Blockchain Papers

Ah-hyun Park, Hyejin Ryu, Woobeen Park, Doowon Jeong

No abstract is available for this record.

Hui Zuo, Yadong Shi, Zhongyuan Qin, Xuxian Jiang

Code similarity detection is crucial for conducting security audits on smart contracts. It enables important audit tasks such as vulnerability mining and malicious contract detection based on code similarity. However, as the majority of smart contracts on Ethereum do not share their source code, detecting code similarity based on bytecode is of great significance. This paper proposes a method for self-supervised learning-based bytecode similarity detection, which obtains the control flow graph (CFG) from the bytecode in a symbolic way by simulating the execution of all instructions on the Ethereum Virtual Machine. Similarity detection is then performed at the function level. The proposed method utilizes a self-supervised model to obtain features from the bytecode and combines them with the features obtained from the stack when generating CFG to detect bytecode similarity. Experimental results demonstrate that the proposed method outperforms the baseline in terms of performance.

Akhila Reddy Yadulla, Mounica Yenugula, Vinay Kumar Kasula, Bhargavi Konda · 6 authors

This paper introduces the Time-Aware LSTM (T-LSTM) model to identify criminal activities involving USDT on wallet addresses within the blockchain ecosystem. The model utilizes a time-aware LSTM architecture to learn the continuous variations in node address features over different transaction time intervals. Additionally, a gating mechanism filters the influence intensity of neighboring transaction node addresses on the central node. The gating mechanism accounts for the transactional correlation strength between node addresses. Finally, a self-attention mechanism is employed to integrate node address features across various transaction timestamps, producing a comprehensive feature representation for the addresses. Experimental results demonstrate that the T-LSTM model effectively captures the dynamic feature changes of node addresses over irregular transaction intervals, outperforming traditional detection models regarding precision, recall, and F1 score on the test set.

Sahil Dudani, Ibrahim Baggili, David Raymond, Randolph Marchany

No abstract is available for this record.

Wenjing Yin

The rapid digital revolution in recent decades has resulted in an overwhelming amount of information, particularly in the realm of modern education systems and related materials. This phenomenon, often referred to as information overload, necessitates the development of educational systems that can effectively search, classify, and categorize this vast amount of available information. Of utmost importance for such educational information systems is the safeguarding of personal data, which refers to information that can identify an individual or their family. School records, for example, contain various types of personal data such as the individual’s name, address, contact details, disciplinary history, as well as their grades and progress checks. Even if individuals choose to make this data public, it remains inherently personal. Another category of data involves more sensitive topics such as student biometrics (e.g. fingerprints, photographs), religious beliefs, health information (e.g. allergies), or dietary restrictions, which may imply religious or health-related aspects. Processing data in this category can pose risks to individuals; hence, strict rules and appropriate consent are necessary to ensure their protection. To address these challenges, this research paper proposes a zero-knowledge proof intelligent recommendation system designed to protect students’ data privacy in the digital age. The proposed method incorporates an Intelligent Recommendation System (IRS) that utilizes an optimized version of the Matrix Factorization technique, calculated as an Eulerian Walk chart. Furthermore, the Schnorr Zero-Knowledge Proof format, based on the discrete logarithm problem, ensures the privacy of personal data during message exchange between educational entities.

Frederik Temmermans, Sabrina Caldwell, Symeon Papadopoulos, Fernando Pereira · 5 authors

Advances in media content manipulation and artificially generated content pose new challenges to the assessment of media authenticity. While automated detection methods can provide meaningful insights and decision support in some scenarios, they cannot provide trustworthy and comprehensive information about the origin and provenance of media assets. Therefore, a longer-term approach should rather focus on secure and interoperable annotations related to the creation and provenance of media. In October 2020, the JPEG Committee initiated a standardization exploration named "JPEG Fake Media" to address these needs. Subsequently, since many of the requirements, for example related to secure annotation and identification of media assets, are also relevant to achieve interoperability in Non-Fungible Tokens (NFTs) an additional exploration was initiated, specifically focused on standardization needs for NFTs. In April 2022 a first Call for Proposals on JPEG Fake Media was issued. Based on the responses to the call, a new standardization project named JPEG Trust was initiated to specify an interoperable framework for establishing trust in media production, distribution, and consumption. This paper presents the journey of JPEG to leverage formal methods of standardization in this context, starting from the initial JPEG Fake Media exploration, followed by the subsequent consideration of NFT use cases and requirements, through to the commencement of the new JPEG Trust international standard.

