Blockchain Papers

Khoula Al Harthy, Aparna Agarwal

No abstract is available for this record.

Dorottya Zelenyanszki, Zhé Hóu, Kamanashis Biswas, Vallipuram Muthukkumarasamy

Non-fungible tokens (NFTs) are unique tokens with various domains, e.g. real estate, metaverse, gaming and public auctions. However, when minted on public blockchains, the underlying blockchain transaction data can be publicly accessible. This instigated transaction data analysis for various purposes, including cryptocurrency price prediction and NFT market analysis. The public data may be considered privacy-sensitive which sets a barrier to the wider adoption of NFTs. In this work, we present that the analysis of the transaction events can describe activities in NFT applications by establishing connections between transactions and thereby, it can identify information that may be privacy-sensitive. This can be useful in developing suitable privacy-enhancing methods for NFTs. We collected transaction data from a blockchain-based game called Planet IX that was built on the Polygon blockchain and used graph visualisation to provide examples for constructed connections.

Rachael A. Ntongho, Joseph Lee

We explore how cybersecurity should be incorporated into corporate governance and develop a specific framework for implementing it. We consider different types of cybersecurity incidents, such as ransomware and data leaks, and their impacts on companies. We then discuss how cybersecurity situates in the current corporate governance theoretical framework. Based on the Resource Dependency Theory (RDT), we develop a specific governance framework with a focus on the role of chief cybersecurity officer, the audit committee, the regulatory powers, and market enforcement mechanisms. As more companies are becoming digital native and more services provided are digital in the Web3 space, this chapter is policy relevant as it provides a theoretical basis for implementing cybersecurity within companies in the digital space and a specific framework for the implementation.

Florian Kammüller

No abstract is available for this record.

Daniele Granata, Massimiliano Rak, Paolo Palmiero, Adele Pastena

Despite the growing role of information and communication technology (ICT) in public administration, paper ballots still dominate elections, especially in Italy. Electronic voting has had limited success worldwide, largely due to security and manipulation concerns. The COVID-19 pandemic has reignited interest in remote e-voting for safe participation while social distancing, though security remains a critical issue. Embracing electronic voting is essential to safeguard rights, improve resource efficiency, and promote digital citizenship. Accordingly, to address security concerns in e-voting, this research emphasizes the importance of security and legal measures. The study is based on ISO15408 (Common Criteria) certification process, a framework for independent security evaluations. The paper proposes a methodology that combines legal and technical requirements for e-voting security assessments, focusing on BPMN processes to model scenarios. The methodology has been applied to a common Ethereum smart contract, focusing on the e-voting process. A detailed analysis of a Solidity e-voting smart contract reveals its vulnerabilities and limitations. The research also produces a BPMN representation of an e-voting scenario, aligning logical behaviour with smart contract implementation. The aim is to bridge the gap between legal and technical aspects of e-voting, enhancing security and transparency.

Jerry Huang, Ken Huang

No abstract is available for this record.

Stephen Kirkman, Steven Fulton, Jeffrey Hemmes, Christopher Garcia · 5 authors

The motivation of this research (and also one of the nation’s cyber goals) is enhancing the resilience of Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA) systems against ransomware attacks. ICS and SCADA systems run some of the most important networks in the country: our critical infrastructure (i.e., water flow, power grids, etc.). Disruption of these systems causes confusion, panic, and in some cases loss of life. We propose a SCADA architecture that uses blockchain to help protect ICS data from ransomware. We focus on the historian. In a SCADA system, the historian collects events from devices in the control network for real-time and future analysis. We choose to use Ethereum and its Proof of Stake (PoS) consensus protocol. The other goal of this research focuses on the resilience of blockchain. There is very little research in protecting the blockchain itself. By performing encryption testing on an Ethereum private network, we explore how vulnerable blockchain is and discuss potential ways to make a blockchain client more resilient.

