Mixing services run on blockchain trading systems, enhancing the transaction privacy of blockchain users. Yet, in recent years, the mixing services provide fertile ground for concealing illicit fund flows. Therefore, security experts make great efforts to find an effective de-anonymization of mixing services. Unfortunately, current de-anonymization technologies are constrained by a fundamental issue, i.e., the lack of a comprehensive, extensive, and reliably labeled benchmark dataset. To address this problem, we propose a new method for acquiring mixing transaction data. We design and implement a method named TGweaver, which actively executes the complete mixing workflow within a simulated blockchain environment. Furthermore, to enhance the realism of the dataset, we introduce a ''behavioral fingerprint'' mapping strategy. Ultimately, the proposed dataset includes over 891K transactions, scaling existing benchmark sizes by 2 to 4 orders of magnitude. In experiments, we use the proposed data to systematically evaluate existing de-anonymization techniques. Experimental results reveal that the current mixing address linking methods, based on heuristic rules, lacks generalization capability in complex scenarios, exhibiting low precision. In contrast, the methods utilizing supervised learning demonstrate significant advantages.

Solana is a rapidly evolving blockchain platform that has attracted an increasing number of users. However, this growth has also drawn the attention of malicious actors, with some phishers extending their reach into the Solana ecosystem. Unlike platforms such as Ethereum, Solana has distinct designs of accounts and transactions, leading to the emergence of new types of phishing transactions that we term SolPhish. We define three types of SolPhish and develop a detection tool called SolPhishHunter. Utilizing SolPhishHunter, we detect a total of 8,058 instances of SolPhish and conduct an empirical analysis of these detected cases. Our analysis explores the distribution and impact of SolPhish, the characteristics of the phishers, and the relationships among phishing gangs. Particularly, the detected SolPhish transactions have resulted in nearly $1.1 million in losses for victims. We report our detection results to the community and construct SolPhishDataset, thefirstSolana phishing-related dataset in academia.

In recent years, blockchain technology has developed rapidly and received widespread attention. However, its pseudonymous and decentralized nature has also attracted many criminal activities. Ponzi schemes, a kind of classic financial scam, also hide their true face in smart contracts, causing massive financial losses to blockchain users. Although several methods have been proposed to detect Ponzi contracts, there are still limitations in broad applicability, semantics understanding, and adversarial robustness. In this article, we propose PonziHunter, an intelligent framework for hunting Ponzi contracts on Ethereum. To tackle the problem of broad applicability, we train a detection model that does not require expert experience based on publicly available on-chain bytecode and off-chain contract labels. To tackle the problem of semantics understanding, we employ cross-function control flows and state variable dependencies to understand the logic of Ponzi contracts. Specifically, we decompile bytecodes into higher-order representations to analyze control flows and state variable dependencies and model the information as graph data. By combining the idea of code slicing, we identify the basic blocks related to Ponzi contract recognition. To tackle the problem of adversarial robustness, we model Ponzi contract recognition as a graph classification problem based on contrastive pre-training. We propose a data augmentation method for control flow graphs (CFGs), which preserves the basic blocks related to Ponzi contract recognition as much as possible during data perturbation. Experimental results show that PonziHunter outperforms state-of-the-art tools with average improvements of at least 4.77% on real-world ground-truth data and can newly discover 85 Ponzi contracts in the wild. More importantly, PonziHunter is robust against adversarial examples and can locate the critical basic blocks for smart Ponzi detection.

Smart contracts are self-executing computer programs on blockchains. With the development of blockchain technology, the number of smart contracts has grown rapidly, as has the concern for their security. Regrettably, inconsistencies between the logic implemented in the code and the intentions described in the comments, known as Code–Comment Inconsistencies (CCI), are frequently present in some smart contracts. These inconsistencies can mislead readers in understanding the contract code and, in severe cases, may lead to vulnerabilities and economic losses. Existing learning-based methods are not tailored for smart contract languages, overlook the issue of insufficient context information caused by comment references and nested intentions, and rely on large-scale labeled data; whereas rule-based methods struggle to accommodate the flexibility with which developers express intentions, often resulting in false positives. To tackle the challenges posed by insufficient context information and the scarcity of labeled data, we introduce CCIHunter, a tool designed to detect CCIs in smart contracts. CCIHunter addresses the issue of insufficient context information during data modeling and incorporates a two-stage pre-training process that does not depend on labeled data to enhance its detection capabilities. Specifically, CCIHunter enhances comments based on templates and models code as a heterogeneous graph based on function calls. It utilizes CodeBERT and UniMp to generate embeddings for comments and code, respectively, and then calculates the similarity between these two embeddings. Consistency is judged by combining code embeddings, comment embeddings, and similarity scores. Notably, CCIHunter undergoes a two-stage pre-training that includes contrastive learning and mutation analysis, aiming to improve its ability to bridge the gap between code and comments and to focus on code elements at different granularities. Experimental results demonstrate that CCIHunter achieves a precision of 0.95, a recall of 0.90, and an F1 score of 0.93, outperforming existing tools.

In recent years, security incidents stemming from centralization defects in smart contracts have led to substantial financial losses. A centralization defect refers to any error, flaw, or fault in a smart contract's design or development stage that introduces a single point of failure. Such defects allow a specific account or user to disrupt the normal operations of smart contracts, potentially causing malfunctions or even complete project shutdowns. Despite the significance of this issue, most current smart contract analyses overlook centralization defects, focusing primarily on other types of defects. To address this gap, our paper introduces six types of centralization defects in smart contracts by manually analyzing 597 Stack Exchange posts and 117 audit reports. For each defect, we provide a detailed description and code examples to illustrate its characteristics and potential impacts. Additionally, we introduce a tool named CDRipper (Centralization Defects Ripper) designed to identify the defined centralization defects. Specifically, CDRipper constructs a permission dependency graph (PDG) and extracts the permission dependencies of functions from the source code of smart contracts. It then detects the sensitive operations in functions and identifies centralization defects based on predefined patterns. We conduct a large-scale experiment using CDRipper on 244,424 real-world smart contracts and evaluate the results based on a manually labeled dataset. Our findings reveal that 82,446 contracts contain at least one of the six centralization defects, with our tool achieving an overall precision of 93.7%.

Cross-chain bridges are essential decentralized applications (DApps) to facilitate interoperability between different blockchain networks. Unlike regular DApps, the functionality of cross-chain bridges relies on the collaboration of information both on and off the chain, which exposes them to a wider risk of attacks. According to our statistics, attacks on cross-chain bridges have resulted in losses of nearly 4.3 billion since 2021. Therefore, it is particularly necessary to understand and detect attacks on cross-chain bridges. In this paper, we collect the largest number of cross-chain bridge attack incidents to date, including 49 attacks that occurred between June 2021 and September 2024, of which 22 were attacks on cross-chain bridge business logic. Our analysis reveal that attacks against cross-chain business logic cause significantly more damage than those that do not. These cross-chain attacks exhibit different patterns compared to normal transactions in terms of call structure, which effectively indicates potential attack behaviors. Given the significant losses in these cases and the scarcity of related research, this paper aims to detect attacks against cross-chain business logic, and propose the BridgeGuard tool. Specifically, BridgeGuard models cross-chain transactions from a graph perspective, and employs a two-stage detection framework comprising global and local graph mining to identify attack patterns in cross-chain transactions. We conduct multiple experiments on the datasets with 203 attack transactions and 40,000 normal cross-chain transactions. The results show that BridgeGuard's reported recall score is 36.32% higher than that of state-of-the-art tools and can detect unknown attack transactions.

In recent years, a large number of on-chain attacks have emerged in the blockchain empowered Web3 ecosystem. In the year of 2023 alone, on-chain attacks have caused losses of over 585 million. Attackers use blockchain transactions to carry out on-chain attacks, for example, exploiting vulnerabilities or business logic flaws in Web3 applications. A wealth of efforts have been devoted to detecting on-chain attack transactions through expert patterns and machine learning techniques. However, in this ever-evolving ecosystem, the performance of current methods is limited in detecting new on-chain attacks, due to the obsoleting of attack recognition patterns or the reliance on on-chain attack samples. In this paper, we propose a universal approach for detecting on-chain attacks even when there are few or even no new on-chain attack samples. Specifically, an in-depth analysis of the transaction characteristics is conducted, and we propose a new insight to train a generic attack transaction detecting model, i.e., transaction reconstruction. Particularly, to overcome the over-fitting in the transaction reconstruction task, we use the web-scale function comments related to transactions as supervision information, rather than expert-confirmed labels. Experimental results demonstrate that the proposed approach surpasses the supervised state-of-the-art by 13% in AUC, with just 30 known on-chain attack samples. Moreover, without any known attack samples, our method can still detect new on-chain attacks in the wild (with a precision of 61.83%). Among attacks detected in the wild, we confirm 1,692 address poisoning attacks, a new type of on-chain attack targeting token holders. Our code is available at: https://github.com/wuzhy1ng/attack_trans_detection_www25.

