arXiv subjects

Nasrin Sohrabi

Publications and source records attributed to Nasrin Sohrabi.

11 recordsLinked to original sources

arXiv2026

FDIFormer:Protocol-Aware Transformer Learning for False Data Injection Attack Detection in Smart Grid Networks

Smart grids use communication networks and intelligent electronic devices for reliable, automated power system operation. As these systems become more interconnected, they are increasingly exposed to cyberattacks such as message tampering, false command injection, and denial-of-service attacks. A particularly concerning threat is False Data Injection (FDI), where attackers manipulate communication messages by deleting, modifying, or adding packets. This is especially critical in IEC 61850-based substations, where Generic Object-Oriented Substation Event (GOOSE) messages deliver time-critical protection and control information between devices. Detecting FDI attacks in IEC 61850 GOOSE traffic is challenging because malicious packets closely resemble legitimate communication, and many existing detection methods depend heavily on manually engineered protocol features requiring extensive domain knowledge and limited generalisability. This paper proposes FDIFormer, a feature-engineering-free framework for FDI attack detection using structured textual representations of GOOSE packet sequences and fine-tuned pre-trained Transformer models. The framework converts protocol packets into structured text windows that capture communication behaviour, enabling Transformer models to learn attack-related patterns directly from the data. Evaluated on the QUT-ZSS-2023-GOOSE dataset under a scenario-level three-fold cross-validation strategy, GraphCodeBERT achieves an MCC of 0.595 +/- 0.122, comparable to the strongest feature-engineered baseline, XGBoost (MCC = 0.604 +/- 0.121), while improving MCC by 0.133 over TF-IDF baselines. These findings show that pre-trained Transformer representations offer an effective technique for FDI attack detection in IEC 61850 GOOSE communication without relying on manually engineered protocol features.

cs.CR↗

arXiv2026

Multi-Round Visibility: A Post-Consensus Ordering Layer for DAG-Based BFT

Directed acyclic graph (DAG)-based Byzantine Fault-Tolerant (BFT) protocols achieve high throughput by decoupling dissemination from agreement and allowing many vertices to be committed concurrently. This same concurrency, however, weakens ordering evidence at the execution boundary: once units are committed in a shared DAG frontier, their final linearization is driven by traversal or deterministic tie-breaking rather than verifiable structural precedence. Prior fair-ordering designs address ambiguity by collecting or reconstructing transaction-level ordering evidence within the consensus workflow. While effective, this couples ordering with agreement and places ordering logic on the critical path. This paper presents Multi-Round Visibility (MRV), a post-consensus structural ordering layer for DAG-based BFT that reinterprets the committed DAG as an ordering evidence substrate. Committed vertices inherently carry authenticated creator, round, and ancestry metadata, enabling replicas to derive multi-round structural visibility without extra consensus-path messages. MRV accumulates this visibility within a bounded evidence horizon, compares concurrently committed atomic units of fairness (AUFs) after they coexist in the DAG, and derives precedence constraints from Byzantine-robust visibility advantages. When the DAG lacks such constraints, MRV exposes and resolves the remaining ambiguity through deterministic graph completion rather than hiding it inside traversal rules. We implement MRV on a Narwhal/Tusk-based prototype. Evaluation across 5-50 replicas under various fault settings shows MRV preserves the high-throughput regime of the DAG-BFT stack, proving it provides post-consensus structural ordering without burdening the consensus-critical path.