Jannik Lucas Sommer, Magnus Mølgaard Lund, Nicola Cibin, Michele Albano

The frequency of software supply chain attacks has reached unprecedented levels, primarily due to the increasing reliance on huge numbers of software and hardware dependencies, and the inherent vulnerabilities they harbor. Currently, vendors providing these software and hardware components share security advisories to centralized databases or post them on proprietary websites, which security engineers have to search manually to find vulnerabilities relevant for their systems. Furthermore, the security advisories often do not follow a standard machine-readable format, which results in the engineers having to manually analyze the documents. In this paper, SENTINEL, a novel solution for automating dissemination and discovery of security advisories leveraging Web3 technologies, is presented. In particular, the Ethereum blockchain is used by vendors to notify asset owners of novel vulnerabilities in their systems in a reliable and accountable manner. Evaluation tests conducted on the Ethereum Sepolia Testnet confirm that our proposal is a functional and functioning solution for securely disseminating and discovering security advisories utilizing a fully decentralized infrastructure. SENTINEL’s source code is released as open source software on GitHub.

Amjad Mehmood, Gregory Epiphaniou, Carsten Maple, Nikolaos Ersotelos · 5 authors

Cyber threats and vulnerabilities present an increasing risk to the safe and frictionless execution of business operations. Bad actors ("hackers"), including state actors, are increasingly targeting the operational technologies (OTs) and industrial control systems (ICSs) used to protect critical national infrastructure (CNI). Minimisations of cyber risk, attack surfaces, data immutability, and interoperability of IoT are some of the main challenges of today's CNI. Cyber security risk assessment is one of the basic and most important activities to identify and quantify cyber security threats and vulnerabilities. This research presents a novel i-TRACE security-by-design CNI methodology that encompasses CNI key performance indicators (KPIs) and metrics to combat the growing vicarious nature of remote, well-planned, and well-executed cyber-attacks against CNI, as recently exemplified in the current Ukraine conflict (2014-present) on both sides. The proposed methodology offers a hybrid method that specifically identifies the steps required (typically undertaken by those responsible for detecting, deterring, and disrupting cyber attacks on CNI). Furthermore, we present a novel, advanced, and resilient approach that leverages digital twins and distributed ledger technologies for our chosen i-TRACE use cases of energy management and connected sites. The key steps required to achieve the desired level of interoperability and immutability of data are identified, thereby reducing the risk of CNI-specific cyber attacks and minimising the attack vectors and surfaces. Hence, this research aims to provide an extra level of safety for CNI and OT human operatives, i.e., those tasked with and responsible for detecting, deterring, disrupting, and mitigating these cyber-attacks. Our evaluations and comparisons clearly demonstrate that i-TRACE has significant intrinsic advantages compared to existing "state-of-the-art" mechanisms.

Qianrui Zhao, Yinan Wang, Bo Yang, Ke Shang · 8 authors

Cross-chain bridges are crucial mechanisms for facilitating interoperation between different blockchains, allowing the flow of assets and information across various chains. Their pivotal role and the vast value of assets they handle make them highly attractive to attackers. Major security incidents involving cross-chain bridge projects have been occurring frequently, resulting in losses of several billion due to cyber attacks. The diversity of vulnerability exploitation methods by hackers is vast, but not entirely untraceable. There are scarce research outcomes studying cross-chain bridge cyber incidents, and we have conducted a study based on the most recent cross-chain bridge security incidents. We introduce the working principles, components, and architecture of cross-chain bridges, explain the categorization mechanisms of the trust layer in cross-chain bridges, summarize four categories of hacker vulnerability exploitation techniques from real cases, and propose preventative measures for cross-chain bridge security.

Chelsea Medina, Lily Shaw, Dissy Vargas, Sundar Krishnan

This paper discusses the mechanisms of cryptocurrency, the idea of using security in the system, and the popularity of it. To begin, the authors provide a background on cryptocurrency and how it works. The authors understand that while most people may be familiar with the concept, they may not know how it works. Next, the authors discuss the security of cryptocurrency in-depth within the paper. The authors also provide examples of attacks on cryptocurrency systems to show the vulnerabilities within the system. Lastly, the authors discuss the popularity of the system to further express the need for security in cryptocurrency.

