{"title":"The next phase of identifying illicit activity in Bitcoin","authors":"Jack Nicholls, Aditya Kuppa, Nhien-An Le-Khac","doi":"10.1002/nem.2259","DOIUrl":"10.1002/nem.2259","url":null,"abstract":"<p>Identifying illicit behavior in the Bitcoin network is a well-explored topic. The methods proposed over time have generated great insights into the deanonymization of the Bitcoin user base through the clustering of inputs and outputs. With advanced techniques being deployed by Bitcoin users, these heuristics are now being challenged in their ability to aid in the detection of illicit activity. In this paper, we provide a comprehensive list of methods deployed by malicious actors on the network and illicit transaction mining methods. We detail the evolution of the heuristics that are used to deanonymize Bitcoin transactions. We highlight the issues associated with conducting law enforcement investigations and propose recommendations for the research community to address these issues. Our recommendations include the release of public data by exchanges to allow researchers and law enforcement to further protect the network from malicious users. We recommend the enhancement of current heuristics through machine learning methods and discuss how researchers can take the fight head-on against expert cybercriminals.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 5","pages":""},"PeriodicalIF":1.5,"publicationDate":"2024-01-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/nem.2259","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139499005","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Najmun Nisa, Adnan Shahid Khan, Zeeshan Ahmad, Johari Abdullah
{"title":"TPAAD: Two-phase authentication system for denial of service attack detection and mitigation using machine learning in software-defined network","authors":"Najmun Nisa, Adnan Shahid Khan, Zeeshan Ahmad, Johari Abdullah","doi":"10.1002/nem.2258","DOIUrl":"10.1002/nem.2258","url":null,"abstract":"<p>Software-defined networking (SDN) has received considerable attention and adoption owing to its inherent advantages, such as enhanced scalability, increased adaptability, and the ability to exercise centralized control. However, the control plane of the system is vulnerable to denial-of-service (DoS) attacks, which are a primary focus for attackers. These attacks have the potential to result in substantial delays and packet loss. In this study, we present a novel system called Two-Phase Authentication for Attack Detection that aims to enhance the security of SDN by mitigating DoS attacks. The methodology utilized in our study involves the implementation of packet filtration and machine learning classification techniques, which are subsequently followed by the targeted restriction of malevolent network traffic. Instead of completely deactivating the host, the emphasis lies on preventing harmful communication. Support vector machine and K-nearest neighbours algorithms were utilized for efficient detection on the CICDoS 2017 dataset. The deployed model was utilized within an environment designed for the identification of threats in SDN. Based on the observations of the banned queue, our system allows a host to reconnect when it is no longer contributing to malicious traffic. The experiments were run on a VMware Ubuntu, and an SDN environment was created using Mininet and the RYU controller. The results of the tests demonstrated enhanced performance in various aspects, including the reduction of false positives, the minimization of central processing unit utilization and control channel bandwidth consumption, the improvement of packet delivery ratio, and the decrease in the number of flow requests submitted to the controller. These results confirm that our Two-Phase Authentication for Attack Detection architecture identifies and mitigates SDN DoS attacks with low overhead.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 3","pages":""},"PeriodicalIF":1.5,"publicationDate":"2024-01-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/nem.2258","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139515576","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Fractional non-fungible tokens: Overview, evaluation, marketplaces, and challenges","authors":"Wonseok Choi, Jongsoo Woo, James Won-Ki Hong","doi":"10.1002/nem.2260","DOIUrl":"10.1002/nem.2260","url":null,"abstract":"<p>Fractional non-fungible tokens (NFTs) have emerged at the forefront of blockchain innovation, merging tokenization, NFTs, and fractional ownership to democratize access to high-value digital assets. In this paper, we explore the fundamental concepts of blockchain technology, smart contracts, NFTs, and tokenization to lay the groundwork for understanding fractional NFTs. We investigate key ERC standards, including ERC-20, ERC-721, and ERC-1155, which are pivotal in enabling the creation and management of fractional NFTs on the Ethereum blockchain. Then, we present