As one of the most popular blockchain platforms supporting smart contracts, Ethereum has caught the interest of both investors and criminals. Differently from traditional financial scenarios, executing Know Your Customer verification on Ethereum is rather difficult due to its pseudonymous nature. Fortunately, as the transaction records stored in the Ethereum blockchain are publicly accessible, we can understand the behavior of accounts or detect illicit activities via transaction mining. Existing risk control techniques have primarily been developed from the perspectives of de-anonymizing address clustering and illicit account classification. However, these techniques cannot ascertain the potential risks for all accounts and are limited by specific heuristic strategies or insufficient label information. These constraints motivate us to seek an effective rating method for quantifying the spread of risk in a transaction network. To the best of our knowledge, we are the first to address the problem of account risk rating on Ethereum by proposing a novel model calledRiskProp, which includes a de-anonymous score to measure transaction anonymity and a network propagation mechanism to formulate the relationships between accounts and transactions. Experimental results on a realistic Ethereum dataset demonstrate that proposedRiskPropnewly discovered 63% of the Top 150 high-risk accounts as suspicious. The superior performance of risk score-based account classification experiments further verifies the effectiveness of our rating method (85.63% accuracy).

Due to the decentralized and public nature of the blockchain ecosystem, malicious activities on the Ethereum platform impose immeasurable losses on users. At the same time, the transparency of cryptocurrency transactions provides a unique opportunity to analyze illegal activities, such as phishing scams, from a network perspective. Most existing phishing scam detection methods focus primarily on analyzing account interaction networks, which limits their ability to uncover transaction behavior patterns embedded within transaction interactions. To address this, we construct theTransactionSubGraphNetwork (TSGN) by using transaction subgraphs as basic elements and further propose a novel framework for Ethereum phishing account detection. Specifically, we rebuild the graph structures via three well-designed mapping mechanisms, yielding TSGN and its two variants, i.e., Directed-TSGN and Temporal-TSGN, to obtain direction-aware and time-aware transfer flow features. By further incorporating the mapping strategy into transaction multidigraphs, we develop the Multiple-TSGN, which could preserve more transaction flow features while concurrently reducing the time consumption of modeling large-scale networks. TSGN models based on transaction subgraph interactions can capture complex higher-order dependencies, which lay beyond the reach of models that exclusively capture pairwise account interactions. As a general framework, our model can incorporate various feature extraction methods to improve the performance of phishing detection. Extensive experimental results on Ethereum datasets show that our method achieves superior performance in phishing detection, yielding 3.27%$\sim$6.71% relative improvement over previous state-of-the-art.

Decentralized bridge applications are important software that connects various blockchains and facilitates cross-chain asset transfer in the decentralized finance (DeFi) ecosystem which currently operates in a multi-chain environment. Cross-chain transaction association identifies and matches unique transactions executed by bridge DApps, which is important research to enhance the traceability of cross-chain bridge DApps. However, existing methods rely entirely on unobservable internal ledgers or APIs, violating the open and decentralized properties of blockchain. In this paper, we analyze the challenges of this issue and then present CONNECTOR, an automated cross-chain transaction association analysis method based on bridge smart contracts. Specifically, CONNECTOR first identifies deposit transactions by extracting distinctive and generic features from the transaction traces of bridge contracts.With the accurate deposit transactions, CONNECTOR mines the execution logs of bridge contracts to achieve withdrawal transaction matching. We conduct real-world experiments on different types of bridges to demonstrate the effectiveness of CONNECTOR. The experiment demonstrates that CONNECTOR successfully identifies 100% deposit transactions, associates 95.95% withdrawal transactions, and surpasses methods for CeFi bridges. Based on the association results, we obtain interesting findings about cross-chain transaction behaviors in DeFi bridges and analyze the tracing abilities of CONNECTOR to assist the DeFi bridge apps.

In recent years, phishing scams have caused huge economic losses in Ethereum, the largest blockchain platform enabling smart contracts. Many new sorts of phishing attacks based on smart contracts, specifically targeting Ethereum assets such as Ether and tokens, are emerging. Existing Ethereum phishing detection methods usually mine the transaction relationships among accounts from block data, while neglecting to mine the temporal transaction patterns inherent in the accounts themselves in different transaction types introduced by smart contracts. Such information provides a new perspective for analyzing account transaction preferences. However, since this information is hidden in heterogeneous data such as trace data and event logs, it is difficult to analyze and mine the information. In this paper, we contribute Trans2Graph, a novel graph-based framework for Ethereum data modeling and phishing detection, to fully exploit the massively heterogeneous temporal transaction data. We propose a new paradigm for the fusion of heterogeneous Ethereum data and model the implicit transition relationships among multiple heterogeneous transactions of each Ethereum account into a heterogeneous, temporal, directed multigraph called transaction state transition graph. Empirical analysis shows that phishing accounts have unique patterns in both the heterogeneity and time dynamics of transaction state transition graphs. Based on the analysis, we develop a novel attention-based graph neural network for the learning of heterogeneous temporal state transition graphs and phishing detection. Experiments on a large-scale real-world dataset demonstrate that Trans2Graph achieves a minimum 52.57% improvement in the average precision metric on state-of-the-art account interaction graph-based methods and a minimum 11.52% improvement in average precision on transaction sequence-based methods.

Unmanned Aerial Vehicle (UAV) clusters are widely used in spectrum reconnaissance, where spectrum samples are transmitted back to the sink through flying ad hoc network (FANET). High sampling frequencies are required, but result in a large amount of data not being transmitted over the wireless network, affecting throughput and reliability of the network. The problem boils down to what a good sampling frequency is and how to find it. There is an unknown dynamic sampling frequency threshold, beyond which high packet loss occurs. Prior work focused on achieving higher frequencies through FANET optimization but neglected methods to find this threshold and achieve a maximum value. We propose an adaptive protocol based on binary search. With limited bandwidth and consistent sampling frequency, the protocol dynamically adjusts sampling frequencies in a phased manner at the application layer to maximize the sampling frequency that the network can handle. In addition to spectrum reconnaissance, this protocol can be extended to other applications with consistent sampling frequencies. We have constructed an application based on the EXata simulation platform to analyze the performance of the protocol in delay, stability, reliability, and search times. Simulation results show the protocol improves the efficiency and survivability of spectrum reconnaissance.

Cross-chain technology enables seamless asset transfer and message-passing within decentralized finance (DeFi) ecosystems, facilitating multi-chain coexistence in the current blockchain environment. However, this development also raises security concerns, as malicious actors exploit cross-chain asset flows to conceal the provenance and destination of assets, thereby facilitating illegal activities such as money laundering. Consequently, the need for cross-chain transaction traceability has become increasingly urgent. Prior research on transaction traceability has predominantly focused on single-chain and centralized finance (CeFi) cross-chain scenarios, overlooking DeFi-specific considerations. This paper proposesABCTracer, an automated, bi-directional cross-chain transaction tracing tool, specifically designed for DeFi ecosystems. By harnessing transaction event log mining and named entity recognition techniques,ABCTracerautomatically extracts explicit cross-chain cues. These cues are then combined with information retrieval techniques to encode implicit cues.ABCTracerfacilitates the autonomous learning of latent associated information and achieves bidirectional, generalized cross-chain transaction tracing. Our experiments on 12 mainstream cross-chain bridges demonstrate thatABCTracerattains 91.75% bi-directional traceability (F1 metrics) with self-adaptive capability. Furthermore, we applyABCTracerto real-world cross-chain attack transactions and money laundering traceability, thereby bolstering the traceability and blockchain ecological security of DeFi bridging applications.

Code reuse is a common practice in software engineering. Developers of smart contracts pervasively reuse subcontracts to improve development efficiency. Like any program language, such subcontract reuse may unexpectedly include, or introduce vulnerabilities to the end-point smart contract. Indeed, prior empirical studies have identified a number of issues caused by code reuse in smart contracts. Unfortunately, automatically detecting such issues poses several unique challenges. Particularly, in most cases, smart contracts are compiled as bytecode, whose class-level information (e.g., inheritance, virtual function table), and even semantics (e.g., control flow and data flow) are fully obscured as a single smart contract after compilation. Therefore, it is rather difficult to identify the reused parts of subcontract from a given smart contract, not to mention finding potential vulnerabilities caused by subcontract misuse.In this paper, we propose Satellite, a new bytecode-level static analysis framework for subcontract misuse vulnerability (SMV) detection in smart contracts. Satellite incorporates a series of novel designs to enhance its overall effectiveness.. Particularly, Satellite utilizes a transfer learning method to recover the inherited methods, which are critical for identifying subcontract reuse in smart contracts. Further, Satellite extracts a set of fine-grained method-level features and performs a method-level comparison, for identifying the reuse part of subcontract in smart contracts. Finally, Satellite summarizes a set of SMV indicators according to their types, and hence effectively identifies SMVs. To evaluate Satellite, we construct a dataset consisting of 58 SMVs derived from real-world attacks and collect additional 56 SMV patterns from SOTA studies. Experiment results indicate that Satellite exhibits good performance in identifying SMV, with a precision rate of 84.68% and a recall rate of 92.11%. In addition, Satellite successfully identifies 14 new/unknown SMV over 10,011 realworld smart contracts, affecting a total amount of digital assets worth 201,358 USD.

