The concept of Bitcoin was first introduced by an unknown individual (or a group of people) named Satoshi Nakamoto before it was released as open-source software in 2009. Bitcoin is a peer-to-peer cryptocurrency and a decentralized worldwide payment system for digital currency where transactions take place among users without any intermediary. Bitcoin transactions are performed and verified by network nodes and then registered in a public ledger called blockchain, which is maintained by network entities running Bitcoin software. To date, this cryptocurrency is worth close to 150 billion of dollars and widely traded across the world. However, as Bitcoin’s popularity grows, security concerns are coming to the forefront. Overall, Bitcoin security inevitably depends upon the distributed protocols-based stimulant-compatible proof-of-work that is being run by network entities called miners, who are anticipated to primarily maintain the blockchain (ledger). As a result, many researchers are exploring new threats in the entire system, introducing new countermeasures, and therefore anticipating new security trends. In this survey paper, we introduce an intensive study that explores the key security concerns. We first start by presenting a global overview of the Bitcoin protocol as well as its major components. Next, we detail the existing threats and weaknesses of the Bitcoin system and its main technologies including the blockchain protocol. Last, we discuss the current existing security studies and solutions and summarize open research challenges and trends of future research for Bitcoin security.

Software-Defined networking (SDN) is a networking paradigm to enable dynamic, flexible, and programmatically efficient configuration of networks to revolutionize network control and management via separation of the control plane and data plane. The SDN technology has evolved in response to the demands from large data centers toward all types of networks, from IoT, enterprise, to ISP networks. On the one hand, SDN has provided solutions for high-demand resources, managing unpredictable data traffic patterns, and rapid network reconfiguration. It is further used to enhance network virtualization and security. On the other hand, SDN is still subject to many traditional network security threats. It also introduces new security vulnerabilities, primarily due to its logically centralized control plane infrastructure and functions. In this paper, we conduct a comprehensive survey on the core functionality of SDN from the perspective of secure communication infrastructure at different scales. A specific focus is put forward to address the challenges in securing SDN-based communications, with efforts taken up to address them. We further categorize the appropriate solutions for specific threats at each layer of SDN infrastructures. Lastly, security implications and future research trends are highlighted to provide insights for future research.

Attackers usually use a command and control (C2) server to manipulate the communication. In order to perform an attack, threat actors often employ a domain generation algorithm (DGA), which can allow malware to communicate with C2 by generating a variety of network locations. Traditional malware control methods, such as blacklisting, are insufficient to handle DGA threats. In this paper, we propose a machine learning framework for identifying and detecting DGA domains to alleviate the threat. We collect real-time threat data from the real-life traffic over a one-year period. We also propose a deep learning model to classify a large number of DGA domains. The proposed machine learning framework consists of a two-level model and a prediction model. In the two-level model, we first classify the DGA domains apart from normal domains and then use the clustering method to identify the algorithms that generate those DGA domains. In the prediction model, a time-series model is constructed to predict incoming domain features based on the hidden Markov model (HMM). Furthermore, we build a deep neural network (DNN) model to enhance the proposed machine learning framework by handling the huge dataset we gradually collected. Our extensive experimental results demonstrate the accuracy of the proposed framework and the DNN model. To be precise, we achieve an accuracy of 95.89% for the classification in the framework and 97.79% in the DNN model, 92.45% for the second-level clustering, and 95.21% for the HMM prediction in the framework.

Smart city is a transformative and progressive vision that aims to revolutionize infrastructure systems and public services in an urban area with modern information technologies. Its ultimate goal is to greatly improve the livability Quality of Service (QoS) of its citizens and to optimize the utilization of its assets and natural resources sustainably. One of the key technical attributes in smart cities is to deploy a large number of sensors to collect data to enable real-time and intelligent decisions for various city functions and citizen needs. Many of the data have strict security requirements as they are either private to citizens or sensitive to critical infrastructures. As a result, how to securely and efficiently deliver and process the dramatically increasing volume of data becomes one of the grand challenges in materializing the smart city vision. In recent years, Software-Defined Networking (SDN) has emerged as a leading communication infrastructure candidate for smart cities. While many efforts have existed to research, prototype, and even deploy SDN on a small scale for some smart city applications, there is still a lack of cohesive understanding about SDN’s impact on the secure communication need of smart cities. In this paper, we conduct a comprehensive survey of the core functionality of SDN from the perspective of secure communication infrastructure at different scales. A specific focus is put on the security threats and challenges in accordance with SDN plane-based architectures for various smart city-enabled applications. We further systematically categorize the state-of-art solutions and proposals to apply SDN to support typical smart city applications, such as transportation, health, and energy applications. Lastly, we cast a holistic view of future research trends.

Phishing is one of the most harmful social engineering techniques to subdue end users where threat actors find a chance to gain access to critical information systems. A common approach in phishing is through the use of e-mail communication with an embedded hyperlink. The detection and mitigation of phishing attacks is a grand challenge due to the complexity of current phishing attacks. Existing techniques are often too time-consuming to be used in the real world in terms of detection and mitigation time. Likewise, they employ static detection rules that are not effective in the real world due to the dynamics of phishing attacks. In this paper, we present PhishLimiter, a new detection and mitigation approach, where we first propose a new technique for Deep Packet Inspection (DPI) and then leverage it with Software-Defined Networking (SDN) to identify phishing activities through e-mail and webbased communication. The proposed DPI approach consists of two components, phishing signature classification and real-time DPI. Based on the programmability of SDN, we develop Store and Forward (SF) mode and the Forward and Inspect (FI) mode to direct network traffic by using an Artificial Neural Network (ANN) model to classify phishing attack signatures and design the real-time DPI so that PhishLimiter can flexibly address the dynamics of phishing attacks in the real world. PhishLimiter also provides better network traffic management for containing phishing attacks since it has the global view of a network through SDN. Furthermore, we evaluate PhishLimiter using a real-world testbed environment and datasets consisting of real-world email with embedded links. Our extensive experimental study shows that PhishLimiter provides an effective and efficient solution to deter malicious activities.

SYN flood attacks (half‐open attacks) have been proven a serious threat to software‐defined networking (SDN)‐enabled infrastructures. A variety of intrusion detection and prevention systems (IDPS) have been introduced for identifying and preventing such security threats, but they often result in significant performance overhead and response time. Therefore, those existing approaches are inflexible for large‐scale networks and real‐time applications. For this reason, a novel and adaptive threshold‐based kernel‐level intrusion detection and prevention system by leveraging SDN capabilities are proposed. The proposed systems to detect and mitigate the aforementioned threats within an SDN over widely used traditional IDPS technologies, Snort and Zeek, are comparatively examined. The approach is evaluated using a mixture of fundamental adverse attacks and SDN‐specific threats on a real‐world testbed. The experimental results demonstrate the efficacy of the mechanism to detect and mitigate SYN flood attacks within an SDN environment.