cs.DC↗

arXiv2026

Evaluating the Vulnerability Landscape of LLM-Generated Smart Contracts

Large language models (LLMs) have been widely adopted in modern software development lifecycles, where they are increasingly used to automate and assist code generation, significantly improving developer productivity and reducing development time. In the blockchain domain, developers increasingly rely on LLMs to generate and maintain smart contracts, the immutable, self-executing components of decentralized applications. Because deployed smart contracts cannot be modified, correctness and security are paramount, particularly in high-stakes domains such as finance and governance. Despite this growing reliance, the security implications of LLM-generated smart contracts remain insufficiently understood. In this work, we conduct a systematic security analysis of Solidity smart contracts generated by state-of-the-art LLMs, including ChatGPT, Gemini, and Sonnet. We evaluate these contracts against a broad set of known smart contract vulnerabilities to assess their suitability for direct deployment in production environments. Our extensive experimental study shows that, despite their syntactic correctness and functional completeness, LLM-generated smart contracts frequently exhibit severe security flaws that could be exploited in real-world settings. We further analyze and categorize these vulnerabilities, identifying recurring weakness patterns across different models. Finally, we discuss practical countermeasures and development guidelines to help mitigate these risks, offering actionable insights for both developers and researchers. Our findings aim to support safe integration of LLMs into smart contract development workflows and to strengthen the overall security of the blockchain ecosystem against future security failures.

cs.CR↗

arXiv2025

How To Cook The Fragmented Rug Pull?

Existing rug pull detectors assume a simple workflow: the deployer keeps liquidity pool (LP) tokens and performs one or a few large sells (within a day) that collapse the pool and cash out. In practice, however, many real-world exits violate these assumptions by splitting the attack across both time and actor dimensions: attackers break total extraction into many low-impact trades and route proceeds through multiple non-owner addresses, producing low-visibility drains. We formalize this family of attacks as the fragmented rug pull (FRP) and offer a compact recipe for a slow-stewed beef special: (i) keep the lid on (to preserve LP control so on-chain extraction remains feasible), (ii) chop thin slices (to split the total exit volume into many low-impact micro-trades that individually fall below impact thresholds), and (iii) pass the ladle (to delegate sells across multiple wallets so that each participant takes a small share of the extraction). Technically, we define three atomic predicate groups and show that their orthogonal combinations yield evasive strategies overlooked by prior heuristics (USENIX Sec 19, USENIX Sec 23). We validate the model with large-scale measurements. Our corpus contains 303,614 LPs, among which 105,434 are labeled as FRP pools. The labeled subset includes 34,192,767 pool-related transactions and 401,838 inflated-seller wallets, involving 1,501,408 unique interacting addresses. Notably, owner-wallet participation in inflated selling among FRP-flagged LPs has declined substantially (33.1% of cases), indicating a shift in scam behavior: the liquidity drain is no longer held on the owner wallet. We also detected 127,252 wallets acting as serial scammers when repeatedly engaging in inflated selling across multiple FRP LPs. Our empirical findings demonstrate that the evasive strategies we define are widespread and operationally significant.

cs.CR↗

arXiv2025

Proof-Carrying Fair Ordering: Asymmetric Verification for BFT via Incremental Graphs

Byzantine Fault-Tolerant (BFT) consensus protocols ensure agreement on transaction ordering despite malicious actors, but unconstrained ordering power enables sophisticated value extraction attacks like front running and sandwich attacks - a critical threat to blockchain systems. Order-fair consensus curbs adversarial value extraction by constraining how leaders may order transactions. While state-of-the-art protocols such as Themis attain strong guarantees through graph-based ordering, they ask every replica to re-run the leader's expensive ordering computation for validation - an inherently symmetric and redundant paradigm. We present AUTIG, a high-performance, pluggable order-fairness service that breaks this symmetry. Our key insight is that verifying a fair order does not require re-computing it. Instead, verification can be reduced to a stateless audit of succinct, verifiable assertions about the ordering graph's properties. AUTIG realizes this via an asymmetric architecture: the leader maintains a persistent Unconfirmed-Transaction Incremental Graph (UTIG) to amortize graph construction across rounds and emits a structured proof of fairness with each proposal; followers validate the proof without maintaining historical state. AUTIG introduces three critical innovations: (i) incremental graph maintenance driven by threshold-crossing events and state changes; (ii) a decoupled pipeline that overlaps leader-side collection/update/extraction with follower-side stateless verification; and (iii) a proof design covering all internal pairs in the finalized prefix plus a frontier completeness check to rule out hidden external dependencies. We implement AUTIG and evaluate it against symmetric graph-based baselines under partial synchrony. Experiments show higher throughput and lower end-to-end latency while preserving gamma-batch-order-fairness.