Decentralized applications (DApps) have long been sitting ducks for hackers due to their valuable cryptocurrency assets, exposing them to various security risks. When a DApp is attacked, promptly identifying faults is crucial to minimizing financial losses and ensuring effective fault repair. However, existing fault localization methods, which mostly rely on code coverage, often fall short for DApps, particularly when dealing with only one fault case. Furthermore, according to a prior survey, most developers expect fault localization tools to provide reasonable explanations.In this paper, we present Malo, a method for DApp-specific explainable fault localization. It identifies fault functions throughsuspicious token transfer-guided analysis, and then employs Large Language Models (LLMs) to generate explanations for these identified fault functions. Specifically, Malo examines function call traces and source codes of fault cases to acquireinternal knowledge, and also retrieves relevant project documents from the Web to obtainexternal knowledge. By integrating internal and external knowledge, Malo generates reasonable explanations for faults in DApps. Our evaluation on a dataset of 68 real-world DApp faults demonstrates that Malo can locate 62% of faults within the Top-5, 9% higher than the state-of-the-art method. The experiment results also demonstrate a remarkable alignment accuracy of 71% between the explanations generated by Malo and the ground truth. In addition, we conduct a user study, which confirms that explanations generated by Malo can aid developers in comprehending the root cause of faults. Our code and dataset are available online: https://github.com/SodalimeZero/Malo_Code.git.

Implementing upgradeable smart contracts (USCs) has become a trend in Decentralized applications. Due to blockchain immutability, ensuring the upgradeability of smart contracts requires specialized implementation strategies. A systematic study of developers’ concerns regarding USC development can provide insights to reduce development costs and increase software robustness. In this work, we propose the first empirical study on exploring developers’ concerns over USCs. We first extract 2,224 USC-related posts based on an iterative process combining keyword filtering and manual filtering of posts from theEthereum StackExchangecommunity. Following open card-sorting practice, we propose 13 common development concerns based on the extracted posts, as well as the causes of these concerns. Furthermore, we analyze the frequency of these concerns within developer discussions. We highlight the most significant concerns of developers, where the top 5 most frequently discussed concerns are notably absent in existing research, e.g., code bugs originating from interacting and testing USCs in specific development frameworks. Additionally, we examine the real-world impact of these concerns by analyzing on-chain smart contracts and security reports from two widely referred databases, i.e.,RektandSlowmist. Based on case studies of the USC-related security reports in the past two years, we found that the causes of most USC security incidents are related to the identified concerns. Besides, we proposed a semi-automatic tool based on static analysis to detect related bugs and found 26 bugs in real-world smart contracts, which have involved over 0.3 million transactions. Based on these findings, we provide suggestions on the less-solved-yet-prevalent concerns regarding usability and security of USC development, such as facilitating the testing on USCs under existing development frameworks.

In recent years, graph neural networks (GNNs) have gained significant attention due to their outstanding performance on graph-related tasks by utilizing neighborhood aggregation. However, traditional GNNs are primarily designed based on the homophily assumption, which means that they show poor performance on heterophilic networks where dissimilar nodes prefer to connect. To address this issue, several heterophilic GNNs have been proposed that employ techniques, such as extending local neighbors and improving GNN architectures. From another perspective, recent studies have shown that, unlike homophilic GNNs, heterophilic GNNs exhibit higher robustness against graph adversarial attacks. In these attacks, the attackers try to inject small perturbations into the graph. Therefore, in this study, we delve into the core designs of heterophilic GNNs, including high-order neighbor, potential neighbor, ego-neighbor separation, and interlayer combination designs. We further analyze the influence of these key designs on the robustness of GNNs. We conducted comprehensive experiments to compare the impact of different designs on baseline and real-world GNN models. The findings of this work can serve as a reference for future studies aiming to design more robust and universal GNNs.

As the number of blockchain platforms continues to grow, the independence of these networks poses challenges for transferring assets and information across chains. Cross-chain bridge technology has emerged to address this issue, establishing communication protocols to facilitate cross-chain interaction of assets and information, thereby enhancing user experience. However, the complexity of cross-chain transactions increases the difficulty of security regulation, rendering traditional single-chain detection methods inadequate for cross-chain scenarios. Therefore, understanding cross-chain transaction semantics is crucial, as it forms the foundation for cross-chain security detection tasks. Although there are existing methods for extracting transaction semantics specifically for single chains, these approaches often overlook the unique characteristics of cross-chain scenarios, limiting their applicability. This paper introduces XSema, a novel cross-chain semantic extraction framework grounded in asset transfer and message-passing, designed specifically for cross-chain contexts. Experimental results demonstrate that XSema effectively distinguishes between cross-chain and non-cross-chain transactions, surpassing existing methods by over 9% for the generality metric and over 10% for the generalization metric. Furthermore, we analyze the underlying asset transfer patterns and message-passing event logs associated with cross-chain transactions. We offer new insights into the coexistence of multiple blockchains and the cross-chain ecosystem.

Cross-chain bridges are currently the most popular solution to support asset interoperability between heterogeneous blockchains. Over the past year, there have been more than ten serious attacks against cross-chain bridges, resulting in billions of dollars in losses. Among these attacks, fake deposits stand out as particularly destructive. Hackers can perpetrate such attacks by verifying the authenticity of proof associated with fake deposits on the target blockchain, subsequently pilfering the assets. However, existing tools have limitations in detecting this type of attack. To address this problem, this work proposes a tool to protect cross-chain bridges from fake deposit attacks by analyzing the network of transaction traces. Specifically, the framework first records the execution traces for each transaction, and then extracts the relevant contract interactions therein to extract statistical and structural features. Finally, real case labels are utilized to identify attacking and non-attacking transactions. We conducted experiments to validate the tool’s effectiveness and efficiency. In particular, for the detection of fake deposit transactions, our method achieved an average precision of 0.89, a recall value of 0.83, and the ability to identify 38.65 transactions per second.

The non-fungible token (NFT) is an emergent type of cryptocurrency that has garnered extensive attention since its inception. The uniqueness, indivisibility, and humanistic value of NFTs are the key characteristics that distinguish them from traditional tokens. The market capitalization of NFT reached 21.5 billion USD in 2021, almost 200 times that of all previous transactions. However, the subsequent rapid decline in NFT market fever in the second quarter of 2022 casts doubt on the ostensible boom in the NFT market. To date, there has been no comprehensive and systematic study of the NFT trade market or of the NFT bubble and hype phenomenon. To address this gap, we conduct an in-depth investigation of the entire Ethereum ERC721 and ERC1155 NFT ecosystems by dividing the NFT ecosystem participants into three categories: creators, transferors, and holders, to understand their manipulations of NFTs and infer their intentions. We examine the differences between NFT and ERC20 traders and then analyze the possible reasons behind these differences, leading us to gain insights into the varying degrees of market bubble associated with the two kinds of tokens. Through the construction and analysis of the NFT transfer graph (NTG), we uncover certain anomalous behaviors related to bubbles, along with quantifying the proportion of these anomalous behaviors, to reveal the degree of bubbles within the entire ecosystem.

Web3 describes an idea for the next evolution of the Internet, where blockchain technology enables the Internet of Value. As Web3 software, decentralized applications (DApps) have emerged in recent years. There exists a natural link between DApps and cryptocurrencies, where faults in DApps could directly lead to monetary losses associated with cryptocurrencies. Hence, efficient fault localization technology is of paramount importance for urgent DApp rescue operations and the mitigation of financial losses. However, fault localization methods applied in traditional applications are not well-suited for this specific field, due to their inability to identify DApp-specific fault features, e.g., a substantial amount of cryptocurrency is transferred from DApps to hackers. In order to explore the root cause of DApp faults, some researchers try to identify suspicious code snippets through mutation testing. Nonetheless, applying mutation testing for DApp fault localization is time-consuming and thus limited in practice. This paper conducts the first comprehensive study of DApp fault localization. We introduce DAppFL, a learning-based DApp fault localization tool that performs reverse engineering to gather executed source code and then trace cryptocurrency flow to assist in locating faulty functions. We also present the inaugural dataset for DApp fault localization, providing a new benchmark for this domain.Our experimental results demonstrate that DAppFL locates 63% of faults within the Top-5, 23% more than the state-of-the-art method. To facilitate further research, our code and dataset are freely available online: https://github.com/xplanet-sysu/awesome-works#dappfl.