Hongsong Chen, Xintong Han, Yiying Zhang

With the rapid development of information technologies, industrial Internet has become more open, and security issues have become more challenging. The endogenous security mechanism can achieve the autonomous immune mechanism without prior knowledge. However, endogenous security lacks a scientific and formal definition in industrial Internet. Therefore, firstly we give a formal definition of endogenous security in industrial Internet and propose a new industrial Internet endogenous security architecture with cost analysis. Secondly, the endogenous security innovation mechanism is clearly defined. Thirdly, an improved clone selection algorithm based on federated learning is proposed. Then, we analyze the threat model of the industrial Internet identity authentication scenario, and propose cross-domain authentication mechanism based on endogenous key and zero-knowledge proof. We conduct identity authentication experiments based on two types of blockchains and compare their experimental results. Based on the experimental analysis, Ethereum alliance blockchain can be used to provide the identity resolution services on the industrial Internet. Internet of Things Application (IOTA) public blockchain can be used for data aggregation analysis of Internet of Things (IoT) edge nodes. Finally, we propose three core challenges and solutions of endogenous security in industrial Internet and give future development directions.

Syed Anas Ansar, Shruti Aggarwal, Swati Arya, Mohd Asim Sayeed · 6 authors

As the world enters the 21st century, the imperative of safeguarding cybersecurity has intensified. Considering the expanding dependence on information technology (IT) systems for a broad spectrum of military operations, the stakes have never been higher for thwarting successful cyberattacks. Conventional security protocols have become increasingly precarious in the face of evolving cyber threats. This necessitates the adoption of avant-garde and nascent technologies to bolster the military's cybersecurity stance. The paper delves into an array of incipient technologies that proffers the prospect of enhancing cybersecurity in the realm of defence. These include artificial intelligence (AI), machine learning (ML), blockchain, and quantum computing. AI can be leveraged to automate numerous cybersecurity functions, such as threat detection and response. ML can augment the precision of threat detection and response systems. Blockchain, a distributed ledger technology, can safeguard data and transactions. Quantum computing, a nascent technology, harbours the potential to revolutionize computation. It could be utilized to breach present-day encryption standards, thereby rendering data vulnerable to attackers. Moreover, the paper appraises the exigencies and possibilities in defence cyber security and scrutinizes the policy and practice ramifications of these emergent technologies and best practices.

Dhiah el Diehn I. Abou-Tair, Raad Haddad, Ala’ Khalifeh, Sahel Alouneh · 5 authors

Security and privacy are among the main challenges in the systems of systems. The distributed ledger technology and self-sovereign identity pave the way to empower systems and users' security and privacy. By utilizing both technologies, this paper proposes a distributed and self-sovereign-based framework for systems of systems to increase the security of such a system and maintain users' privacy. We conducted an extensive security analysis of the proposed framework using a threat model based on the STRIDE framework, highlighting the mitigation provided by the proposed framework compared to the traditional SoS security. The analysis shows the feasibility of the proposed framework, affirming its capability to establish a secure and privacy-preserving identity management system for systems of systems.

Majd Soud, Grischa Liebel, Mohammad Hamdaqa

Context:Smart contracts are prone to numerous security threats due to undisclosed vulnerabilities and code weaknesses. In Ethereum smart contracts, the challenges of timely addressing these code weaknesses highlight the critical need for automated early prediction and prioritization during the code review process. Efficient prioritization is crucial for smart contract security. Objective:Toward this end, our research aims to provide an automated approach, PrAIoritize, for prioritizing and predicting critical code weaknesses in Ethereum smart contracts during the code review process. Method: To do so, we collected smart contract code reviews sourced from Open Source Software (OSS) on GitHub and the Common Vulnerabilities and Exposures (CVE) database. Subsequently, we developed PrAIoritize, an innovative automated prioritization approach. PrAIoritize integrates advanced Large Language Models (LLMs) with sophisticated natural language processing (NLP) techniques. PrAIoritize automates code review labeling by employing a domain-specific lexicon of smart contract weaknesses and their impacts. Following this, feature engineering is conducted for code reviews, and a pre-trained DistilBERT model is utilized for priority classification. Finally, the model is trained and evaluated using code reviews of smart contracts. Results: Our evaluation demonstrates significant improvement over state-of-the-art baselines and commonly used pre-trained models (e.g. T5) for similar classification tasks, with 4.82\%-27.94\% increase in F-measure, precision, and recall. Conclusion: By leveraging PrAIoritize, practitioners can efficiently prioritize smart contract code weaknesses, addressing critical code weaknesses promptly and reducing the time and effort required for manual triage.

