With the dramatically increasing deployment of IoT devices, storing and protecting the large volume of IoT data has become a significant issue. Traditional cloud-based IoT structures impose extremely high computation and storage demands on the cloud servers. Meanwhile, the strong dependencies on the centralized servers bring significant trust issues. To mitigate these problems, we propose a distributed data storage scheme employing blockchain and cetrificateless cryptography. Our scheme eliminates the traditional centralized servers by leveraging the blockchain miners who perform "transaction" verifications and records audit with the help of certificateless cryptography. We present a clear definition of the transactions in a non-cryptocurrency system and illustrate how the transactions are processed. To the best of our knowledge, this is the first work designing a secure and accountable IoT storage system using blockchain. Additionally, we extend our scheme to enable data trading and elaborate how data trading can be efficiently and effectively achieved.

The modern industrial control systems now exhibit an increasing connectivity to the corporate Internet technology networks so as to make full use of the rich resource on the Internet. The increasing interaction between industrial control systems and the outside Internet world, however, has made them an attractive target for a variety of cyber attacks, raising a great need to secure industrial control systems. Intrusion detection technology is one of the most important security precautions for industrial control systems. It can effectively detect potential attacks against industrial control systems. In this survey, we elaborate on the characteristics and the new security requirements of industrial control systems. After that, we present a new taxonomy of intrusion detection systems for industrial control systems based on different techniques: protocol analysis based, traffic mining based, and control process analysis based. In addition, we analyze the advantages and disadvantages of different categories of intrusion detection systems and discuss some future developments of intrusion detection systems for industrial control systems, in order to promote further research on intrusion detection technology for industrial control systems.

With dramatic developments of blockchain technology, a number of blockchain-based applications emerge rapidly, among which the incorporation of blockchain into IoT is one of the most valued research direction. Such powerful incorporation is adouble-sided sword, i.e., it can benefit both individuals and society but has the vulnerability to coin hopping attack that is a new type of pool mining attack and hard to happen in traditional blockchain networks. In this paper, we theoretically prove the feasibility of coin hopping attack, deeply analyze the conditions of attack implementation, and comprehensively investigate the impacts of coin hopping attack. Moreover, some defense strategies are addressed. To our best knowledge, this paper is the first work targeting coin hopping attack.

With the development of electric vehicles, the shortage of charging piles (CPs) has gradually been exposed. In response to this situation, CP operators have taken private CPs into the shared charging system. Due to the lack of maintenance personnel for private CPs that join shared charging, users often face the problems of damaged CPs and poor service attitudes of CP owners. Reputation solutions based on third-party platforms face a problem of single-point failures and reputation solutions based on blockchain face problems of storage and query efficiency. To improve storage and query efficiency, this article proposes a multichain charging model that stores different types of information on different blockchains. However, it faces the problem of unreliable information called across chains, when calculating reputation across chains. Therefore, this article proposes a cross-chain trusted smart contract ( $C_{2}T$ smart contract) to ensure the authenticity, real-time, and interchain write mutual exclusion of cross-chain information, making reputation calculation in the multichain charging model more convenient and more accurate. Especially, we propose a data mutual trust mechanism based on Merkle proof to ensure the authenticity of cross-chain information and prevent forged information from participating in calculating reputation. Furthermore, we present a data structure composed of multiple counting Bloom filters (MCBFs) to verify the real time of information and filter out non-real-time information, thereby ensuring the real time of the calculated reputation. In addition, we put forward an algorithm to guarantee the interchain write mutual exclusion by hash mutexes, making the reputation calculation process more accurate and complete. The security analysis and experimental results demonstrate that $C_{2}T$ smart contract is feasible in practice.

Third-party libraries (TPLs) are extensively utilized by developers to expedite the software development process and incorporate external functionalities. Nevertheless, insecure TPL reuse can lead to significant security risks. Existing methods, which involve extracting strings or conducting function matching, are employed to determine the presence of TPL code in the target binary. However, these methods often yield unsatisfactory results due to the recurrence of strings and the presence of numerous similar non-homologous functions. Furthermore, the variation in C/C++ binaries across different optimization options and architectures exacerbates the problem. Additionally, existing approaches struggle to identify specific pieces of reused code in the target binary, complicating the detection of complex reuse relationships and impeding downstream tasks. And, we call this issue the poor interpretability of TPL detection results. In this article, we observe that TPL reuse typically involves not just isolated functions but also areas encompassing several adjacent functions on the Function Call Graph (FCG). We introduce LibAM, a novel Area Matching framework that connects isolated functions into function areas on FCG and detects TPLs by comparing the similarity of these function areas, significantly mitigating the impact of different optimization options and architectures. Furthermore, LibAM is the first approach capable of detecting the exact reuse areas on FCG and offering substantial benefits for downstream tasks. To validate our approach, we compile the first TPL detection dataset for C/C++ binaries across various optimization options and architectures. Experimental results demonstrate that LibAM outperforms all existing TPL detection methods and provides interpretable evidence for TPL detection results by identifying exact reuse areas. We also evaluate LibAM’s scalability on large-scale, real-world binaries in IoT firmware and generate a list of potential vulnerabilities for these devices. Our experiments indicate that the Area Matching framework performs exceptionally well in the TPL detection task and holds promise for other binary similarity analysis tasks. Last but not least, by analyzing the detection results of IoT firmware, we make several interesting findings, for instance, different target binaries always tend to reuse the same code area of TPL. The datasets and source code used in this article are available at https://github.com/Siyuan-Li201/LibAM .

Vulnerability is a major threat to software security. It has been proven that binary code similarity detection approaches are efficient to search for recurring vulnerabilities introduced by code sharing in binary software. However, these approaches suffer from high false-positive rates (FPRs) since they usually take the patched functions as vulnerable, and they usually do not work well when binaries are compiled with different compilation settings. To this end, we propose an approach, named Robin , to confirm recurring vulnerabilities by filtering out patched functions. Robin is powered by a lightweight symbolic execution to solve the set of function inputs that can lead to the vulnerability-related code. It then executes the target functions with the same inputs to capture the vulnerable or patched behaviors for patched function filtration. Experimental results show that Robin achieves high accuracy for patch detection across different compilers and compiler optimization levels respectively on 287 real-world vulnerabilities of 10 different software. Based on accurate patch detection, Robin significantly reduces the false-positive rate of state-of-the-art vulnerability detection tools (by 94.3% on average), making them more practical. Robin additionally detects 12 new potentially vulnerable functions.