In the context of boosting smart contract applications, prioritizing their security becomes paramount. Smart contract exploits often result in notable financial losses. Ensuring their security is by no means trivial. Rather than resulting in program crashes, most attacks in on-chain smart contracts aim to induce financial loss, referred to as profitable exploits. By constructing seemingly innocuous inputs, profitable exploits try to extract extra profit or compromise the interests of others. However, due to the complexity of call chains in on-chain smart contracts and the need for effective oracles for profitable exploits, smart contract fuzzing suffers from low efficiency and low effectiveness in finding profitable exploits. In this paper, we present Midas, a novel feedback-driven fuzzing framework to mine profitable exploits in on-chain smart contracts effectively. Midas consists of two modules: diverse validity fuzzing and profitable transaction identification. The diverse validity fuzzing module applies two waypoints to efficiently generate valid transactions, addressing the complexity of on-chain smart contract call chains. The profitable transaction identification module applies differential analysis to effectively identify profitable exploits, addressing the limitation of ad-hoc oracles. Evaluation of Midas over on-chain smart contracts showed it effectively identified 40 real-world exploits with a precision of 80%, outperforming state-of-the-art tools (i.e., ItyFuzz and Slither) in both efficiency and effectiveness. Particularly, Midas effectively mines five unknown exploits in valuable smart contracts, and two of them have already been confirmed by their DApp developers.

Nowadays, unmanned aerial vehicle (UAV) clusters are widely used in military and civil scenarios to perform spectrum reconnaissance. In this task, a high sampling frequency is desirable, but it results in a large volume of data that may not be transmitted through the wireless network. The problem boils down to what a good sampling frequency is and how to find it. There is an unknown dynamic sampling frequency threshold exceeding which leads to high packet loss. To find this threshold and achieve the maximum sampling frequency, we propose a distributed protocol based on binary search to find the best sampling frequency, taking consideration of performance metrics like latency, stability, reliability, and search times. Under the premise of limited bandwidth and consistent spectrum sampling frequency of UAVs, our protocol can dynamically adjust the spectrum sampling frequency at the application layer. We have built a network application on the EXata simulation platform to analyze the performance of the proposed protocol. The simulation results show that the protocol improves the efficiency and survivability of spectrum reconnaissance.

Unmanned Aerial Vehicle (UAV) swarm is becoming an important part of the future battlefield. Due to the high confrontation and the multiplicity types of interference in the battlefield environment, ensuring the topology integrity of the UAV formation becomes the premise of achieving the target mission. In this paper, we propose an optimal swarm reconstruction strategy for scenarios where some UAVs are destroyed. Our strategy reorganizes the remaining isolated UAVs into UAV clusters through reconstruction. We formulate the problem as an integer linear programming problem and propose a minimum-cost maximum-flow-based algorithm to solve it to optimality in polynomial time. Numerical results show that the proposed strategy can find the optimal path-cost solution, and the solution also takes into account the remaining energy and topoloaical change,

In recent years, money laundering crimes on blockchain, especially on Ethereum, have become increasingly rampant, resulting in substantial losses. The unique features of money laundering on Ethereum, such as decentralization and pseudonymity, pose new challenges for Ethereum anti-money laundering. Specifically, the existence of dense and extensive laundering gangs and intricate multilayered laundering pathways makes it exceptionally challenging for regulators to identify suspicious accounts and trace money flows. To address this issue, we propose an innovative DenseFlow framework that effectively identifies and traces money laundering activities by finding dense subgraphs and applying the maximum flow idea. We conduct multiple experiments on four datasets from Ethereum to validate the effectiveness of our approach. The precision of our DenseFlow is 16.34% higher than the start-of-the-art comparison methods on average, highlighting its distinctive contribution to tackling money laundering issues on blockchain.

Graph neural networks (GNNs) have found successful applications in various graph-related tasks. However, recent studies have shown that many GNNs are vulnerable to adversarial attacks. In a vast majority of existing studies, adversarial attacks on GNNs are launched via direct modification of the original graph such as adding/removing links, which may not be applicable in practice. In this article, we focus on a realistic attack operation via injecting fake nodes. The proposed global attack strategy via node injection (GANI) is designed under the comprehensive consideration of an unnoticeable perturbation setting from both structure and feature domains. Specifically, to make the node injections as imperceptible and effective as possible, we propose a sampling operation to determine the degree of the newly injected nodes, and then generate features and select neighbors for these injected nodes based on the statistical information of features and evolutionary perturbations obtained from a genetic algorithm, respectively. In particular, the proposed feature generation mechanism is suitable for both binary and continuous node features. Extensive experimental results on benchmark datasets against both general and defended GNNs show strong attack performance of GANI. Moreover, the imperceptibility analyses also demonstrate that GANI achieves a relatively unnoticeable injection on benchmark datasets.

As the largest blockchain platform that supports smart contracts, Ethereum has attracted wide attention from both academia and industry in recent years. Along with the prosperous development of Ethereum, the high-risk illegal practices on it are becoming more and more rampant, seriously jeopardizing the system’s trading security and long-term development. Therefore, the detection and quantification of account risk are of great importance for both cryptocurrency investors and blockchain security researchers. In this article, we propose the first general framework for account risk rating on Ethereum, which includes a devisable suspiciousness metric to adapt to various illicit fraud detection and a network propagation mechanism to formulate the relations between accounts and transactions. By conducting extensive experiments on a real-world dataset from Ethereum, we show the universality of the account risk rating framework. Particularly, statistical analyses on different risk levels of accounts demonstrate that the risk rating framework has access to detect various illicit accounts. And the metric analysis of risk rating results put forward some insights. Moreover, visualization of a suspicious transaction chain reveals the process of illicit activities on Ethereum, enabling investors to obtain an understanding of the risky accounts and avoid significant financial losses.

As one of the most typical cybercrime types, phishing scams have extended the devil’s hand to the emerging blockchain ecosystem in recent years. Especially, huge economic losses have been caused by phishing scams in Ethereum, the second-largest blockchain system. Existing approaches for Ethereum phishing detection, however, typically use machine learning or transaction graph embedding methods to identify phishers in isolation and do not effectively uncover the group of transaction accounts linked to scams (which we term a “gang”). Since accounts are pseudonymous in Ethereum, these undisclosed conspirator accounts have potential risks to the system. In this paper, we conduct the first study that characterizes and detects Ethereum phishing gangs. We first investigate the transaction behaviors in phishing gangs from the perspectives of individuals, pairs, and higher-order patterns. Our analysis reveals that although the Ethereum transaction graph is sparse with a highly skewed degree distribution, phishing accounts in the same gang have closer relationships and share specific transaction patterns. Based on our findings, we formalize the phishing gang detection problem and introduce a novel detection model named PGDetector. Given a risky phishing account as a seed, PGDetector can find out the potential risky accounts sharing close relationships within the seed’s community based on genetic algorithm optimization. Experimental results on large-scale Ethereum transaction data demonstrate the effectiveness of PGDetector.

With the overall momentum of the blockchain industry, financial crimes related to blockchain crypto-assets are becoming increasingly prevalent. After committing a crime, the main goal of cybercriminals is to obfuscate the source of the illicit funds in order to convert them into cash and get away with it. Many studies have analyzed money laundering (ML) in the field of the traditional financial sector. However, in terms of the emerging blockchain crypto-asset ecosystem, there is currently only one public anti-money laundering (AML) dataset for Bitcoin– the Elliptic dataset, whose binary labels (licit vs. illicit transactions) cannot cover the ML behaviors in the evergrowing crypto-asset market. To fill this gap, in this paper, we propose a framework named XBlockFlow which identifies ML addresses starting from Ethereum heist incidents and obtains the first detailed Ethereum ML dataset named$\textit {EthereumHeist}$, and then conducts a comprehensive feature and evolution analysis on the$\textit {EthereumHeist}$dataset according to the three main phases of ML. We first search for the source cybercriminal accounts including exchange hackers, DeFi exploiters, and scammers. Then, employing the idea of taint analysis, we track the diverse downstream transactions and addresses layer by layer. At the end of tracking, we identify and categorize service providers, and go a step further to investigate advanced ML methods that do not exist in the Bitcoin scenario, e.g. token swap and counterfeit token creation. Based on the ML identification results, we obtain many interesting findings about crypto-asset money laundering, observing the escalating money laundering methods such as creating counterfeit tokens and masquerading as speculators.

