Smart contracts are programs deployed on the blockchain. The security issues of smart contracts have become the focus in recent years. Comments have been widely used to improve the readability of programs. Nevertheless, comments and code are not always consistent in smart contracts because of the modification of developers based on token standards and code reuse. These inconsistencies can mislead developers and even pose security risks. We call comment-code inconsistencies as CCIs. In particular, permission-related CCIs can easily expose vulnerabilities in smart contracts, causing funds to be hacked. In this work, we employ pre-training techniques to detect CCIs on permission in smart contracts. Specifically, we collect 3511 comments from Ethereum and Defi projects. Firstly, we utilize BERT to classify permission comments. Then, we extract related function implementations of each permission comment using the compilation technique and adopt CodeT5 to embed comment-code pairs. Finally, we make use of BiLSTM to predict inconsistencies. The evaluation results show that our proposed approach performs better than the existing tools in both precision and recall. Moreover, considering the two stages, it achieves an accuracy of 95.2% and 91.5% in permission comment recognition and permission CCI detection, respectively.
With the development of new technologies such as artificial intelligence, the Internet of Things, and big data, Internet network attack methods have become increasingly complex and diverse, resulting in increasingly serious security issues. To counter these threats, enterprises and individuals need to adopt more advanced and comprehensive network security defense measures. The deception defense strategy effectively achieves proactive network security protection by increasing the difficulty and cost of attacks for attackers. However, the asymmetry of information between the defense and attack parties limits the application of classical game theory. Based on the theory of supergame, this article considers the complexity of network topology and the uncertainty of both defense and attack parties, establishes a multi-round dynamic game model, and formulates a deception defense strategy for network attacks under incomplete information. Simulation results indicate that the proposed deception defense strategy can significantly reduce the false alarm rate by approximately 75% and extend the system's secure failure time.
Insider threat are actions by insiders that violate an organization's security policies, and have become a serious challenge to organizational security in digital and cloud-based environments nowadays. As a result, insider threat detection has become one of the key strategies to secure organizational information assets. However, existing methods are costly to maintain a model for each user, and in order to maintain a high detection accuracy, these methods are overly sensitive to user behavior, which leads to a high false positive and negatively affects the detection of user behavior. In this paper, we propose a lower-cost insider threat detection framework (LITD) based on user cluster and user behavior analysis. LITD clusters user classes according to user behavioral features, and trains deep learning models for each user class instead of a single user, thereby reducing the detection cost. In addition, we design a log content detection model to detect threatening information in specific log content. A risk detection and assessment model is built to use a risk list for final determination, and it significantly reduces the false positive while ensuring detection accuracy based on the combined assessment of multiple risks. A series of experiments are conducted using the publicly available CERT dataset, the results show that LITD outperforms state-of-the-art methods in the four metrics of Accuracy, Precision, Recall, and False Positive Rate (FPR), with the FPR metric being considerably lower.
As the amount of data in society increases, the importance of collecting and storing data while protecting privacy also increases. In particular, protecting personal numeric data is essential for crowdsourcing and big data analytics. Although various methods have been proposed for specific analysis purposes such as mean estimation, methods for storing numeric values themselves are still lacking. Furthermore, no method that can flexibly collect all data information with multiple attributes exists. Therefore, this study first generalizes the piecewise mechanism (PM), the state-of-the-art method in collecting a single numeric value, and proposes a new mechanism that achieves a truly smaller variance of the collected private values than the original one. Subsequently, we enhance our generalized PM for collecting multidimensional numeric data while considering a situation in which each attribute information has its own privacy level. The proposed mechanism is optimal in terms of privacy guarantees for the entire dataset, and is highly advisable for collecting all information with high privacy assurance. We further evaluate our mechanism both theoretically and experimentally and show that it outperforms existing methods. We measure the accuracy of the collected private values using real census data as well, demonstrating the utility of our mechanism. Overall, this study is an important step toward the safe and accurate collection of numeric data. The codes for the experiments are available at https://eithub.com/ay0408/Generalized-PM.
Crowdsensing in edge computing leverages the low-latency and high-efficiency communications to conduct large-scale data sensing and truth discovery at a reduced cost. Privacy-preserving truth discovery (PPTD) has emerged as a promising technique for securely inferring truthful information from noisy, incomplete, or conflicting data from multiple sources. However, designing a secure and reliable PPTD for edge-based crowdsensing meets challenges due to the heterogeneous nature of the edge computing environment, which renders edge nodes susceptible to breakdown and collusion. Existing PPTDs lack simultaneous consideration of this dropout problem and collusion attacks. This study tackles the challenges by proposing a PPTD scheme for edge-based crowdsensing with configurable reliability, which enhances security with respect to collusion attacks and dropout problems in the meantime. The scheme treats edge nodes with various reliability levels and offers a flexible way to configure their reliability. First, vector space secret sharing is employed as a fundamental building block to construct methods for secure multi-party computation. Then, protocols for PPTD involving workers and edge nodes are devised. A formal analysis is conducted for the security and performance, followed by experiments showing its effectiveness.
