Eclipse attacks isolate blockchain nodes by monopolizing their peer-to-peer connections. The attacks were extensively studied in Bitcoin (SP'15, SP'20, CCS'21, SP'23) and Monero (NDSS'25), but their practicality against Ethereum nodes remains underexplored, particularly in the post-Merge settings.

Cryptomining poses significant security risks, yet traditional detection methods like blacklists and Deep Packet Inspection (DPI) are often ineffective against encrypted mining traffic and suffer from high false positive rates. In this paper, we propose a practical encrypted cryptomining traffic detection mechanism. It consists of a two-stage detection framework, which can effectively provide fine-grained detection results by machine learning and reduce false positives from classifiers through active probing. Our system achieves an F1-score of 0.99 and identifies specific cryptocurrencies with a 99.39% accuracy rate. Extensive testing across various mining pools confirms the effectiveness of our approach, offering a more precise and reliable solution for identifying cryptomining activities.

Many tracking companies collect user data and sell it to data markets and advertisers. While they claim to protect user privacy by anonymizing the data, our research reveals that significant privacy risks persist even with anonymized data. Attackers can exploit this data to identify users' accounts on other websites and perform targeted identity alignment. In this paper, we propose an effective identity alignment scheme for accurately identifying targeted users. We develop a data collector to obtain the necessary datasets, an algorithm for identity alignment, and, based on this, construct two types of de-anonymization attacks: thepassive attack, which analyzes tracker data to align identities, and theactive attack, which induces users to interact online, leading to higher success rates. Furthermore, we introduce, for the first time, a novel evaluation framework for online tracking-based identity alignment. We investigate the key factors influencing the effectiveness of identity alignment. Additionally, we provide an independent assessment of our generated dataset and present a fully functional system prototype applied to a cryptocurrency use case.

Although many scalable event matching algorithms have been proposed to achieve scalability for publish/subscribe services, the content-based pub/sub system still suffer from performance deterioration when the system has large numbers of subscriptions, and cannot support the requirements of real-time pub/sub data services. In this paper, we model the event matching problem as an existence problem which only care about whether there is at least one matching subscription in the given subscription set, differing from existing works that try to speed up the time-consuming search operation to find all matching subscriptions. To solve this existence problem efficiently, we propose DLS (Discrete Label Set), a novel subscription and event representation model. Based on the DLS model, we propose an event matching algorithm withO(Nd)time complexity to support real-time event matching for a large volume of subscriptions and high event arrival speed, whereNdis the node degree in overlay network. Experimental results show that the event matching performance can be improved by several orders of magnitude compared with traditional algorithms.

Cryptomining behaviours pose severe security threats to campus network. However, existing blacklist and DPI-based techniques suffer from delayed blacklist updates and inability to identify encrypted cryptomining traffic. Furthermore, existing encrypted cryptomining traffic detection schemes usually fail to provide detailed information about cryptomining behaviours and do not have a solution to deal with false positives caused by detection models. To meet the needs of campus networks and solve the problems of existing work, this paper proposes an effective and practical encrypted cryptomining traffic detection mechanism in campus network. It consists of a two-stage detection framework, which can effectively provide fine-grained detection results by machine learning and reduce false positives from classifiers through active probing. Based on our collected dataset and extracted time series features, our classifiers detect mining traffic with an 0.99 F 1 score and identify the cryptocurrency being mined with $99.39 \%$ correct recognition rate. Unlike existing schemes, we perform active probing after the traffic classification to reduce false positives. Futhermore, we have extensively evaluated the active probing scheme to verify its effectiveness for different mining pools.

Abstract Publish/subscribe(pub/sub) systems are widely used in large-scale messaging systems due to their asynchronous and decoupled nature. With the population of pub/sub cloud services, the privacy protection problem of pub/sub systems has started to emerge, and events and subscriptions are exposed when executing event matching on untrustworthy cloud brokers. However, as the number of subscriptions increases, the effectiveness of the previous confidentiality protection approaches declines drastically. In this paper, we propose SBM (scalable blind matching), an effective confidentiality protection scheme for pub/sub systems. To the best of our knowledge, SBM is the first scheme that applies order-preserving encryption algorithm to protect the system’s confidentiality and ensure its scalability. In this scheme, SBM-I is highly effective in subscription matching but is unable to achieve ideal security IND-OCPA, whereas SBM-II is suggested to ensure system security and SGX is used to reduce interaction and boost ciphertext matching performance. The experiment demonstrates that this method has better matching performance compared to others: the average matching time of SBM-I is 3–4 orders of magnitude faster than the matching algorithm MP and SGX-based algorithm SCBR when the number of subscriptions is 500,000, and the average matching time of SBM-II is 40 times faster than MP and 24 times than SCBR.

Content-based publish/subscribe cloud services are prevailing recently. Confidentiality in publish/subscribe cloud services has become a major concern, especially for applications with sensitive data. Many methods have been proposed to achieve the confidentiality of events and subscriptions. Unfortunately, all these approaches suffer significant performance deterioration while matching on large-scale subscription set. In this paper, we propose an efficient ciphertext matching scheme called SBM. To the best of our knowledge, SBM is the first approach which can preserve confidentiality while at the same time provide scalable event matching. Furthermore, we have integrated SBM with an open source publish/subscribe middleware, PADRES and conducted extensive experiments to evaluate our scheme. The experimental results demonstrate that the matching speed of our solution is faster by two orders of magnitude than its counterparts.

IoT (Internet of Things) bridges the physical world and information space. IoT services are environment sensitive and event-driven. The new IoT service architecture should adapt to these features. This paper analyses IoT sensing service characteristics and proposes the future services architecture. It is focused on the middleware architecture and the interface presentation technology. In the middleware layer, the traditional SOA architecture is insufficient in the real-time response and parallel process of services execution, this paper proposes that the new sensing service system based on EDSOA (Event Driven SOA) architecture to support real-time, event-driven, and active service execution. At presentation layer, this paper presents the new IoT browser features including using augmented reality technology to input and output, and realize the superposition presentation of the physical world and abstract information. Through a use case and proof-of-concept implementation-road manhole covers monitoring system - we verify the feasibility of the proposed ideas and frameworks.