With the popularity of Non-Fungible Tokens (NFTs), the high value of NFTs makes them a target for phishing scammers, which harms the security and reliability of the Web3 NFT ecosystem. Despite the significance of this issue, there is a lack of systematic research in the area of emerging NFT phishing scams. To address this gap, we are the first to conduct a case retrospective analysis and empirical measurement study of real-world historical NFT phishing scams on Ethereum. We collect and publicly release the first NFT phishing dataset which includes 1,625 NFT phishing accounts and transaction records as of August 2023. We further categorize the existing scams into four phishing patterns and investigate their distinguishable behaviors. Then, we reveal the modus operandi preferences and economic impacts to characterize NFT phishing scams. We find that NFT phishers stole 67,188 NFTs, with a total direct selling profit of${\$}$20.92 million. We also observe that scammers favor certain categories and collections of NFTs, coupled with signs of gang theft. Furthermore, we design a variety of account features for the classification task of NFT phishers based on empirical conclusions. Experimental results on real-world NFT transaction data demonstrate the effectiveness of these features in detecting NFT phishing accounts, and outperform traditional phishing detection methods with 41% average Precision and 44% average Recall.

In recent years, phishing scams have emerged as one of the most serious crimes on Ethereum. Existing phishing scam detection methods typically model public transaction records on the blockchain as a graph, and then identify phishing addresses through manual feature extraction or graph learning frameworks. Meanwhile, these methods model transactions within a period as a static network for analysis. Therefore, these methods lack the ability to capture fine-grained time dynamics, and on the other hand, they cannot handle the large-scale and continuously growing transaction data on the Ethereum blockchain, resulting in lower scalability and efficiency. In this paper, we propose a two-dimensional streaming framework 2DynEthNet for Ethereum phishing scam detection. First, we cast the transaction series into 6 slices according to block numbers, treating each as a separate task. In the first dimension, we treat transaction features as edge features instead of node features within one task, allowing each transaction to be streamed in 2DynEthNet, aiming to capture the evolutionary features of the Ethereum transaction network at a fine-grained level in continuous time. In the second dimension, we adopt the strategy of incremental information training between tasks, which utilizes meta-learning to quickly update the model parameters under new slices, thus effectively improving the scalability of the model. Finally, experimental results on large-scale real Ethereum phishing scam datasets show that our 2DynEthNet outperforms the state-of-the-art methods with 28.44% average Recall and achieves the most efficient training speed, proving the effectiveness of both temporal edge representation and meta-learning. In addition, we provide an Ethereum large-scale dynamic graph transaction dataset, ETGraph, which aligns with the data distribution in real transaction scenarios without sampling and filtering unlabeled accounts.

In recent years, Decentralized Finance (DeFi) has grown rapidly due to the development of blockchain technology and smart contracts. As of March 2023, the estimated global cryptocurrency market cap has reached approximately $949 billion. However, security incidents continue to plague the DeFi ecosystem, and one of the most notorious examples is the “Rug Pull” scam. This type of cryptocurrency scam occurs when the developer of a particular token project intentionally abandons the project and disappears with investors’ funds. Despite only emerging in recent years, Rug Pull events have already caused significant financial losses. In this work, we manually collected and analyzed 103 real-world rug pull events, categorizing them based on their scam methods. Two primary categories were identified:Contract-relatedRug Pull (through malicious functions in smart contracts) andTransaction-relatedRug Pull (through cryptocurrency trading without utilizing malicious functions). Based on the analysis of rug pull events, we propose CRPWarner (short forContract-relatedRugPull RiskWarner) to identify malicious functions in smart contracts and issue warnings regarding potential rug pulls. We evaluated CRPWarner on 69 open-source smart contracts related to rug pull events and achieved a 91.8% precision, 85.9% recall, and 88.7% F1-score. Additionally, when evaluating CRPWarner on 13,484 real-world token contracts on Ethereum, it successfully detected 4168 smart contracts with malicious functions, including zero-day examples. The precision of large-scale experiments reaches 84.9%.

To combat cybercrimes and maintain financial security for the blockchain ecosystem, “know your customer” (KYC) is an essential and also challenging process due to the pseudonymity nature of blockchain technology. To unlock the potential of KYC on blockchain-based platforms like Ethereum, account labeling is a powerful means which can de-anonymize addresses by mining public transaction records. Existing studies on account labeling are mainly conducted via machine learning (ML) methods fed with hand-crafted features or graph neural networks based on the modeled transaction network. However, ML approaches based on hand-crafted features ignore the global interaction information between accounts, making it easy for criminals to evade detection. Moreover, the performance of traditional GCN methods when applied to Ethereum transaction network encounters limitations due to label sparsity, network heterophily, and large network size of the transaction network. In this article, we first analyze Ethereum accounts involved in typical businesses, in terms of both account and topological features. Then based on the analytical results, we propose a novel GCN method named know-your-customer graph convolutional network (KYC-GCN) which contains two key designs: 1) multihop aggregators and importance-based sampling are designed to tackle the dilemma between accuracy and efficiency. 2) GCN architecture is improved to explicitly capture local and more global information. Experimental results on a realistic Ethereum dataset show that the proposed KYC-GCN (90.2% accuracy, 86.2% Marco-F1) achieves state-of-the-art classification performance, and results on six benchmarks demonstrate that it yields great performance under homophily and heterophily.

With the continuous evolution of blockchain technology, cryptocurrency platforms such as Ethereum have emerged as centers for digital asset transactions and smart contracts deployment. However, this nascent financial ecosystem also introduces potential money laundering risks. The traditional financial industry has accumulated significant antimoney laundering (AML) experience and technical means for monitoring and detecting money laundering activities. Yet, the adaptability of these established AML algorithms in the context of blockchain remains unclear. This paper aims to investigate the practical adaptability of traditional AML algorithms on Ethereum data through empirical experiments. We gather eight real-world money laundering case datasets collected from Ethereum and conduct experiments using three traditional AML algorithms on these datasets. We evaluate the performance of these algorithms from various angles, including precision, recall, and the distribution of detected accounts' labels in comparison to the original datasets. It turns out algorithms demonstrate distinct performance in diverse money laundering cases, indicating that the adaptability of traditional AML algorithms on Ethereum data presents certain adaptability and limitations. Holoscope's accuracy demonstrates the value of dense subgraph properties in Ethereum money laundering detection, and further research can be conducted based on this model framework combined with the money laundering characteristics of Ethereum. Our study provides valuable insights for strengthening AML mechanisms on blockchain platforms and offers guidance for further research on detecting money laundering accounts in blockchain environments.

Overdue risk detection of consumer loans is a critical issue faced by consumer finance companies. Unlike other types of loans, such as mortgage loans and guaranteed loans, consumer loans only regard personal credit as collateral. As a high overdue rate will result in economic losses to financial companies, it is of great significance for lenders to accurately detect risky customers. However, the large volume of credit data and the variety of customer characteristics make the risk detection via manual expert analysis rather challenging. Additionally, previous loan risk detection approaches based on machine learning classification neglect the relations between different customers, and traditional graph neural networks lack the exploration of loan overdue patterns. In this paper, we construct a heterogeneous graph based on real credit data from a consumer finance company. We analyze the distribution of meta-paths and propose a meta-path-based graph neural network that combines both lower-order and higher-order features. Experimental results show that our model is able to detect more risky customers by exploring overdue patterns and can achieve the best effect in the loan overdue detection task.

As the largest blockchain platform that supports smart contracts, Ethereum has developed with an incredible speed. Yet due to the anonymity of blockchain, the popularity of Ethereum has fostered the emergence of various illegal activities and money laundering by converting ill-gotten funds to cash. In the traditional money laundering scenario, researchers have uncovered the prevalent traits of money laundering. However, since money laundering on Ethereum is an emerging means, little is known about money laundering on Ethereum. To fill the gap, in this paper, we conduct an in-depth study on Ethereum money laundering networks through the lens of a representative security event on Upbit Exchange to explore whether money laundering on Ethereum has traditional traits. Specifically, we construct a money laundering network on Ethereum by crawling the transaction records of Upbit Hack. Then, we present five questions based on the traditional traits of money laundering networks. By leveraging network analysis, we characterize the money laundering network on Ethereum and answer these questions. In the end, we summarize the findings of money laundering networks on Ethereum, which lay the groundwork for money laundering detection on Ethereum.

As one of the most active blockchain platforms at present, Ethereum attracts a great deal of interest, including that of fraudsters. They exploit the anonymity of Ethereum accounts to perpetrate varieties of scams, the most common of which is phishing frauds. However, existing phishing detection work ignores the heterogeneity of Ethereum transaction edges. In fact, the activities on Ethereum include external transactions, internal transactions, and token transactions. Therefore, this paper proposes an Ethereum account phishing fraud detection method named HTSGCN. Based on heterogeneous transaction subnets, our method makes full use of the type and direction information contained in transactions. First, we collect Ethereum transaction data and construct a k-order heterogeneous subnet for each account. To aggregate the neighbor feature, we design a message propagation mechanism based on graph convolution network. Finally, we classify node representation vectors containing neighborhood and its own characteristics. Experimental results show that HTSGCN has a better effect on detecting phishing accounts than previous work which is based on homogeneous networks.