Dylan Yaga

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial,

Marina Shevko, Yury Yanovich, Darya Zhukova

Decentralized autonomous organizations (DAOs) offer transparency and integrity in decision-making, but their decentralized structure presents challenges during times of crisis. Our paper implements and demonstrates a solution to this issue by introducing a quasi DAO (qDAO) that allows for centralized decision-making when necessary. By modifying smart contracts and introducing new rules, we strike a balance between decentralization and centralized management, offering potential opportunities for improved crisis management in DAOs. We present a demo of our qDAO implementation on the local Ethereum testnet, along with a web application for user input. Our approach expands the possibilities of DAO administrator control while maintaining the integrity and auditability of DAO operations.

Ayman Bakr

Abstract The increasing prominence of cryptocurrencies has brought to the forefront the critical issue of security vulnerabilities, particularly the majority 51% attack. This study addresses the need for benchmarks to distinguish between vulnerable and non-vulnerable cryptocurrencies. A comprehensive literature review reveals a lack of research with the desired statistical rigor in this domain, necessitating the development of a robust model. Drawing upon mathematical modeling, this research fills the gap by proposing a susceptibility test model which incorporates essential parameters identified from literature. The model is validated with additional data to ensure its accuracy and reliability. Furthermore, k-means clustering analysis is employed to determine benchmarking thresholds, allowing for a refined categorization of cryptocurrencies based on their susceptibility levels. The findings of this study reveal five distinct clusters, each representing a unique security profile. Resilience is associated with susceptibility test values less than the critical threshold \(0.532\). In contrast, cryptocurrencies with susceptibility test values greater than 1.557 exhibit alarming vulnerability. In between, three cryptocurrency susceptibility levels are identified, ranging from moderate resilience to high vulnerability. The outcomes of this study serve as a foundation for better-informed investment decisions as well as future research endeavors, informing the development of industry best practices and policy recommendations aimed at strengthening the robustness of cryptocurrencies against malicious activities.

Petar Radanliev

<p>The first cryptocurrency was invested in 2008/09, but the Blockchain-Web3 concept is still in its infancy, and the cyber risk is constantly changing. Our cybersecurity should also be adapting to these changes to ensure security of personal data and continuation of business for organisations. This review paper starts with a comparison of existing cybersecurity standards and regulations from the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO) - ISO27001, followed by a discussion on more specific and recent standards and regulations, such as the Markets in Crypto-Assets Regulation (MiCA), Committee on Payments and Market Infrastructures and the International Organisation of Securities Commissions (CPMI-IOSCO), and more general cryptography and post-quantum cryptography, in the context of cybersecurity. These topics are followed up by a review of recent technical reports on cyber risk/security and a discussion on cloud security questions. Comparison of Blockchain cyber risk is also performed on the recent EU standards on cyber security, including European Cybersecurity Certification Scheme (EUCS) – cloud, and additional US standards – The National Vulnerability Database (NVD) Common Vulnerability Scoring System (CVSS). The study includes a review of Blockchain endpoint security, and new technologies e.g., IoT. The research methodology applied is a review and case study analysing secondary data on cybersecurity. The research significance is the integration of knowledge from the United States (US), the European Union (EU), the United Kingdom (UK), and international standards and frameworks on cybersecurity that can be alighted to new Blockchain projects. The results show that cybersecurity standards are not designed in close cooperation between the two major western blocks - US and EU. In addition, while the US is still leading in this area, the security standards for cryptocurrencies, internet-of-things, and blockchain technologies have not evolved as fast as the technologies have. The key finding from this study is that although the crypto market has grown into a multi-trillion industry, the crypto market has also lost over 70% since its peak, causing significant financial loss for individuals and cooperation’s. Despite this significant impact to individuals and society, cybersecurity standards and financial governance regulations are still in their infancy.</p>

P D Prakruthi, K Yashawanth, D. L. Chethan, Bhuvan Kumar · 7 authors

AWS is an upcoming technology along with decentralized infrastructure. This knowledge is employed in variety of different domains including cloud computing, finance, energy, messaging and others. AWS really takes up vital part in military message passing which enables certainty and safety of messages by dodging changes created to data that is collected in blocks. AWS needs the access where each user is an authorized user. In this paper we will be proposing different cryptographic techniques along with AWS technology to ensure safe and secure passage of messages between different teams in the defence sector.