two major processes in fractional NFTs, minting and reconstitution. We develop fractional NFTs based on ERC standards and evaluate their gas consumption. Furthermore, through a comprehensive review of existing platforms, we analyze their minting and reconstitution processes and underlying ERC standards. Challenges, such as regulatory compliance and security, are also examined. We highlight the significance of robust security measures and transparency to build trust in fractional NFT ecosystems. While the field is still evolving, fractional NFTs have the potential to disrupt traditional ownership models and revolutionize industries. We envision fractional NFTs fostering a more inclusive and decentralized digital economy as technology advances and adoption grows.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 4","pages":""},"PeriodicalIF":1.5,"publicationDate":"2024-01-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139462401","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A novel eviction policy based on shortest remaining time for software defined networking flow tables","authors":"Kavi Priya Dhandapani, Mirnalinee Thanganadar Thangathai, Shahul Hamead Haja Moinudeen","doi":"10.1002/nem.2257","DOIUrl":"10.1002/nem.2257","url":null,"abstract":"<div>\u0000 \u0000 <p>Software defined networking is a modern paradigm that divides the control plane from the data plane for improved network manageability. A flow table in the data plane has limited and expensive memory called TCAM. The presence of unwanted flow rules would lead to flow bloat conditions and make the lookup operation inefficient. Eviction schemes based on LRU policy have been widely studied in the literature which preempts the life of the least recently used flow rule and reduces the occupancy of the flow table. LRU considers the past behavior for the eviction of a flow rule. This paper proposes a novel policy that preempts a flow rule by considering its future characteristic, the shortest remaining time (SRT). A rule with a higher probability of being used is avoided from eviction to mitigate the degradation of performance. The modeling of the SRT technique exhibits better utilization of a flow rule that has higher probability of being used. On the other hand, LRU does not guarantee that the evicted flow rule will not be used frequently in the future and it has been shown that an incorrectly evicted flow rule incurs controller delay. The experimental results show that for different traffic rates, SRT has reduced the delay by 15%, reinstallation count by 25%, and jitter by 40%. SRT has increased utilization by 22% compared to LRU.</p>\u0000 </div>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 3","pages":""},"PeriodicalIF":1.5,"publicationDate":"2023-12-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138825536","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Udit Agarwal, Vinay Rishiwal, Sudeep Tanwar, Mano Yadav
{"title":"Blockchain and crypto forensics: Investigating crypto frauds","authors":"Udit Agarwal, Vinay Rishiwal, Sudeep Tanwar, Mano Yadav","doi":"10.1002/nem.2255","DOIUrl":"10.1002/nem.2255","url":null,"abstract":"<p>In the past few years, cryptocurrency has gained widespread acceptance because of its decentralized nature, quick and secure transactions, and potential for investment and speculation. But the increased popularity has also led to increased cryptocurrency fraud, including scams, phishing attacks, Ponzi schemes, and other criminal activities. Although there is little documentation of cryptocurrency fraud, an in-depth study is essential to recognize various scams in different cryptocurrencies. To fill this gap, a study investigated cryptocurrency-related fraud in various cryptocurrencies and provided a taxonomy of crypto-forensics and forensic blockchain. In addition, we have introduced an architecture that integrates artificial intelligence (AI) and blockchain technologies to investigate and protect against instances of cryptocurrency fraud. The suggested design's effectiveness was evaluated using several machine learning (ML) classification algorithms. The conclusion of the evaluation confirmed that the random forest (RF) classifier performed the best, delivering the highest level of accuracy, that is, 97.5%. Once the ML classifiers detect cryptocurrency fraud, the information is securely stored in the InterPlanetary File System (IPFS); the document's hash is also stored in the blockchain using smart contracts. Law enforcement can leverage blockchain technology to secure access to fraudulent cryptographic transactions. The proposed architecture was tested for bandwidth utilization. Despite the potential benefits of blockchain and crypto-forensics, several issues and challenges remain, including privacy concerns, standardization, and difficulty identifying fraud between crypto-currencies. Finally, the paper discusses various problems and challenges in blockchain and crypto forensics to investigate cryptocurrency fraud.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 2","pages":""},"PeriodicalIF":1.5,"publicationDate":"2023-12-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138561650","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