Phishing is a widespread scam activity on Ethereum, causing huge financial losses to victims. Most existing phishing scam detection methods abstract accounts on Ethereum as nodes and transactions as edges, then use manual statistics of static node features to obtain node embedding and finally identify phishing scams through classification models. However, these methods can not dynamically learn new Ethereum transactions. Since the phishing scams finished in a short time, a method that can detect phishing scams in real-time is needed. In this paper, we propose a streaming phishing scam detection method. To achieve streaming detection and capture the dynamic changes of Ethereum transactions, we first abstract transactions into edge features instead of node features, and then design a broadcast mechanism and a storage module, which integrate historical transaction information and neighbor transaction information to strengthen the node embedding. Finally, the node embedding can be learned from the storage module and the previous node embedding. Experimental results show that our method achieves decent performance on the Ethereum phishing scam detection task.

Web3, based on blockchain technology, is the evolving next generation Internet of value. Massive active applications on Web3, e.g. DeFi and NFT, usually rely on blockchain transactions to achieve value transfer as well as complex and diverse custom logic and intentions. Various risky or illegal behaviors such as financial fraud, hacking, money laundering are currently rampant in the blockchain ecosystem, and it is thus important to understand the intent behind the pseudonymous transactions. To reveal the intent of transactions, much effort has been devoted to extracting some particular transaction semantics through specific expert experiences. However, the limitations of existing methods in terms of effectiveness and generalization make it difficult to extract diverse transaction semantics in the rapidly growing and evolving Web3 ecosystem. In this paper, we propose the Motif-based Transaction Semantics representation method (MoTS), which can capture the transaction semantic information in the real-time transaction data workflow. To the best of our knowledge, MoTS is the first general semantic extraction method in Web3 blockchain ecosystem. Experimental results show that MoTS can effectively distinguish different transaction semantics in real-time, and can be used for various downstream tasks, giving new insights to understand the Web3 blockchain ecosystem. Our codes are available at https://github.com/wuzhy1ng/MoTS.

As one of the most popular blockchain systems, EOSIO has been widely used in decentralized applications (DApps). Compared with traditional proof-of-work (PoW)-based blockchain systems like Bitcoin, EOSIO achieves a high transaction throughput and an alleged decentralization with the Delegated Proof-of-Stake (DPoS) consensus protocol. However, recent reports claimed the existence of voting collusion and manipulation during the DPoS consensus procedure of EOSIO, which may greatly decline the decentralization degree, fault tolerance, and reliability of the whole system. In this article, we obtain data from up to 135 000 000 blocks of EOSIO and conduct a data-driven decentralization analysis. Specifically, we characterize the decentralization evolution of the two phases in DPoS, namely block producer election and block production. Moreover, we study the voters with similar voting behaviors and propose methods to discover abnormal mutual voting behaviors in EOSIO. The analysis results show how EOSIO gradually evolves from decentralization to oligopoly and our methods can effectively capture abnormal voting phenomena in the EOSIO, which can also provide important insights for the design and maintenance of other DPoS-based blockchains.

With the wide application and development of blockchain technology, the past years have witnessed the emergence of various cybercrimes, which have caused a huge amount of economic loss. Among them, phishing scams on the blockchain are regarded as a serious threat to the trading security of the blockchain ecosystem. By modeling the transaction data of blockchain as a network, a series of graph-based phishing detection frameworks have been proposed. Enlightened by adversarial attacks of graph data, we propose to verify the robustness of current phishing detection frameworks under intentional attackers aiming to hide phishing behaviors. In this study, we first propose a general phishing detection framework based on feature engineering and then propose a phishing hiding framework combing the greedy selection mechanism with four phishing hiding strategies to measure the robustness of the proposed general detection models. Extensive experiments evaluate the detective performance of the phishing detection model and its robustness against the hiding framework. The experimental results indicate that the detective model based on feature engineering is rather fragile under adversarial attacks.

Security incidents such as scams and hacks have become a major threat to the health of the blockchain ecosystem, resulting in billions of dollars in losses to blockchain users each year. To reveal the real-world entities behind pseudonymous blockchain accounts and recover stolen funds from massive transaction data, much effort has recently been put into tracing illicit financial flows in blockchain by academia and industry. However, most of the current blockchain fund tracing methods are heuristics and taint analysis methods that are designed on the basis of expert experience and specific events, which have limitations in terms of universality, effectiveness and efficiency. This paper models blockchain transaction records as a transaction graph and tackles blockchain transaction tracing as a graph search task. To achieve efficient and effective tracing of fund transfers on the transaction graphs, we propose a scalable transaction tracing tool, TRacer, which to the best of our knowledge is thefirstintelligent transaction tracing tool that is generalized to multiple account-based blockchain platforms and can handle complex transaction behavior in decentralized finance (DeFi). Particularly, we tackle the transaction tracing task via a subgraph searching approach which employ a novel ranking method to infer the relevance between accounts during the graph search process in the multi-relational blockchain transaction graph. Theoretical analysis and experimental results on datasets from multiple blockchain platforms demonstrate that TRacer can efficiently perform the transaction tracing task at a lower cost and achieve better tracing results than existing methods or even expert manual audits.

The degree of establishment of cerebrovascular collateral circulation is closely related to the prognosis of patients with acute ischemic stroke, but the evaluation of collateral circulation requires high professional experience of physicians because of the complex structure of the cerebral vessels themselves, and the variety of scoring criteria resulting in poor consistency of results between physicians. Therefore, the use of computer-aided diagnostic techniques to evaluate the establishment of collateral circulation in patients with ischemic stroke is of great clinical importance. In this paper, we proposed a novel method for automatic scoring of collateral circulation via multiphase cranial CTA (computed tomography angiography) to assist physicians in diagnosis. We compared with existing mainstream classification n etworks, our method is able to achieve 90.43% accuracy. Further, the effectiveness of the method was further validated by ablation experiments. However, the multi-phase Cranial CTA collateral circulation scoring algorithm based on a feature fusion network with the hybrid attention mechanism effectively improves the efficiency of prognostic judgment, avoids the limitations of manual extraction of image features in the traditional ways, and plays an auxiliary role in diagnosis for physicians in clinical practice, which is useful for guiding the decision of clinical syndromes in lateral branch circulation stroke.

Acute ischemic stroke (AIS) caused by large vessel occlusion (LVO) has high disability and mortality. However, due to the individual differences of physiological structure and pathological changes between patients, it will be difficult to detect the occluded vessels, so as to delay the treatment timing. Therefore, it is of great significance to a ssist d octors to locate occluded vessels quickly and accurately in clinical practice. In this paper, we present a novel multi-branch hybrid network (MBH-Net) with auxiliary attention guidance to detect occluded vessels. The proposed network consists of three branches for universal representation learning, patient representation learning and classifier learning, respectively. Furthermore, we propose a semantic feature enhancement module to extract more robust semantic information. Particularly, we introduce an auxiliary attention guidance module to guide the attention tendency of MBH-Net, which can make the network give a more reasonable visual interpretation. Extensive experiments show that our MBH-Net can achieve satisfactory accuracy and give a reasonable visual interpretation.

Due to the widespread use of smart contracts, Ethereum has become the second-largest blockchain platform after Bitcoin. Many different types of Ethereum accounts (ICO, Mining, Gambling, etc.) also have quite active trading activities on Ethereum. Studying the transaction records of these specific Ethereum accounts is very important for understanding their particular transaction characteristics, and further labeling the pseudonymous accounts. However, traditional methods are generally based on static and global transaction networks to conduct research, ignoring useful information about dynamic changes. Our work chooses six kinds of important account labels, and builds ego networks for each kind of Ethereum account. We focus on the interaction between the target node and neighbor nodes with temporal analysis. Experiments show that there is a significant difference between various types of accounts in terms of several network features, helping us better understand their transaction patterns. To the best of our knowledge, this is the first work to analyze the dynamic characteristics of Ethereum labeled accounts from the perspective of transaction ego networks.

With a large market capitalization, Ethereum is one of the most famous blockchain platforms supporting smart contracts nowadays. To better understand Ethereum, previous researches have performed numerous analyses on Ethereum via complex network theory, while many of them merely focus on a single perspective of scale or time series. This motivates us to investigate the evolution of Ethereum from a local point of view. We concentrate our study on some key accounts labeled by the community. Then we crawl and extract their transaction subgraphs, and conduct an analysis based on several basic network properties consisting of network scale and triadic tendencies by sliding window. Furthermore, we provide an insight into the local structure of these subgraphs by counting the graphlets induced from the label nodes. Subsequently, we observe diverse similarities and differences between various label nodes in the changing trend and subgraph patterns in the locality of Ethereum networks. The results and findings from this study may help us to understand the activity of Ethereum more comprehensively.