Chuan Chen, Zhenpeng Wu, Yanyi Lai, Wenlin Ou · 6 authors

Artificial Intelligence Generated Content (AIGC) is one of the latest achievements in AI development. The content generated by related applications, such as text, images and audio, has sparked a heated discussion. Various derived AIGC applications are also gradually entering all walks of life, bringing unimaginable impact to people's daily lives. However, the rapid development of such generative tools has also raised concerns about privacy and security issues, and even copyright issues in AIGC. We note that advanced technologies such as blockchain and privacy computing can be combined with AIGC tools, but no work has yet been done to investigate their relevance and prospect in a systematic and detailed way. Therefore it is necessary to investigate how they can be used to protect the privacy and security of data in AIGC by fully exploring the aforementioned technologies. In this paper, we first systematically review the concept, classification and underlying technologies of AIGC. Then, we discuss the privacy and security challenges faced by AIGC from multiple perspectives and purposefully list the countermeasures that currently exist. We hope our survey will help researchers and industry to build a more secure and robust AIGC system.

Sanket Pawar, Shubham Lahane, Omkar Mandhare, Nabilal Begade · 6 authors

Abstract: Electronic First Information Report (e-FIR) is a document filed to the police stations by a victim or accuser when offense is committed. In traditional e-FIR databases, offense’s records can be tampered because of its centralized nature. Also intentional false e-FIR can be registered. Thus, data transparency and integrity is big concern. To overcome this problem e-FIR with decentralized blockchain system can be integrated with e-FIR portal. The main characteristics of the blockchain technology are advanced security and decentralized system. This technology uses the encrypted blocks to make FIR data secured. Proof of Stake (PoS) protocol is used in this system. Users have to submit e-FIR through portal which will be stored in blocks in blockchain. Due to advanced security feature of system, data tampering will be prevented. Integrating such FIR registration system will ensure transparency and enhance data integrity.

Yixiao Gao, Muhammad Saad, Adam Oest, Jean Zhang · 6 authors

Recent years have witnessed the increasing popularity and market value of Non-Fungible Tokens (NFTs), along with the burgeoning of blockchains and metaverse. The media hypes often imply that NFTs are as secure as the underlying blockchains. In this work, we take a first look into the building blocks of NFTs (i.e., ownership certificates stored on-chain and the metadata and digital assets stored on-chain or off-chain), focusing on understanding the new attack surface and safety of these digital assets (rather than the traditional attacks on block-chains). For this purpose, we provide a detailed analysis of the logical structure of the dominant off-chain NFTs, followed by the attack surface analysis. Our study indicates that specific new attacks could be easily mounted on them. To validate our findings, we experiment by minting our own NFTs on Ethereum and demonstrate that we can successfully mount the attacks with trivial or even no cost. The cause of these new attacks is rooted in the current design of NFTs where the digital assets are decoupled from the contracts deployed on the blockchains. We discuss some future research to address these vulnerabilities.

Muhammad Nur Adhar, Yudi Prayudi, Erika Ramadhani

Cryptocurrency adalah teknologi sistem kriptografi yang bertujuan untuk mengamankan dan mengatur otoritas dengan menggunakan sistem desentralisasi untuk mengelola pengeluaran unit baru, mencatat transaksi, dan memberikan jaminan keamanan yang tidak dapat diduplikasi atau ditiru. Oleh karena itu, tidak diragukan lagi bahwa penjahat juga telah menggunakan Bitcoin dalam aktivitas ilegal seperti menerima pembayaran dalam kasus pemerasan online, membayar obat-obatan terlarang, insiden ransomware, mendanai terorisme, transaksi di pasar darknet, dan pencucian uang. Kejahatan yang dilakukan dengan menggunakan dompet crypto sebagai wadah berperan dalam tantangan untuk membuktikan dan menganalisis objek digital yang tersimpan di smartphone. Penelitian ini berfokus pada penemuan artefak digital dari perangkat smartphone berdasarkan fakta atau informasi yang diperoleh dari instruksi smartphone. Untuk menemukan bukti digital dari aplikasi dompet cryptocurrency smartphone menggunakan metode DFRWS dan alat oksigen forensik. Berdasarkan hasil penelitian, diperoleh beberapa aktivitas transaksi dompet cryptocurrency tokocrypto. Informasi yang terdapat pada transaksi deposit fiat, penarikan fiat, penarikan crypto, dan penjualan crypto serta beberapa label tidak terdapat pada beberapa transaksi yaitu jenis transaksi, Order Id, Txid, dan alamat wallet.Cryptocurrency adalah teknologi sistem kriptografi yang bertujuan untuk mengamankan dan mengatur otoritas dengan menggunakan sistem desentralisasi untuk mengelola pengeluaran unit baru, mencatat transaksi, dan memberikan jaminan keamanan yang tidak dapat diduplikasi atau ditiru. Oleh karena itu, tidak diragukan lagi bahwa penjahat juga telah menggunakan Bitcoin dalam aktivitas ilegal seperti menerima pembayaran dalam kasus pemerasan online, membayar obat-obatan terlarang, insiden ransomware, mendanai terorisme, transaksi di pasar darknet, dan pencucian uang. Kejahatan yang dilakukan dengan menggunakan dompet crypto sebagai wadah berperan dalam tantangan untuk membuktikan dan menganalisis objek digital yang tersimpan di smartphone. Penelitian ini berfokus pada penemuan artefak digital dari perangkat smartphone berdasarkan fakta atau informasi yang diperoleh dari instruksi smartphone. Untuk menemukan bukti digital dari aplikasi dompet cryptocurrency smartphone menggunakan metode DFRWS dan alat oksigen forensik. Berdasarkan hasil penelitian, diperoleh beberapa aktivitas transaksi dompet cryptocurrency tokocrypto. Informasi yang terdapat pada transaksi deposit fiat, penarikan fiat, penarikan crypto, dan penjualan crypto serta beberapa label tidak terdapat pada beberapa transaksi yaitu jenis transaksi, Order Id, Txid, dan alamat wallet.

