gong, Erzhena Tcydenova, Jeong Hoon Jo, Younghun Lee · 5 authors
The broadly configured smart city network requires a variety of security considerations for a heterogeneous device environment. Because a network of heterogeneous devices facilitates an attacker’s intrusion through a specific device or node, a device management framework is required to manage each node comprehensively. This paper proposes a blockchain-based device management framework for efficient device management, scalable firmware update and resiliences on attacks against smart city network. This framework offers four device management and firmware update mechanisms based on the performance and requirements of each device: bidirectional mechanism of general end node and a unidirectional mechanism of the lightweight end node. This difference optimizes the resource of network and devices in terms of management and security. All management history of each device is stored in the blockchain and transmitting firmware between vendor and management node is conducted through a smart contract of blockchain for security and resilience on the attack. Through the framework proposed in this paper, the confidentiality and availability of device management on smart city network as well as integrity, auditability, adaptability and authentication for each node are ensured and the effectiveness of the proposed framework is presented through the security analysis.
Ruffin White, Gianluca Caiazza, Agostino Cortesi, Young Im Cho · 5 authors
Event data recording is crucial in robotics research, providing prolonged insights into a robot's situational understanding, progression of behavioral state, and resulting outcomes. Such recordings are invaluable when debugging complex robotic applications or profiling experiments ex post facto. As robotic developments mature into production, both the roles and requirements of event logging will broaden, to include serving as evidence for auditors and regulators investigating accidents or fraud. Given the growing number of high profile public incidents involving self-driving automotives resulting in fatality and regulatory policy making, it is paramount that the integrity, authenticity and non-repudiation of such event logs are maintained to ensure accountability. Being mobile cyber-physical systems, robots present new threats, and vulnerabilities beyond traditional IT: unsupervised physical system access or postmortem collusion between robot and OEM could result in the truncation or alteration of prior records. In this letter, we address immutablization of log records via integrity proofs and distributed ledgers with special considerations for mobile and public service robot deployments.
Sté́phane Ducasse, Henrique Rocha, Santiago Bragagnolo, Marcus Denker · 5 authors
Smart contracts are new computational units with special properties: they act as classes with aspectual concerns; their memory structure is more complex than mere objects; they are obscure in the sense that, once they are deployed, it is difficult to access their internal state; they reside in an append-only chain. There is a need to support the building of new generation tools to help developers. Such support should tackle several important aspects: (1) the static structure of the contract, (2) the object nature of published contracts, and (3) the overall data chain composed of blocks and transactions. In this chapter, we present SmartAnvil, an open platform to build software analysis tools around smart contracts. We illustrate the general components, and we focus on three important aspects: support for static analysis of Solidity smart contracts, deployed smart contract binary analysis through inspection, and blockchain navigation and querying. SmartAnvil is open source and supports a bridge to the Moose data and software analysis platform.
Mark Mossberg, Felipe Andrés Manzano, Eric Hennenfent, Alex Groce · 8 authors
An effective way to maximize code coverage in software tests is through dynamic symbolic execution$-$a technique that uses constraint solving to systematically explore a program's state space. We introduce an open-source dynamic symbolic execution framework called Manticore for analyzing binaries and Ethereum smart contracts. Manticore's flexible architecture allows it to support both traditional and exotic execution environments, and its API allows users to customize their analysis. Here, we discuss Manticore's architecture and demonstrate the capabilities we have used to find bugs and verify the correctness of code for our commercial clients.