Network storage services have benefited countless users worldwide due to the notable features of convenience, economy and high availability. Since a single service provider is not always reliable enough, more complex multi-cloud storage systems are developed for mitigating the data corruption risk. While a data auditing scheme is still needed in multi-cloud storage to help users confirm the integrity of their outsourced data. Unfortunately, most of the corresponding schemes rely on trusted institutions such as the centralized third-party auditor (TPA) and the cloud service organizer, and it is difficult to identify malicious service providers after service disputes. Therefore, we present a blockchain-based multi-cloud storage data auditing scheme to protect data integrity and accurately arbitrate service disputes. We not only introduce the blockchain to record the interactions among users, service providers, and organizers in data auditing process as evidence, but also employ the smart contract to detect service dispute, so as to enforce the untrusted organizer to honestly identify malicious service providers. We also use the blockchain network and homomorphic verifiable tags to achieve the low-cost batch verification without TPA. Theoretical analyses and experiments reveal that the scheme is effective in multi-cloud environments and the cost is acceptable.

Cascading failure is a ubiquitous phenomenon that can paralyze networked systems in a short time. Many traditional studies of cascading failures have been conducted from the perspective of either an attacker or a defender. In reality, however, malicious attacks on networks are rarely a one-sided process. Instead, both the attacker and defender are actively involved. We use game theory to study the strategies of both sides in terms of an attacker–defender game on complex networks. Based on the concept of the Stackelberg competition, we propose a multiround attacker–defender game model on complex networks, allowing high flexibility in the available actions for both sides in the game. The model we propose allows the two sides to specify certain parameters of the network to attack/defend and further allocate a certain amount of resources for the attack/defense. Such flexibility allows the model to capture the actions of the attackers and defenders more precisely and simulate the attack process in a more realistic manner. We propose an iterative search algorithm to search for desirable strategies with systematic experiments on various types of networks and associated parameters and in terms of different relative resource owned by the attacker and defender.

Much of the current research in Ethereum transaction records focuses on the statistical analysis and measurements of existing data; however, the evolution mechanism of Ethereum transactions is an important, yet seldom discussed issue. In this work, we first collect the transaction data of Ethereum and build network models from a microlevel view and then use a link-prediction-based framework to quantify the impact of network characteristics on Ethereum evolution. Next, we explore the graph structure properties and the driving factors of newly generated transaction relationships. Experimental results show that the local and microscopic structure of Ethereum networks is star-shaped, and the transaction frequency of addresses has a great impact on the evolution of Ethereum transaction relationships. First-layer nodes of microstructures dominate the network evolution. Moreover, the degree of addresses is an effective basis for predicting the direction of new transactions. Potential further studies on Ethereum transaction link prediction are discussed, for example, the label effect of center addresses.

Blockchain technology has the characteristics of decentralization, traceability and tamper-proof, which creates a reliable decentralized trust mechanism, further accelerating the development of blockchain finance. However, the anonymization of blockchain hinders market regulation, resulting in increasing illegal activities such as money laundering, gambling and phishing fraud on blockchain financial platforms. Thus, financial security has become a top priority in the blockchain ecosystem, calling for effective market regulation. In this paper, we consider identifying Ethereum accounts from a graph classification perspective, and propose an end-to-end graph neural network framework namedEthident, to characterize the behavior patterns of accounts and further achieve account de-anonymization. Specifically, we first construct an Account Interaction Graph (AIG) using raw Ethereum data. Then we design a hierarchical graph attention encoder namedHGATEas the backbone of our framework, which can effectively characterize the node-level account features and subgraph-level behavior patterns. For alleviating account label scarcity, we further introduce contrastive self-supervision mechanism as regularization to jointly train our framework. Comprehensive experiments on Ethereum datasets demonstrate that our framework achieves superior performance in account identification, yielding 1.13% ~ 4.93% relative improvement over previous state-of-the-art. Furthermore, detailed analyses illustrate the effectiveness ofEthidentin identifying and understanding the behavior of known participants in Ethereum (e.g. exchanges, miners, etc.), as well as that of the lawbreakers (e.g. phishing scammers, hackers, etc.), which may aid in risk assessment and market regulation.

As the first decentralized peer-to-peer (P2P) cryptocurrency system allowing people to trade with pseudonymous addresses, Bitcoin has become increasingly popular in recent years. However, the P2P and pseudonymous nature of Bitcoin make transactions on this platform very difficult to track, thus triggering the emergence of various illegal activities in the Bitcoin ecosystem. Particularly,mixing servicesin Bitcoin, originally designed to enhance transaction anonymity, have been widely employed for money laundering to complicate the process of trailing illicit fund. In this article, we focus on the detection of the addresses belonging to mixing services, which is an important task for anti-money laundering in Bitcoin. Specifically, we provide a feature-based network analysis framework to identify statistical properties of mixing services from three levels, namely, network level, account level, and transaction level. To better characterize the transaction patterns of different types of addresses, we propose the concept of attributed temporal heterogeneous motifs (ATH motifs). Moreover, to deal with the issue of imperfect labeling, we tackle the mixing detection task as a positive and unlabeled learning (PU learning) problem and build a detection model by leveraging the considered features. Experiments on real Bitcoin datasets demonstrate the effectiveness of our detection model and the importance of hybrid motifs including ATH motifs in mixing detection.

Recently, blockchain technology has become a topic in the spotlight but also a hotbed of various cybercrimes. Among them, phishing scams on blockchain have been found to make a notable amount of money, thus emerging as a serious threat to the trading security of the blockchain ecosystem. In order to create a favorable environment for investment, an effective method for detecting phishing scams is urgently needed in the blockchain ecosystem. To this end, this article proposes an approach to detect phishing scams on Ethereum by mining its transaction records. Specifically, we first crawl the labeled phishing addresses from two authorized websites and reconstruct the transaction network according to the collected transaction records. Then, by taking the transaction amount and timestamp into consideration, we propose a novel network embedding algorithm calledtrans2vecto extract the features of the addresses for subsequent phishing identification. Finally, we adopt the one-class support vector machine (SVM) to classify the nodes into normal and phishing ones. Experimental results demonstrate that the phishing detection method works effectively on Ethereum, and indicate the efficacy oftrans2vecover existing state-of-the-art algorithms on feature extraction for transaction networks. This work is thefirstinvestigation on phishing detection on Ethereum via network embedding and provides insights into how features of large-scale transaction networks can be embedded.

The security issue of complex network systems, such as communication systems and power grids, has attracted increasing attention due to cascading failure threats. Many existing studies have investigated the robustness of complex networks against cascading failure from an attacker's perspective. However, most of them focus on the synchronous attack in which the network components under attack are removed synchronously rather than in a sequential fashion. Most recent pioneering work on sequential attack designs the attack strategies based on simple heuristics like degree and load information, which may ignore the inside functions of nodes. In the paper, we exploit a reinforcement learning-based sequential attack method to investigate the impact of different nodes on cascading failure. Besides, a candidate pool strategy is proposed to improve the performance of the reinforcement learning method. Simulation results on Barabási-Albert scale-free networks and real-world networks have demonstrated the superiority and effectiveness of the proposed method.

With the prosperous development of blockchain technologies in the past few years, some cybercrimes have emerged in the blockchain ecosystem, such as the phishing scams on Ethereum. To alleviate these security problems, a few anomaly detection frameworks were proposed. Specifically, previous studies usually model the transfer relationship between accounts in the blockchain ecosystem as a transaction network, where nodes represent accounts and edges represent the corresponding transaction records. Inspired by the adversarial attacks on graph data, we believe the robustness of existing detection frameworks still needs to be further verified even though they have achieved good performance. In this paper, a phishing detection framework based on feature learning and a phishing hidden framework based on inserting transaction records are proposed, respectively. Experimental results show the effectiveness of our phishing detection framework and the superiority of the phishing hidden strategies, which indicate that existing phishing detection frameworks are lack of robustness and still need further improvement against malicious attacks.