Peng Qian, Jianting He, Lingling Lu, Siwei Wu · 8 authors

Recent years have witnessed explosive growth in blockchain smart contract applications. As smart contracts become increasingly popular and carry trillion dollars worth of digital assets, they become more of an appealing target for attackers, who have exploited vulnerabilities in smart contracts to cause catastrophic economic losses. Notwithstanding a proliferation of work that has been developed to detect an impressive list of vulnerabilities, the bad randomness vulnerability is overlooked by many existing tools. In this paper, we make the first attempt to provide a systematic analysis of random numbers in Ethereum smart contracts, by investigating the principles behind pseudo-random number generation and organizing them into a taxonomy. We also lucubrate various attacks against bad random numbers and group them into four categories. Furthermore, we present RNVulDet - a tool that incorporates taint analysis techniques to automatically identify bad randomness vulnerabilities and detect corresponding attack transactions. To extensively verify the effectiveness of RNVulDet, we construct three new datasets: i) 34 well-known contracts that are reported to possess bad randomness vulnerabilities, ii) 214 popular contracts that have been rigorously audited before launch and are regarded as free of bad randomness vulnerabilities, and iii) a dataset consisting of 47,668 smart contracts and 49,951 suspicious transactions. We compare RNVulDet with three state-of-the-art smart contract vulnerability detectors, and our tool significantly outperforms them. Meanwhile, RNVulDet spends 2.98s per contract on average, in most cases orders-of-magnitude faster than other tools. RNVulDet successfully reveals 44,264 attack transactions. Our implementation and datasets are released, hoping to inspire others.

Borase Bhushan Gulabrao, Digvijaysinh Rathod

In the last decade, use of cryptocurrencies in various fields has increased phenomenally. It offers many benefits to the users. It also has emerged as one of the major challenges for law enforcement agencies across the world. Research has been conducted to identify forensic artefacts for various cryptocurrencies used in different wallets and on different platforms. This paper aims to analyse and sum up the existing literature on forensic investigation of cryptocurrencies. This review paper makes mention of forensic investigation of six different cryptocurrencies, 30 different types of wallets and 49 different types of forensic artefacts. It also mentions 25 different tools used in forensic investigation. The paper briefs about seven different cryptocurrency visualisation and analysis tools. Finally, the paper highlights research gaps in this field.

Anyu Yang

Cryptocurrency represented by Bitcoin is a very popular topic in recent years. However, the prosperity of cryptocurrency drives an increasing number of applications published. Some malicious or vulnerable programs are also detected and reported these years. To do a deeper study into security of cryptocurrency application, this paper learns common vulnerabilities, threat models inside normal applications, and taint analysis, a useful vulnerability-detecting tool, concludes a common and useful methodology for threat detection in application programs, especially Android apps. This approach uses static taint analysis to detect vulnerabilities inside a given Android application, classify them into common vulnerability categories and then make conclusions. This paper does research in analyzing statistics of threats in common cryptocurrency apps in Google play store and draw conclusions on the status of cryptocurrency software as well. Finally, some suggestions are provided at the end of this paper. These recommendations apply to application programmers, app store administrators, scholars and experts in related area, government officer and users. This set of analysis process can be applied to analyze any type of application programs.

