With the frequent emergence of in-process security threats, in-process isolation has become essential for software security. While hardware security primitives enable lightweight isolation, an implicit dependency persists between permission-setting instructions and their subsequent checked instructions. To enforce this implicit dependency, modern out-of-order processors resort to enforcing strict serialization by flushing the entire pipeline during permission switches. This approach severely degrades instruction-level parallelism. Moreover, serialization leaves an exploitable security window for side-channel attacks by failing to revert speculative microarchitectural side effects.

Blockchain sharding enhances transaction throughput for vote-based blockchains while preserving system decentralization. Existing sharded blockchains can only maintain reasonable performance by tolerating a smaller magnitude of adversarial nodes compared to the upper-bound adversarial population of non-sharded ones. They lack adequate distinction of adversarial behaviors, with safety attacks posing catastrophic consequences and liveness attacks being more manageable. This paper presents WaveSpreader, a novel blockchain sharding protocol in a synchronous communication network that tolerates the same upper-bound adversarial population as non-sharded blockchains. It achieves a notable transaction throughput with the help of a robust mitigation method that effectively mitigates the liveness attacks. Our study provides a comprehensive security analysis and experimental results confirming the efficacy of WaveSpreader.

Hardware-assisted in-process compartmentalization reduces attack surface at low cost, but existing methods face practical challenges: inefficient dynamic permission management, weak metadata/instruction protection, and limited resource isolation. To tackle these problems, this paper proposes DASICS, a lightweight and efficient design of hardware-assisted in-process compartmentalization. DASICS partitions the process code segments into trusted and untrusted compartments and implements a user-mode protection runtime in the trusted compartment for dynamic permission management. It employs boundary registers to enforce dynamic access-control restrictions on instructions within different untrusted compartments. Additionally, it applies metadata access restriction, control-flow checks, and systemcall filtering for the untrusted compartments to achieve comprehensive protection. We implemented a hardware prototype of DASICS on the RISC-V XiangShan superscalar out-of-order processor and validated its effectiveness on FPGA. Our prototype increases less than 5% LUTs cost, and experimental results show that DASICS isolation incurs an average overhead of${6.02 \%}$on Memcached key-value store and 8.18% on NGINX webserver. DASICS project is publicly available at github.com/DASICS-ICT.

Abstract Smart contracts executed on blockchains are interactive programs where external actors generate events that trigger function invocations. Events can be emitted by participants asynchronously. However, some functionalities should be restricted to participants inhabiting specific roles in the system, which might be dynamically adjusted while the system evolves. We argue that current smart contract languages adopting imperative programming paradigms require additional complicated access control code. Furthermore, smart contracts are often developed and evolved independently and cannot share a joint access control policy. This makes it challenging to ensure the correctness of access control properties and to maintain correctness when the contracts are adapted. We propose using dynamic condition response (DCR) graphs for role‐based and declarative access control for smart contracts and techniques for test‐driven modelling and refinement of DCR graphs to support the safe design and evolution of smart contracts. We show that they allow for capturing and visualizing a form of dynamic access control where access rights evolve as the contract state progresses. Their use supports the straightforward declaration of access control rights, improved code auditing, test‐driven modelling, and safe evolution of smart contracts and improves users' understanding.

Harnessing the benefits of blockchain, such as decentralization, immutability, and transparency, to bolster the credibility and security attributes of federated learning (FL) has garnered increasing attention. However, blockchain-enabled FL (BFL) still faces several challenges. The primary and most significant issue arises from its essential but slow validation procedure, which selects high-quality local models by recruiting distributed validators. The second issue stems from its incentive mechanism under the transparent nature of blockchain, increasing the risk of privacy breaches regarding workers’ cost information. The final challenge involves data eavesdropping from shared local models. To address these significant obstacles, this paper proposes a Blockchain-enabled Incentivized and Secure Federated Learning (BIT-FL) framework. BIT-FL leverages a novel loop-based sharded consensus algorithm to accelerate the validation procedure, ensuring the same security as non-sharded consensus protocols. It consistently outputs the correct local model selection when the fraction of adversaries among validators is less than$1/2$with synchronous communication. Furthermore, BIT-FL integrates a randomized incentive procedure, attracting more participants while guaranteeing the privacy of their cost information through meticulous worker selection probability design. Finally, by adding artificial Gaussian noise to local models, it ensures the privacy of trainers’ local models. With the careful design of Gaussian noise, the excess empirical risk of BIT-FL is upper-bounded by$\mathcal {O}(\frac{\ln n_{\min}}{ n_{\min}^{3/2}}+\frac{\ln n}{n})$, where$n$represents the size of the union dataset, and$n_{{\min}}$represents the size of the smallest dataset. Our extensive experiments demonstrate that BIT-FL exhibits efficiency, robustness, and high accuracy for both classification and regression tasks.