As one of the most important and famous applications of blockchain technology, cryptocurrency has attracted extensive attention recently. Empowered by blockchain technology, all the transaction records of cryptocurrencies are irreversible and recorded in the blocks. These transaction records containing rich information and complete traces of financial activities are publicly accessible, thus providing researchers with unprecedented opportunities for data mining and knowledge discovery in this area. Networks are a general language for describing interacting systems in the real world, and a considerable part of existing work on cryptocurrency transactions is studied from a network perspective. This survey aims to analyze and summarize the existing literature on analyzing and understanding cryptocurrency transactions from a network perspective. Aiming to provide a systematic guideline for researchers and engineers, we present the background information of cryptocurrency transaction network analysis and review existing research in terms of three aspects, i.e., network modeling, network profiling, and network-based detection. For each aspect, we introduce the research issues, summarize the methods, and discuss the results and findings given in the literature. Furthermore, we present the main challenges and several future directions in this area.

Cascading failure on complex networks has been extensively studied over the past decade. However, restoration of networks from cascading failure is still relatively unexplored. In this paper, we consider cascading failure in conjunction with the restoration process involving repairing the failed nodes in a sequential fashion. Depending on the availability of resources, we tackle the sequential recovery problem from two distinct approaches, namely, result-oriented and resource-oriented restoration approaches. In the result-oriented approach, we aim to restore the network to the largest extent and within the shortest time. Heuristic network restoration strategies based on node load or degree are proposed. For resource-oriented restoration, we aim to maximize the increase of network size with a given number of nodes to be repaired, and we propose a novel iterative strategy to improve performance. Simulation results on the Barábasi-Albert scale-free network, Internet autonomous system-level network, and IEEE 300 bus power system have demonstrated the effectiveness of the proposed sequential recovery strategies.

With the increasing popularity of blockchain technology, it has also become a hotbed of various cybercrimes. As a traditional way of scam, the phishing scam has new means of scam in the blockchain scenario and swindles a lot of money from users. In order to create a safe environment for investors, an efficient method for phishing detection is urgently needed. In this paper, we propose a three steps framework to detect phishing scams on Ethereum by mining Ethereum transaction records. First, we obtain the labeled phishing accounts and corresponding transaction records from two authorized websites. According to the collected transaction records we build an Ethereum transaction network. Then, a network embedding method node2vec which can extract the latent features of accounts is used for subsequent phishing classification. Finally, to distinguish whether the account is a phishing account, we adopt the one-class support vector machine (SVM) to classify. The experimental result demonstrates that F-score of our phishing detection method can achieve 0.846, which verifies the validity of our model. To the best of our knowledge, this is the first work that investigates the phishing scams on Ethereum based on transaction records.

Graph embedding has been widely used to process various downstream tasks on large-scale graphs, i.e. node classification, community detection and link prediction. Among various embedding methods, Deep Graph Infomax (DGI) is a newly proposed method which achieves excellent performance in node classification. However, such outstanding achievement may cause the over-mining issue of user privacy and the robustness of this embedding method is still unexplored. In this paper, we investigate how to disturb the node classification accuracy of DGI from an attacker's perspective. We propose a novel attack method called Cross Entropy Attack (CEA), which aims to make target nodes be misclassified by DGI model with only limited edges being modified. By slightly changing the topological structure of a graph, CEA can successfully interfere with the accuracy of node classification in an unsupervised manner. Experiment results show that the proposed CEA obviously outperforms two baseline methods in terms of both Misclassified Rate (MR) and Average Modified of Edge (AME).

In the study of power grid security, the cascading failure process has attracted increasing attention in recent years. The robustness of a power grid against cascading failure can be evaluated from both structural and functional perspective. In most previous studies, these two types of robustness were treated separately in spite of the fact that both of them are considered equally important in many scenarios. In our study, we utilize multi-objective optimization to take both aspects of the system robustness against cascading failure into consideration. Based on NSGA-II, we develop an effective attack strategy to localize the critical nodes in the power grids. The variety of our solution is preserved, enabling flexible choices by decision makers. Simulations on a realistic power grid dataset demonstrate the capability of our strategy in serving as a guideline for launching attacks in power grids, for it can damage the power grid to the greatest extent in terms of both metrics.

Cascading failure, which can be triggered by both physical and cyber attacks, is among the most critical threats to the security and resilience of power grids. In current literature, researchers investigate the issue of cascading failure on smart grids mainly from the attacker's perspective. From the perspective of a grid defender or operator, however, it is also an important issue to restore the smart grid suffering from cascading failure back to normal operation as soon as possible. In this paper, we consider cascading failure in conjunction with the restoration process involving repairing of the failed nodes/links in a sequential fashion. Based on a realistic power flow cascading failure model, we exploit a Q-learning approach to develop a practical and effective policy to identify the optimal way of sequential restorations for large-scale smart grids. Simulation results on three power grid test benchmarks demonstrate the learning ability and the effectiveness of the proposed strategy.

Offloading computation-intensive blockchain mining tasks to the edge servers (ESs) is a promising solution for blockchain-empowered Industrial Internet of Things (IIoT) because the computing capabilities in IIoT are usually limited, whereas the blockchain mining tasks are computationally intensive. However, the computation offloading solutions for data processing tasks and for blockchain mining tasks have been studied separately. Moreover, most of the existing solutions for offloading assume that all IIoT devices can directly connect to the ESs or cloud data centers. To address these issues, in this paper, we propose a multihop cooperative and distributed computation offloading algorithm that considers the data processing tasks and the mining tasks together for blockchain-empowered IIoT. First, we study the multihop computation offloading problem for both the data processing tasks and the mining tasks to minimize the economic cost of IIoT devices. Second, we formulate the offloading problem as a potential game in which the IIoT devices can make their decisions autonomously and prove the existence of Nash equilibrium (NE) for the game. Third, we design an efficient distributed algorithm based on exchanging messages between IIoT devices to achieve the NE with low computational complexity. Lastly, our experimental results demonstrate that our distributed algorithm scales well as the number of IIoT devices increases and has the minimum system cost compared with other approaches.

Node influence refers to the ability of a node to disseminate information. The faster and wider the node spreads, the more influential it is. With its great theoretical and practical significance, identifying influential nodes in complex networks becomes one of the most attractive research topics in recent years. Consequently, a variety of different methods, such as betweenness, closeness, and pagerank, have been proposed to identify influential nodes. However, most of the existing methods cannot lead to a tradeoff between the ranking accuracy and time complexity, which limits their application on many real-world complex networks. In this paper, we propose a novel and efficient ranking method named semi-local centrality, to evaluate the influence of nodes more accurately. The method performs random walk to collect the influential surround nodes which are used to evaluate the nodes' influence. We use susceptible-infected-recovered (SIR) model to evaluate the performance of our method. The experimental results on four real-world networks show that the proposed method can identify influential nodes more effectively compared with five state-of-the-art methods.

Network theory has been demonstrated as an effective approach for better understanding and analysis of software systems from a systematic perspective. In this paper, we develop a directed and weighted software dependency network model to analyse software systems from a complex network perspective. In particular, to measure the "High Cohesion and Low Coupling" nature of object-oriented software systems, we propose to use a directed and weighted modularity index, which can better reflect the cohesion of software systems. Experiments are conducted on a series of open source object-oriented software systems with various scales, and the results show that the directed and weighted modularity can better characterize software systems with different cohesion.

The issue of traffic congestion on single complex networks has been extensively studied in the past decade. Recently, interconnected network models have been developed to model the interactions between real-world systems. In interconnected networks, the coupling preference, i.e., the way to add coupling links, has great impact on the overall traffic performance. In this paper, we employ a simulated annealing algorithm to find a near-optimal configuration of the coupling links, which effectively balances the traffic loads and improves the overall traffic capacity.

In this paper, we study the traffic performance in communication networks from a complex network perspective. The node usage probability is an effective metric for characterizing the traffic load distribution and how frequently a node is chosen to relay packets in a network. Based on the concept of node usage probability, we propose an effective routing strategy to maintain balanced traffic loads in the network nodes by avoiding overuse of certain nodes. Simulation results show that routing algorithms based on the proposed strategy can effectively balance traffic loads and improve the overall traffic performance.

In this paper, we study the packet routing process in communication networks. For efficient and reliable data transmission, the traffic load should be as uniformly distributed as possible in the network and the average distance travelled by the data should be short. The Internet has been demonstrated to have small-world and scale-free properties in its topology. Under the shortest path routing strategy, the traffic intensity of high degree nodes is much higher, thus causing congestion of the whole network. We propose an adaptive routing algorithm, which takes into consideration both the network structure property and the dynamic traffic information. Simulation results show that the proposed algorithm can effectively balance the traffic in the network and improve the overall traffic performance.

In this paper we study the performance of communication networks from a network science perspective. We consider in particular the effects of the choice of routing algorithms and the kind of network topology on selected areas of performance, and we also study the vulnerability of the networks when subject to selected attack strategies. Contrary to intuition, our results reveal that the removal of a certain number of high-degree nodes in a scale-free network with shortest path routing does not necessarily worsen the overall network performance. Moreover, the scale-free network can perform better when high-degree nodes are coordinated to provide exclusive service to a specific group of nodes.