Pardon Ramazhamba, Hein S. Venter

Abstract The South African Local Government (SALG) uses the tendering system to procure goods and services. Some of these tendering projects are aimed at promoting socio-economic and industrial policies. Hence, the tendering system used by SALG should be fair, transparent, competitive, cost-effective, equitable, and free from corruption. However, the mismanagement of the tendering system might lead to interruption of operations, late service delivery, rising costs, and most importantly, fraud and corruption. The use of paperwork to share project information might lead to the mismanagement of the tendering project because it might contribute towards illicit altering of project information during the process. The purpose of this study is to develop a Blockchain prototype that might be used to securely share project information with all the parties interested in the tendering project. It is recommended that the adoption of the proposed solution will enable various organisations to have access to real-time data, allowing them to have access to the entire project history regardless of their geographical location. Access to real-time data would promote real-time auditing and digital forensic investigations because both auditors and investigators will have access to credible digital evidence or project information of their interest in real-time.

Sunardi Sunardi, Ridho Surya Kusuma

Digital evidence plays an essential role in meeting the forensic need to uncover cybercrime and search for trace information of perpetrators. Digital evidence is vulnerable to system changes, human error, theft, deletion, and data manipulation, requiring security efforts to maintain authenticity. This study offers optimization of the chain of custody systems to maintain digital evidence integrity using authentication applications connected to the website server database. The design of the chain of custody system uses blockchain technology and K-means clustering algorithm. This research process consists of two stages. The first stage is the prototype of blockchain-based user access authentication applications. The second stage is the implementation of K-means clustering to determine the place of data storage according to its classification. The results of this study are the maximum security for blockchain-based chain of custody with the efficiency value of this application of 94.73% and the system load value of 0.223%. The total cost of deploying the application is 0.026702786 ETH. Based on this research can help to secure digital evidence information.

Philip Garnett

There has been a lot of hype around blockchains and non fungible tokens (NFTs). However the technology is yet to establish itself beyond a limited number of fairly specific use cases, namely cryptocurrency and digital art. This commentary seeks to propose an outline framework for NFTs and Blockchains for digital provenance of important digital artifacts such as citizen intelligence and newspapers. This article develops an outline framework and reasoning for NFT and Blockchain technology to be used to establish provenance of digital artifacts in what is an increasingly contested digital space. A space where the subtle (and perhaps not so subtle) manipulation of video, images, and all forms of digital evidence and documents by humans, and increasingly artificial intelligence, could be used to challenge contemporary narratives and manipulate the past. This framework should be seen as an opening proposal to ignite discussion, as the establishment of any technology in this space should not be done without careful consideration. Nor should it be done by a single individual or group.

Tianyuan Hu, Jingyue Li, Bixin Li, André Storhaug

As smart contracts process digital assets, their security is essential for blockchain applications. Many approaches have been proposed to detect smart contract vulnerabilities. Studies show that few of the reported vulnerabilities are exploited and hypothesize that many of the reported vulnerabilities are false positives. However, no follow-up study is performed to confirm the hypothesis and understand why the reported vulnerabilities are not exploited. In this study, we first collect 136,969 unique real-world smart contracts and analyze them using four vulnerability detectors, namely Oyente, SmartCheck, Slither, and SolDetector. Then, we apply Strauss’ grounded theory approach to manually analyze the source code of the smart contracts reported as vulnerable to recognizing false positives and understand the reasons for false results. In addition, we analyze the transaction logs of the smart contracts reported as vulnerable to identifying and understanding their exploitations. Our results show that 75.37% of the 4,364 smart contracts reported as vulnerable are false positives, and eleven reasons are causing the false positives. After analyzing the 4,106,134 transaction logs of the contracts reported as vulnerable, we find that vulnerabilities of only 67 (0.015%) of the contracts have been exploited in history. We also identify six reasons for demotivating and preventing the attackers from exploiting the vulnerabilities. Our results reveal that state-of-the-art smart contract vulnerability detectors primarily treat the smart contracts as yet another application developed using Object Oriented (OO) languages when analyzing and reporting the smart contract vulnerabilities. Without considering the specific design principles of the Solidity programming language and the characteristics of smart contracts’ application scenarios and execution environments, many of the reported vulnerabilities are not exploitable or not cost-effective to be exploited by adversaries.