Mia Dropulić

Rad ispituje glavnu hipotezu: utjecaj socio-demografskih obilježja ekonomskih agenata na ulaganje, odnosno namjeru ulaganja u kriptovalute u budućnosti. Za potrebe istraživanja glavne hipoteze postavljeno je 6 pomoćnih hipoteza koje su kroz rad testirane, a odnose se na niz socio-demografskih obilježja, a to su: spol, dob, dosadašnja najviše postignuta razina obrazovanja, razina mjesečnih primanja, stupanj financijske pismenosti ispitanika te sklonost riziku. Anketnom upitniku je putem online istraživanja pristupilo 216 ispitanika. Za testiranje pomoćnih hipoteza korišten je Chi-square test. Rezultati ovog istraživanja pokazali su da socio-demografska obilježja imaju utjecaj na ulaganje ispitanika u kriptovalute i na njihovu namjeru ulaganja u budućnosti, čime se glavna hipoteza potvrđuje. Jedino pomoćna hipoteza o razini obrazovanja ispitanika kroz rad nije potvrđena čime se zaključuje da obrazovanje ispitanika nema utjecaj na ulaganje ispitanika u kriptovalute.

Dimitrios Chatziamanetoglou, Konstantinos Rantos

Cyber threat intelligence (CTI) is contextualised knowledge, built on information that is collected, processed, analysed, and disseminated to the right audience, in order to comprehend a malicious threat actor’s motivation, goals, objectives, targets, and attack behaviours. The CTI value increases by the ability to be shared, consumed, and actioned timely, by the right stakeholders, based always on quality standards and parameters, which boost the cyber security community to understand how adversaries act and to counter the constantly emerging sophisticated cyber threats. In this article, along with the identification of research gaps, after a comparison between existing research studies in the similar scope of CTI evaluation and sharing mechanisms, we propose a blockchain-based cyber threat intelligence system architecture, which collects, evaluates, stores, and shares CTI, enabling tamper-proof data and exclusion of untrustworthy evaluation peers, while evaluating, at the same time, the quality of CTI Feeds against a defined set of quality standards. The evaluation of the data is performed utilising a reputation and trust-based mechanism for selecting validators, who further rate the CTI feeds using quality-based CTI parameters, while the consensus for preserving the fairness of the results and their final storage is performed via the recently introduced proof-of-quality (PoQ) consensus algorithm. The data, which are stored in the proposed ledger, constitute a reliable, distributed, and secure repository of CTI Feeds and contain their objective evaluation, as well as the performance of the validators who participated in each evaluation, while these data can be further used for assessing the reputation of CTI Sources. Finally, in order to assess the proposed system’s reliability, integrity, and tolerance against malicious activities, the model is subject to a theoretical analysis using a probabilistic simulation, taking into account various aspects and features of the integrated mechanisms. The results show that the tolerance against malicious validators is acceptable, even when the ratio between legitimately vs. maliciously behaving validators is 1 : 50.

Ahmed Banafa

AI as the first line of defense for cybersecurity, the goal was to keep the cyber-criminals at bay, but in case they managed to get in and infiltrate the network, we need to initiate the second line of defense – blockchain. New blockchain platforms are stepping up to address security concerns in the face of recent breaches. Transactions in the blockchain can be audited and traced. Since a blockchain system is protected with the help of ledgers and cryptographic keys, attacking and manipulating it becomes extremely difficult. Blockchain decentralizes the systems by distributing ledger data on several systems rather than storing them on one single network. The confidentiality of network members is high due to the public-key cryptography that authenticates users and encrypts their transactions. The distributed ledger ensures the protection of data against modification or destruction.

Masoud Jamshidiyantehrani, Sattar Hashemi

No abstract is available for this record.