V. Karthik, R. Lakshmi, Salini Abraham, M. Ramkumar
{"title":"Residual based temporal attention convolutional neural network for detection of distributed denial of service attacks in software defined network integrated vehicular adhoc network","authors":"V. Karthik, R. Lakshmi, Salini Abraham, M. Ramkumar","doi":"10.1002/nem.2256","DOIUrl":"10.1002/nem.2256","url":null,"abstract":"<p>Software defined network (SDN) integrated vehicular ad hoc network (VANET) is a magnificent technique for smart transportation as it raises the efficiency, safety, manageability, and comfort of traffic. SDN-integrated VANET (SDN-int-VANET) has numerous benefits, but it is susceptible to threats like distributed denial of service (DDoS). Several methods were suggested for DDoS attack detection (AD), but the existing approaches to optimization have given a base for enhancing the parameters. An incorrect selection of parameters results in a poor performance and poor fit to the data. To overcome these issues, residual-based temporal attention red fox-convolutional neural network (RTARF-CNN) for detecting DDoS attacks in SDN-int-VANET is introduced in this manuscript. The input data is taken from the SDN DDoS attack dataset. For restoring redundancy and missing value, developed random forest and local least squares (DRFLLS) are applied. Then the important features are selected from the pre-processed data with the help of stacked contractive autoencoders (St-CAE), which reduces the processing time of the introduced method. The selected features are classified by residual-based temporal attention-convolutional neural network (RTA-CNN). The weight parameter of RTA-CNN is optimized with the help of red fox optimization (RFO) for better classification. The introduced method is implemented in the PYTHON platform. The RTARF-CNN attains 99.8% accuracy, 99.5% sensitivity, 99.80% precision, and 99.8% specificity. The effectiveness of the introduced technique is compared with the existing approaches.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 3","pages":""},"PeriodicalIF":1.5,"publicationDate":"2023-12-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138561627","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A comprehensive review of blockchain integration in remote patient monitoring for E-health","authors":"Nedia Badri, Leïla Nasraoui, Leïla Azouz Saïdane","doi":"10.1002/nem.2254","DOIUrl":"10.1002/nem.2254","url":null,"abstract":"<p>The integration of the Internet of Things (IoT) with blockchain technology has enabled a significant digital transformation in the areas of E-health, supply chain, financial services, smart grid, and automated contracts. Many E-health organizations take advantage of the <i>game-changing</i> power of blockchain and IoT to improve patient outcomes and optimize internal operational activities. In particular, it proposes a decentralized and evolutive way to model and acknowledge trust and data validity in a peer-to-peer network. Blockchain promises transparent and secure systems to provide new business solutions, especially when combined with smart contracts. In this paper, we provide a comprehensive survey of the literature involving blockchain technology applied to E-health. First, we present a brief background on blockchain and its fundamentals. Second, we review the opportunities and challenges of blockchain in the context of E-health. We then discuss popular consensus algorithms and smart contracts in blockchain in conjunction with E-health. Finally, blockchain platforms are evaluated for their suitability in the realm of IoT-based E-health, including electronic health records, electronic management records, and personal health records, from the perspective of remote patient monitoring.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 2","pages":""},"PeriodicalIF":1.5,"publicationDate":"2023-11-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138513418","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Topology analysis of the Ripple transaction network","authors":"Anan Jin, Yuhang Ye, Brian Lee, Yuansong Qiao","doi":"10.1002/nem.2253","DOIUrl":"10.1002/nem.2253","url":null,"abstract":"<p>The Ripple network is one typical blockchain-based decentralized credit network, which supports money transfer without physical money movement by only transferring the credits between participants. It is critical to obtain a deep understanding on the characteristics of the payment networks while optimizing the network design and transaction routing. This paper presents a comprehensive analysis to the Ripple transaction network, including two subnets formed by the two key functionalities, that is, Ripple Direct Payment Network (RDPN) and Ripple Credit Payment Network (RCPN). The analysis is performed with different network metrics, including clustering coefficient, centrality, and so on. Furthermore, this paper provides an in-depth analysis on the node degrees and edge weights, which reflect the number of transacted accounts of an account and the number of transactions between two accounts. The results show that the network is highly imbalanced and concentrated with a few nodes and edges holding most of the resources. Moreover, RDPN and RCPN show different characteristics in terms of transmitted and received transactions, the senders are more concentrated in RDPN, whereas in RCPN, the receivers are more concentrated.