Finding Cryptocurrency Attack Indicators Using Temporal Logic and Darkweb Data

With the recent prevalence of darkweb/deepweb (D2web) sites specializing in the trade of exploit kits and malware, malicious actors have easy-access to a wide-range of tools that can empower their offensive capability. In this study, we apply concepts from causal reasoning, itemset mining, and logic programming on historical cryptocurrency-related cyber incidents with intelligence collected from over 400 D2web hacker forums. Our goal was to find indicators of cyber threats targeting cryptocurrency traders and exchange platforms from hacker activity. Our approach found interesting activities that, when observed together in the D2web, subsequent cryptocurrency-related incidents are at least twice as likely to occur than they would if no activity was observed. We also present an algorithmic extension to a previously-introduced algorithm called APT-Extract that allows to model new semantic structures that are specific to our application

Measurement and Analysis of the Bitcoin Networks: A View from Mining Pools

Mining pools, the main components of the Bitcoin network, dominate the computing resources and play essential roles in network security and performance aspects. Although many existing measurements of the Bitcoin network are available, little is known about the details of mining pool behaviors (e.g., empty blocks, mining revenue and transaction collection strategies) and their effects on the Bitcoin end users (e.g., transaction fees, transaction delay and transaction acceptance rate). This paper aims to fill this gap with a systematic study of mining pools. We traced over 1.56 hundred thousand blocks (including about 257 million historical transactions) from February 2016 to January 2019 and collected over 120.25 million unconfirmed transactions from March 2018 to January 2019. Then we conducted a board range of measurements on the pool evolutions, labeled transactions (blocks) as well as real-time network traffics, and discovered new interesting observations and features. Specifically, our measurements show the following. 1) A few mining pools entities continuously control most of the computing resources of the Bitcoin network. 2) Mining pools are caught in a prisoner's dilemma where mining pools compete to increase their computing resources even though the unit profit of the computing resource decreases. 3) Mining pools are stuck in a Malthusian trap where there is a stage at which the Bitcoin incentives are inadequate for feeding the exponential growth of the computing resources. 4) The market price and transaction fees are not sensitive to the event of halving block rewards. 5) The block interval of empty blocks is significantly lower than the block interval of non-empty blocks. 6) Feerate plays a dominating role in transaction collection strategy for the top mining pools. Our measurements and analysis help to understand and improve the Bitcoin network.Comment: 13 page