abstract
With the rapid growth of blockchain, smart contract,
which is the computer program executed on blockchain systems,
has played an important role especially in the trade of cryptcurrency.
However, smart contracts are utilized to commit some crimes or attacks
because they often hold a large amount of cryptcurrency.
Thus, to enhance the security of smart contract is an urgent need.
There exists three types of crimes regarding smart contract, namely,
attack using vulnerabilities,
trade between criminals, and fraud.
Some researchers reported that many smart contracts have vulnerabilities,
and attackers exploit them to steal cryptcurrency or attack system itself
like DoS attack.
Another type of crime is to trade criminal information for rewards
between criminals using smart contracts.
Especially in recent years, fraud acts including phishing have become
a big problem on blockchain, and smart contracts are utilized to support them.
These crimes have occured due to the presense of Malicious Smart Contract
(MSC).
Thus, the systems which detect MSC are needed to prevent these crimes.
Though MSC is a smart contract which shows malicious activities,
there does not exist a clear definition.
As a result, the word "malicious" is used in different ways among researchers.
In this situation, it is difficult to detect whole MSCs.
This is because different types of MSC have different malicious activities,
meaning that detection systems corresponded to each type of MSC are needed.
Therefore, the classification of MSC is required.
Some researchers classify MSC into
two types: Vulnerable Smart Contract (VSC) related to vulnerability
and Criminal Smart Contract (CSC) related to trade between criminals.
In this classification model, however,
there does not exist a type of MSC corresponded to fraud activities.
To overcome this problem,
we propose a new standpoint that MSC should be classified into VSC,
CSC and Fraudulent Smart Contract (FSC),
which supports frauds. By introducing this standpoint,
to detect whole MSCs will be realized by constructing detection systems
of each MSC simultaneously.
While there exists a lot of works of detecting VSC and a few CSC works
have also proposed, a field of FSC detection has not developed.
Some researchers proposed detection systems of malicious accounts.
In this field, "malicious" means fraud activities.
Thus, we consider that these kinds of works are similar to detection
of FSC and can be applied.
These studies mainly use machine learning to detect malicious accounts.
However, their models only consider graph-based features constructed
from external transaction and address data,
and not focus on other features.
Therefore, as a future work,
considering internal transaction and smart contract code-based feature
like opcode is worth working.
abstract
With the rapid growth of Internet of Things (IoT) devices,
a lot of IoT malware has been created,
and the security against IoT malware,
especially the family classification, has become a more important issue.
There exist three requirements which classification systems
must achieve: detection of new families,
precise classification for sequential inputs,
and being independent of computer architectures.
However, existing methods do not satisfy them simultaneously.
In this paper, we propose a realtime IoT malware classification system
based on pending samples.
In order to detect new families and to classify sequential inputs precisely,
we introduce the concept of "pending samples".
This concept is useful when heterogeneous inputs which are difficult
to classify instantly come into the system.
This is because the system can postpone classifying them until
similar samples come.
Once similar samples are gathered, we regard these samples
as a new cluster, meaning that detecting new families is achieved.
Moreover, we use printable strings to satisfy the requirement
of being independent of architectures
because strings are common among different architectures.
Our results show the ability to detect new families demonstrated
by finding new clusters after applying our algorithm to
the initial clusters.
Furthermore, our new clustering algorithms achieves a 0.130 higher
V-measure compared to the k-means algorithm,
which is the representative clustering algorithm.