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 2","pages":""},"PeriodicalIF":1.5,"publicationDate":"2023-11-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"135679817","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ziyu Qiu, Zhilei Zhou, Bradley Niblett, Andrew Johnston, Jeffrey Schwartzentruber, Nur Zincir-Heywood, Malcolm I. Heywood
{"title":"Assessing the impact of bag-of-words versus word-to-vector embedding methods and dimension reduction on anomaly detection from log files","authors":"Ziyu Qiu, Zhilei Zhou, Bradley Niblett, Andrew Johnston, Jeffrey Schwartzentruber, Nur Zincir-Heywood, Malcolm I. Heywood","doi":"10.1002/nem.2251","DOIUrl":"10.1002/nem.2251","url":null,"abstract":"<p>In terms of cyber security, log files represent a rich source of information regarding the state of a computer service/system. Automating the process of summarizing log file content represents an important aid for decision-making, especially given the 24/7 nature of network/service operations. We perform benchmarking over eight distinct log files in order to assess the impact of the following: (1) different embedding methods for developing semantic descriptions of the original log files, (2) applying dimension reduction to the high-dimensional semantic space, and (3) assessing the impact of using different unsupervised learning algorithms for providing a visual summary of the service state. Benchmarking demonstrates that (1) word-to-vector embeddings identified by bidirectional encoder representation from transformers (BERT) without “fine-tuning” are sufficient to match the performance of Bag-or-Words embeddings provided by term frequency-inverse document frequency (TF-IDF) and (2) the self-organizing map without dimension reduction provides the most effective anomaly detector.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 1","pages":""},"PeriodicalIF":1.5,"publicationDate":"2023-10-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/nem.2251","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"136261798","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Availability-aware virtual network function placement based on multidimensional universal generating functions","authors":"Kengo Arakawa, Eiji Oki","doi":"10.1002/nem.2252","DOIUrl":"10.1002/nem.2252","url":null,"abstract":"<p>Network function virtualization (NFV) implements network functions as software, which enables flexible, resource-efficient, and rapid provision of network services. In NFV, network services are realized by the service function chain (SFC), which is a chain of virtual network functions (VNFs) linked in the proper order. Both availability and deployment cost are key concerns for network operators providing network services as SFC. This paper proposes a flexible VNF placement model on a per-VNF instance basis that minimizes deployment costs while satisfying availability requirements that may be placed on SFC. This paper uses a multidimensional universal generating function (MUGF) method, which is a multistate system analysis method, to compute the availability of a multistate SFC system with multiple VNFs coexisting on a server. The MUGF method calculates the performance of the entire SFC by combining the performance of servers as determined by applying a continuous-time Markov chain. To reduce the time to compute the SFC availability, we introduce operators to be applied to MUGF and develop an availability computing method. In addition, a heuristic algorithm for determining VNF placement targeting the lowest deployment cost possible while meeting availability requirements is presented. Numerical results show that the proposed model obtains VNF placement with lower cost than the conventional model in all examined cases. The proposed model achieves VNF placement at 58.5%–75.0% of the deployment cost of the conventional model for the same SFC availability requirements.</p>","PeriodicalId":14154,"journal":{"name":"International Journal of Network Management","volume":"34 2","pages":""},"PeriodicalIF":1.5,"publicationDate":"2023-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/nem.2252","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"135265795","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}