Smart contracts executed on blockchains are interactive programs where external actors generate events that trigger function invocations. Events can be emitted by participants asynchronously. However, some functionalities should be restricted to participants inhabiting specific roles in the system, which might be dynamically adjusted while the system evolves. We argue that current smart contract languages adopting imperative programming paradigms require additional complicated access control code. Furthermore, smart contracts are often developed independently and cannot share a joint access control policy. We propose to use Dynamic Condition Response Graphs for role-based and declarative access control for smart contracts. We show that they allow to capture and visualize a form of dynamic access control where access rights evolve as the contract state progresses. Their use supports straight-forward declaration of access control rights, improved code auditing, programming error reduction and improves users’ understanding of smart contracts.

Blockchain sharding splits a blockchain into several shards where consensus is reached at the shard level rather than over the entire blockchain. It improves transaction throughput and reduces the computational resources required of individual nodes. But a derivation of trustworthy consensus within a shard becomes an issue as the longest chain based mechanisms used in conventional blockchains can no longer be used. Instead, a vote-based consensus mechanism must be employed. However, existing vote-based Byzantine fault tolerance consensus protocols do not offer sufficient security guarantees for sharded blockchains. First, when used to support consensus where only one block is allowed at a time (binary consensus), these protocols are susceptible to progress-hindering attacks (i.e., unable to reach a consensus). Second, when used to support a stronger type of consensus where multiple concurrent blocks are allowed (strong consensus), their tolerance of adversary nodes is low. This article proposes a new consensus protocol to address all these issues. We call the new protocol MWPoW +, as its basic framework is based on the existing Multiple Winners Proof of Work (MWPoW) protocol but includes new mechanisms to address the issues mentioned previously. MWPoW+ is a vote-based protocol for strong consensus, asynchronous in consensus derivation but synchronous in communication. We prove that it can tolerate up to f < n /2 adversary nodes in a n-node system as if using a binary consensus protocol and does not suffer from progress-hindering attacks.

Blockchain sharding protocols randomly distribute nodes to different shards. They limit the quantity of shards to ensure that the adversary remains a minority inside each shard with a high probability. There can exist only a small number of shards. In this article, we propose a new sharding protocol that links the number of shards with the adversary population in real-time instead of a fixed upper-bounded population. The protocol is a two-phase design. First, several committee shards are constructed where the majority of nodes inside each are honest with high probability; then, each committee shard randomly splits into several worker shards with a high likelihood that at least one honest node is inside each. Each worker shard handles different transactions. Worker shard blocks that did not pass the unanimous voting are collected and voted by the committee shard using the majority voting. We show that (1) in the worst case (extremely unlikely) when all the transactions need to be handled by the committee shards, the transaction throughput and the data requirement only deteriorate to the same level as classical sharded blockchain; (2) when the worker shards handle most transactions, the overall transaction throughput is zoomed by two magnitudes securely while the data requirement for nodes remains at the same level.

Time series anomaly detection is an important research topic in the field of intelligent operation and maintenance. When software systems are frequently updated with continuous integration and deployment, the distribution of KPI data will also change, and the accuracy of anomaly detection models will inevitably decrease. To tackle this problem, we propose an active anomaly detection framework named Active-MTSAD suitable for multi-dimensional time series, combining unsupervised anomaly detection and active learning. The active learning module introduces three feedback strategies, namely denominator penalty, negative penalty, and metric learning, to learn new anomalous patterns under new data distribution. In metric learning, we consider the difference between normal and abnormal samples in reconstruction error and latent space. We conduct extensive experiments on a large-scale public dataset and a real-world dataset coming from Tencent. The experimental results show that Active-MTSAD can still achieve excellent performance in real scenarios where the distribution changes with only 0.2% of labels.

BACKGROUND: Biomedical named entity recognition is one of the most essential tasks in biomedical information extraction. Previous studies suffer from inadequate annotated datasets, especially the limited knowledge contained in them. METHODS: To remedy the above issue, we propose a novel Biomedical Named Entity Recognition (BioNER) framework with label re-correction and knowledge distillation strategies, which could not only create large and high-quality datasets but also obtain a high-performance recognition model. Our framework is inspired by two points: (1) named entity recognition should be considered from the perspective of both coverage and accuracy; (2) trustable annotations should be yielded by iterative correction. Firstly, for coverage, we annotate chemical and disease entities in a large-scale unlabeled dataset by PubTator to generate a weakly labeled dataset. For accuracy, we then filter it by utilizing multiple knowledge bases to generate another weakly labeled dataset. Next, the two datasets are revised by a label re-correction strategy to construct two high-quality datasets, which are used to train two recognition models, respectively. Finally, we compress the knowledge in the two models into a single recognition model with knowledge distillation. RESULTS: Experiments on the BioCreative V chemical-disease relation corpus and NCBI Disease corpus show that knowledge from large-scale datasets significantly improves the performance of BioNER, especially the recall of it, leading to new state-of-the-art results. CONCLUSIONS: We propose a framework with label re-correction and knowledge distillation strategies. Comparison results show that the two perspectives of knowledge in the two re-corrected datasets respectively are complementary and both effective for BioNER.