cs.DC↗

arXiv2025

Slow is Fast! Dissecting Ethereum's Slow Liquidity Drain Scams

We identify the slow liquidity drain (SLID) scam, an insidious and highly profitable threat to decentralized finance (DeFi), posing a large-scale, persistent, and growing risk to the ecosystem. Unlike traditional scams such as rug pulls or honeypots (USENIX Sec'19, USENIX Sec'23), SLID gradually siphons funds from liquidity pools over extended periods, making detection significantly more challenging. In this paper, we conducted the first large-scale empirical analysis of 319,166 liquidity pools across six major decentralized exchanges (DEXs) since 2018. We identified 3,117 SLID affected liquidity pools, resulting in cumulative losses of more than US$103 million. We propose a rule-based heuristic and an enhanced machine learning model for early detection. Our machine learning model achieves a detection speed 4.77 times faster than the heuristic while maintaining 95% accuracy. Our study establishes a foundation for protecting DeFi investors at an early stage and promoting transparency in the DeFi ecosystem.

cs.CR↗

arXiv2025

FedLAD: A Linear Algebra Based Data Poisoning Defence for Federated Learning

Sybil attacks pose a significant threat to federated learning, as malicious nodes can collaborate and gain a majority, thereby overwhelming the system. Therefore, it is essential to develop countermeasures that ensure the security of federated learning environments. We present a novel defence method against targeted data poisoning, which is one of the types of Sybil attacks, called Linear Algebra-based Detection (FedLAD). Unlike existing approaches, such as clustering and robust training, which struggle in situations where malicious nodes dominate, FedLAD models the federated learning aggregation process as a linear problem, transforming it into a linear algebra optimisation challenge. This method identifies potential attacks by extracting the independent linear combinations from the original linear combinations, effectively filtering out redundant and malicious elements. Extensive experimental evaluations demonstrate the effectiveness of FedLAD compared to five well-established defence methods: Sherpa, CONTRA, Median, Trimmed Mean, and Krum. Using tasks from both image classification and natural language processing, our experiments confirm that FedLAD is robust and not dependent on specific application settings. The results indicate that FedLAD effectively protects federated learning systems across a broad spectrum of malicious node ratios. Compared to baseline defence methods, FedLAD maintains a low attack success rate for malicious nodes when their ratio ranges from 0.2 to 0.8. Additionally, it preserves high model accuracy when the malicious node ratio is between 0.2 and 0.5. These findings underscore FedLAD's potential to enhance both the reliability and performance of federated learning systems in the face of data poisoning attacks.

cs.LG↗

arXiv2025

Univariate to Multivariate: LLMs as Zero-Shot Predictors for Time-Series Forecasting

Time-series prediction or forecasting is critical across many real-world dynamic systems, and recent studies have proposed using Large Language Models (LLMs) for this task due to their strong generalization capabilities and ability to perform well without extensive pre-training. However, their effectiveness in handling complex, noisy, and multivariate time-series data remains underexplored. To address this, we propose LLMPred which enhances LLM-based time-series prediction by converting time-series sequences into text and feeding them to LLMs for zero shot prediction along with two main data pre-processing techniques. First, we apply time-series sequence decomposition to facilitate accurate prediction on complex and noisy univariate sequences. Second, we extend this univariate prediction capability to multivariate data using a lightweight prompt-processing strategy. Extensive experiments with smaller LLMs such as Llama 2 7B, Llama 3.2 3B, GPT-4o-mini, and DeepSeek 7B demonstrate that LLMPred achieves competitive or superior performance compared to state-of-the-art baselines. Additionally, a thorough ablation study highlights the importance of the key components proposed in LLMPred.

cs.LG↗

arXiv2024

$π$QLB: A Privacy-preserving with Integrity-assuring Query Language for Blockchain