C P Shilpa, A. H. Shanthakumara

Crime is an unlawful act and is punished by the authority, in order to prove crime, evidence is necessary. Evidence obtained from crime scene is crucial as it act as proof of crime, Digitalization of evidences is need of hour. During the entire process of investigation heterogenous format of data is generated and integrity of the sensitive data has to be maintained as sensitive data passes through the various levels of intermediaries forming Chain of Evidences (CoE). Evidence needs to be tramper proof and should be protected from any kind of alterations. In order to build strong system with immutability, integrity, and legitimacy features blockchain technology is more suitable. The digital evidence can be transferred in a transparent way between the parties involved without any central authority using blockchain technology. This paper focuses on how blockchain based solutions can help in building a strong secure system. The system is implemented using Ethereum platform to achieve integrity, immutability transparency as well as tampering can be identified by any one at any time.

Hoang Viet Anh Le, Quoc Duy Nam Nguyen, Thi Hong Tran, Tadashi Nakano

No abstract is available for this record.

Jatkola, Kaisa

The verification of the integrity of data recorded on blockchains is a disregarded challenge. The limitations of blockchains to provide verification mechanisms suggest the necessity to extend the data provenance verification further back into the real-world infrastructure. The deployment of blockchain in critical areas handling sensitive data, such as healthcare machines, motivates the development of such measures. The purpose of this thesis is to explore blockchains in real-world medical applications. The implementation introduces a mechanism to establish a link between real-world medical systems and blockchains by utilizing mechanisms such as Non-Fungible Tokens (NFT), Trusted Platform Module (TPM), and remote attestation. This thesis provides practical insight into the design of blockchain applications with the requirement of digital twin-like properties. In conclusion, TPM and remote authentication mechanisms can be used to verify the integrity of devices and the data they generate. However, the overall architecture of blockchains and the required infrastructure are still lacking. Thus, more investigation is required to understand the actual utility of blockchains.

Shi Chen, Yong Guan

No abstract is available for this record.

Ahmed Bouzid, Paolo Narciso, Steve Wood

As we stand on the precipice of a new era, the digital age continues to redefine our lives in ways that were once beyond imagination. One revolutionary concept that has rapidly entered mainstream consciousness is that of non-fungible tokens, or NFTs.

Chuan Chen, Yuecheng Li, Zhenpeng Wu, Chengyuan Mai · 8 authors

Metaverse, the core of the next-generation Internet, is a computer-generated holographic digital environment that simultaneously combines spatio-temporal, immersive, real-time, sustainable, interoperable, and data-sensitive characteristics. It cleverly blends the virtual and real worlds, allowing users to create, communicate, and transact in virtual form. With the rapid development of emerging technologies including augmented reality, virtual reality and blockchain, the metaverse system is becoming more and more sophisticated and widely used in various fields such as social, tourism, industry and economy. However, the high level of interaction with the real world also means a huge risk of privacy leakage both for individuals and enterprises, which has hindered the wide deployment of metaverse. Then, it is inevitable to apply privacy computing techniques in the framework of metaverse, which is a current research hotspot. In this paper, we conduct comprehensive research on the necessity, taxonomy and challenges when privacy computing meets metaverse. Specifically, we first introduce the underlying technologies and various applications of metaverse, on which we analyze the challenges of data usage in metaverse, especially data privacy. Next, we review and summarize state-of-the-art solutions based on federated learning, differential privacy, homomorphic encryption, and zero-knowledge proofs for different privacy problems in metaverse. Finally, we show the current security and privacy challenges in the development of metaverse and provide open directions for building a well-established privacy-preserving metaverse system. For easy access and reference, we integrate the related publications and their codes into a GitHub repository: https://github.com/6lyc/Awesome-Privacy-Computing-in-Metaverse.git.

T. Sathya, N Keertika, Sirikonda Shwetha, Deepti Upodhyay · 5 authors

In recent years, ransomware attacks have become a more significant source of computer penetration. Only general-purpose computing systems with sufficient resources have been harmed by ransomware so far. Numerous ransomware prediction strategies have been published, but more practical machine learning ransomware prediction techniques still need to be developed. In order to anticipate ransomware assaults, this study provides a method for obtaining data from artificial intelligence and machine learning systems. A more accurate model for outcome prediction is produced by using the data science methodology. Understanding the data and identifying the variables are essential elements of a successful model. A variety of machine learning algorithms are applied to the pre-processed data, and the accuracy of each technique is compared to determine which approach performed better. Additional performance indicators including recall, accuracy, and f1-score are also taken into account while evaluating the model. It uses machine learning to predict how the ransomware attack would pan out.