Biomedical Named Entity Recognition (BioNER) is one of the most essential tasks in biomedical information extraction. Previous studies suffer from inadequate annotation datasets, especially the limited knowledge inside. This paper proposes a two-perspective named entity recognition method with Weakly Labeled (WL) data correction. Firstly, from the perspective of coverage and accuracy, we utilize PubTator and multiple knowledge bases to construct two large-scale WL datasets, which are then revised by their corresponding label correction models respectively, obtaining two high-quality datasets. Finally, we compress the knowledge in the two datasets into a BioNER model with partial label integrating. Our approach achieves new state-of-the-art performances on three BioNER datasets.

Document-level Relation Extraction (RE) is particularly challenging due to complex semantic interactions among multiple entities in a document.Among exiting approaches, Graph Convolutional Networks (GCN) is one of the most effective approaches for document-level RE.However, traditional GCN simply takes word nodes and adjacency matrix to represent graphs, which is difficult to establish direct connections between distant entity pairs.In this paper, we propose Global Context-enhanced Graph Convolutional Networks (GCGCN), a novel model which is composed of entities as nodes and context of entity pairs as edges between nodes to capture rich global context information of entities in a document.Two hierarchical blocks, Context-aware Attention Guided Graph Convolution (CAGGC) for partially connected graphs and Multi-head Attention Guided Graph Convolution (MAGGC) for fully connected graphs, could take progressively more global context into account.Meantime, we leverage a large-scale distantly supervised dataset to pre-train a GCGCN model with curriculum learning, which is then fine-tuned on the human-annotated dataset for further improving document-level RE performance.The experimental results on DocRED show that our model could effectively capture rich global context information in the document, leading to a state-of-the-art result.

Summary Blockchain sharding is a promising approach to solving the dilemma between decentralization and high performance (transaction throughput) for blockchain. The main challenge of blockchain sharding systems is how to reach a decision on a statement among a subgroup (shard) of people while ensuring the whole population recognizes this statement. Namely, the challenge is to prevent an adversary who does not have the majority of nodes globally but have the majority of nodes inside a shard. Most blockchain sharding approaches can only reach a correct consensus inside a shard with at most n/3 evil nodes in a n node system. There is a blockchain sharding approach which can prevent an incorrect decision to be reached when the adversary does not have n/2 nodes globally. However, the system can be stopped from reaching consensus (become deadlocked) if the adversary controls a smaller number of nodes. In this article, we present an improved Blockchain sharding approach that can withstand n/2 adversarial nodes and recover from deadlocks. The recovery is made by dynamically adjusting the number of shards and the shard size. A performance analysis suggests our approach has a high performance (transaction throughput) while requiring little bandwidth for synchronization.

Distributed Ledger Technology (DLT) is promising to become the foundation of many decentralised systems. However, the unbalanced and unregulated network layout contributes to the inefficiency of DLT especially in Internet of Things (IoT) environments, where nodes connect to only a limited number of peers. The data communication speed globally is unbalanced and does not live up to the constraints of efficient real-time distributed systems. In this paper, we introduce a new communication protocol, which enables nodes to calculate the tradeoff between connecting/disconnecting a peer in a completely decentralised manner. The network layout globally is continuously re-balancing and optimising along with nodes adjusting their peers. This communication protocol weakened the inequality of the communication network. The experiment suggests this communication protocol is stable and efficient.

Blockchain mining should not be a game among power oligarchs. In this paper, we present the Multiple Winners Proof of Work Protocol (MWPoW), a mining-pool-like decentralised blockchain consensus protocol. MWPoW enables disadvantaged nodes which post only a small amount of calculation resource in the mining game to create blocks together and compete with power oligarchs without centralised representatives. A precise Support Rate of blocks can be determined through the mining process; the mechanism of the mainchain determination is therefore changed and has become faster and more straightforward. A method that periodically adjusts the block size and the block interval is introduced into MWPoW, which increases the system flexibility in the changes of network conditions and data flow. Experiments suggest, without lifting calculation and bandwidth requirements, MWPoW is more attractive to disadvantaged nodes due to its mostly increased reward expectation for disadvantaged nodes. The transaction pending time is shortened chiefly, and either the block interval or the block size can be adapted amid the changes of overall network conditions.

Bitcoin-derived blockchain has shown promise as infrastructure for many decentralized models. However, problems are withholding the realization of the potentials. The booming increase of storage demand has hindered devices with storage shortage to use blockchain powered distributed applications. In this paper, we present section-blockchain, a new blockchain protocol, which is designed to solve the oversize storage problem without compromise the security of blockchain. There are no full nodes or lightweight nodes, all nodes are equal and contributing to the Section-Blockchain network. Experiments demonstrate that Section-Blockchain is efficient, remarkably reduced the storage, and withstand sudden nodes losing of massive scale. Section-blockchain also extended the capability of blockchain to the foundation of an autotrophic, tamper-resist decentralized storage system, in which, data can be equidistributional distributed worldwide automatically without any centralized dispatcher to assign storage; nodes are motivated to change their local storage to receive more remuneration. The global storage distribution is continuously optimizing and fit into any adding/losing nodes.