The increase in the adoption of blockchain technology in different application domains e.g., healthcare systems, supplychain management, has raised the demand for a data query mechanism on blockchain. Since current blockchain systems lack the support for querying data with embedded security and privacy guarantees, there exists inherent security and privacy concerns on those systems. In particular, existing systems require users to submit queries to blockchain operators (e.g., a node validator) in plaintext. This directly jeopardizes users' privacy as the submitted queries may contain sensitive information, e.g., location or gender preferences, that the users may not be comfortable sharing. On the other hand, currently, the only way for users to ensure integrity of the query result is to maintain the entire blockchain database and perform the queries locally. Doing so incurs high storage and computational costs on the users, precluding this approach to be practically deployable on common light-weight devices (e.g., smartphones). To this end, this paper proposes $π$QLB, a query language for blockchain systems that ensures both confidentiality of query inputs and integrity of query results. Additionally, $π$QLB enables SQL-like queries over the blockchain data by introducing relational data semantics into the existing blockchain database. $π$QLB has applied the recent cryptography primitive, i.e., function secret sharing (FSS), to achieve confidentiality. To support integrity, we extend the traditional FSS setting in such a way that integrity of FSS results can be efficiently verified. Successful verification indicates absence of malicious behaviors on the servers, allowing the user to establish trust from the result. To the best of our knowledge, $π$QLB is the first query model designed for blockchain databases with support for confidentiality, integrity, and SQL-like queries.

cs.CR↗

arXiv2023

RPDP: An Efficient Data Placement based on Residual Performance for P2P Storage Systems

Storage systems using Peer-to-Peer (P2P) architecture are an alternative to the traditional client-server systems. They offer better scalability and fault tolerance while at the same time eliminate the single point of failure. The nature of P2P storage systems (which consist of heterogeneous nodes) introduce however data placement challenges that create implementation trade-offs (e.g., between performance and scalability). Existing Kademlia-based DHT data placement method stores data at closest node, where the distance is measured by bit-wise XOR operation between data and a given node. This approach is highly scalable because it does not require global knowledge for placing data nor for the data retrieval. It does not however consider the heterogeneous performance of the nodes, which can result in imbalanced resource usage affecting the overall latency of the system. Other works implement criteria-based selection that addresses heterogeneity of nodes, however often cause subsequent data retrieval to require global knowledge of where the data stored. This paper introduces Residual Performance-based Data Placement (RPDP), a novel data placement method based on dynamic temporal residual performance of data nodes. RPDP places data to most appropriate selected nodes based on their throughput and latency with the aim to achieve lower overall latency by balancing data distribution with respect to the individual performance of nodes. RPDP relies on Kademlia-based DHT with modified data structure to allow data subsequently retrieved without the need of global knowledge. The experimental results indicate that RPDP reduces the overall latency of the baseline Kademlia-based P2P storage system (by 4.87%) and it also reduces the variance of latency among the nodes, with minimal impact to the data retrieval complexity.

cs.DC↗

arXiv2023

AICons: An AI-Enabled Consensus Algorithm Driven by Energy Preservation and Fairness

Blockchain has been used in several domains. However, this technology still has major limitations that are largely related to one of its core components, namely the consensus protocol/algorithm. Several solutions have been proposed in literature and some of them are based on the use of Machine Learning (ML) methods. The ML-based consensus algorithms usually waste the work done by the (contributing/participating) nodes, as only winners' ML models are considered/used, resulting in low energy efficiency. To reduce energy waste and improve scalability, this paper proposes an AI-enabled consensus algorithm (named AICons) driven by energy preservation and fairness of rewarding nodes based on their contribution. In particular, the local ML models trained by all nodes are utilised to generate a global ML model for selecting winners, which reduces energy waste. Considering the fairness of the rewards, we innovatively designed a utility function for the Shapley value evaluation equation to evaluate the contribution of each node from three aspects, namely ML model accuracy, energy consumption, and network bandwidth. The three aspects are combined into a single Shapley value to reflect the contribution of each node in a blockchain system. Extensive experiments were carried out to evaluate fairness, scalability, and profitability of the proposed solution. In particular, AICons has an evenly distributed reward-contribution ratio across nodes, handling 38.4 more transactions per second, and allowing nodes to get more profit to support a bigger network than the state-of-the-art schemes.

cs.DC↗