Due to the immutable nature of smart contracts, online contract diagnosis is the only viable approach for revealing vulnerabilities in deployed contracts. Existing online approaches face significant challenges in terms of efficiency, adaptability, and reliance on vulnerability labels. This paper proposes ConWatcher+, a new adaptive and label-efficient online contract diagnosis framework from the diffusion perspective, which is capable to detect yet unknown attacks under evolving tactics without reliance on vulnerability labels. ConWatcher+ simulates the Advanced Persistent Threat (APT) tactics commonly used in yet unknown attacks by continuously applying minor perturbations to legitimate interaction behaviors. It then reversely learns the denoising process, guided by potential logic vulnerabilities (i.e., functionality dependencies), to adaptively identify stealthy anomalies and detect yet unknown attacks without needing vulnerability labels. ConWatcher+ proceeds in five steps. First,real-time data extraction. We design a cost-effective contract runtime information collector, incorporating on-demand data retrieval and event-driven data update mechanisms to reduce communication overhead in online contract diagnosis. Second,interaction behavior modeling. Via bytecode-level, account-level, revenue-level modeling, and side-channel level behavior modeling, we propose behavior-aware multivariate time series model to accurately represent long-term contract interactions with multi-faceted behaviors. Third,APT-like noise adding. We leverage the forward diffusion model to produce minor and stochastic APT-like noises with efficiency. Fourth,reverse denoising learning. To effectively guide reverse denoising using functionality dependencies, we devise an adaptive contract-level analysis engine equipped with heterogeneous control flow graph modeling and heterogeneous message passing mechanisms to extract function-level and bytecode-level functionality dependencies. Last,contract anomaly detection. We establish a label-efficient attack detector based on reconstruction error for contract anomaly detection. It combines complex dependency analysis and deterministic inference to ensure high-quality data reconstruction and low detection latency. Extensive empirical validations on a manually constructed dataset, covering both mainstream and novel vulnerabilities, demonstrate ConWatcher+’s effectiveness, adaptability, and label efficiency, with an average F1-score of 0.92 across all types of attacks without prior knowledge of corresponding vulnerabilities.

Network Intrusion Detection Systems (NIDSs) have emerged as a frontline defense against potential attacks in wireless Internet of Things (IoT) networks. However, existing machine learning methods follow an unstructured data processing patterns and can barely incorporate all information due to the network dynamicity as well as data imbalance. In this study, we propose Graph Isomorphism Network model based on Edge (GINE), an innovative graph-based algorithm tailored to pinpoint malicious network traffic within wireless IoT networks. Specifically, we initiate by presenting the wireless IoT network graph, capturing the global topological interactions of its edges. Subsequently, we design an edge representation learning algorithm, capable of encoding network data frames in a discerning pattern-aware manner. Moreover, we integrate a data interpolation module into the edges of our structured graph data targeting at data imbalance, which fosters a more balanced distribution across the various classes of edges. Our empirical analysis on select wireless IoT intrusion datasets shows GINE’s superiority, consistently outperforming state-of-the-art methods in classification metrics, including accuracy, F1-Score, False Alarm Rate, etc. Through a simulated wireless environment, we demonstrate GINE’s robust scalability, even in unpredictable wireless networks.

The Public Key Infrastructure (PKI) system is the cornerstone of today's security communications. All users in the service domain covered by the same PKI system are able to authenticate each other before exchanging messages. However, there is identity isolation in different domains, making the identity of users in different domains cannot be recognized by PKI systems in other domains. To achieve cross-domain authentication, the consortium blockchain system is leveraged in the existing schemes. Unfortunately, the consortium blockchain-based authentication schemes have the following challenges: high cost, privacy concerns, scalability and economic unsustainability. To solve these challenges, we propose a scalable and privacy-preserving cross-domain authentication scheme called Bifrost-Auth. Firstly, Bifrost-Auth is designed to use a decentralized oracle to directly interact with blockchains in different domains instead of maintaining a consortium blockchain and enables mutual authentication for users lying in different domains. Secondly, users can succinctly authenticate their membership of the domain by the accumulator technique, where the membership proof is turned into zero knowledge to protect users' privacy. Finally, Bifrost-Auth is proven to be secure against various attacks, and thorough experiments are carried out and demonstrate the security and efficiency of Bifrost-Auth.