Directed Graph based models of a blockchain that capture accounts as nodes and transactions as edges, evolve over time. This temporal nature of a blockchain model enables us to understand the behavior (malicious or benign) of the accounts. Predictive classification of accounts as malicious or benign could help users of the permissionless blockchain platforms to operate in a secure manner. Motivated by this, we introduce temporal features such as burst and attractiveness on top of several already used graph properties such as the node degree and clustering coefficient. Using identified features, we train various Machine Learning (ML) models and identify the algorithm that performs the best in detecting malicious accounts. We then study the behavior of the accounts over different temporal granularities of the dataset before assigning them malicious tags. For the Ethereum blockchain, we identify that for the entire dataset—the ExtraTreesClassifier performs the best among supervised ML algorithms. On the other hand, using cosine similarity on top of the results provided by unsupervised ML algorithms such as K-Means on the entire dataset, we were able to detect 554 more suspicious accounts. Further, using behavior change analysis for accounts, we identify 814 unique suspicious accounts across different temporal granularities.

The explosive growth of non-fungible tokens (NFTs) on Web3 has created a new frontier for digital art and collectibles and an emerging space for fraudulent activities. This study provides an in-depth analysis of NFT rug pulls, the fraudulent schemes that steal investors’ funds. From a curated dataset of 760 rug pulls across 10 NFT marketplaces, we examine these schemes’ structural and behavioral properties, identify the characteristics and motivations of rug pullers, and classify NFT projects into 20 groups based on creators’ association with their accounts. Our findings reveal that repeated rug pulls account for a significant proportion of the rise in NFT-related cryptocurrency crimes, with one NFT creator attempting 37 rug pulls within 3 months. Additionally, we identify the largest group of creators influencing the majority of rug pulls and demonstrate the connection between rug pullers of different NFT projects using the same wallets to store and move money. Our study contributes to understanding NFT market risks and provides insights for designing preventative strategies to mitigate future losses.

We present evidence and characterization of host congestion in production clusters: adoption of high-bandwidth access links leading to emergence of bottlenecks within the host interconnect (NIC-to-CPU data path). We demonstrate that contention on existing IO memory management units and/or the memory subsystem can significantly reduce the available NIC-to-CPU bandwidth, resulting in hundreds of microseconds of queueing delays and eventual packet drops at hosts (even when running a state-of-the-art congestion control protocol that accounts for CPU-induced host congestion). We also discuss implications of host interconnect congestion to design of future host architecture, network stacks and network protocols.

The Internet of Things (IoT) concept has attracted a lot of attention from the research and innovation community for a number of years already. One of the key drivers for this hype towards the IoT is its applicability to a plethora of different application domains. However, infrastructures enabling experimental assessment of IoT solutions are scarce. Being able to test and assess the behavior and the performance of any piece of technology (i.e., protocol, algorithm, application, service, etc.) under real-world circumstances is of utmost importance to increase the acceptance and reduce the time to market of these innovative developments. This paper describes the federation of eleven IoT deployments from heterogeneous application domains (e.g., smart cities, maritime, smart building, crowd-sensing, smart grid, etc.) with over 10,000 IoT devices overall which produce hundreds of thousands of observations per day. The paper summarizes the resources that are made available through a cloud-based platform. The main contributions from this paper are twofold. In the one hand, the insightful summary of the federated data resources are relevant to the experimenters that might be seeking for an experimental infrastructure to assess their innovations. On the other hand, the identification of the challenges met during the testbed integration process, as well as the mitigation strategies that have been implemented to face them, are of interest for testbed providers that can be considering to join the federation.

Different malicious activities occur in cryptocurrency-based permissionless blockchains such as Ethereum and Bitcoin. Some activities are due to the exploitation of vulnerabilities which are present in the blockchain infrastructure, some activities target its users through social engineering techniques, while some activities use it to facilitate different malicious activities. Since cryptocurrency-based permissionless blockchains provide pseudonymity to its users, bad actors prefer to carry out transactions related to malicious activities on them. Towards this, we aim at automatically flagging blockchain accounts as suspects that indulge in malicious activities, thus reducing the unintended support that cryptocurrency-based permissionless blockchains provide to malicious actors. We first use the cosine similarity (CS) metrics to study the similarities between the feature vector of accounts associated with different malicious activities and find that most of the malicious activities associated with the Ethereum blockchain behave similarly. We then use the K-Means clustering algorithm to check if accounts associated with similar malicious activities cluster together. We also study the effect of bias on the performance of a machine learning (ML) algorithm, due to the number of accounts associated with malicious activity. We then compare the different state-of-the-art models and identify that Neural Networks (NNs) are resistant to bias associated with a malicious activity and are also robust against adversarial attacks. The previously used ML algorithms for identifying malicious accounts also show bias towards an over-represented malicious activity.