Received 12 October 2023, accepted 20 December 2023, date of publication 25 December 2023, date of current version 25 January 2024.

Digital Object Identifier 10.1109/ACCESS.2023.3346432

Blockchain-Based Logging to Defeat Malicious

Insiders: The Case of Remote Health
Monitoring Systems
HAMZA JAVED1 , ZAINAB ABAID1 , SHAHID AKBAR 2 , KIFAYAT ULLAH3 , ASHFAQ AHMAD 4 ,
AAMIR SAEED 5 , HASHIM ALI 2 , YAZEED YASIN GHADI 6 , TAHANI JASER ALAHMADI 7 ,
HEND KHALID ALKAHTANI 7 , (Member, IEEE), AND ALI RAZA4
1 Department of Computer Science, National University of Computer and Emerging Science, Islamabad 44000, Pakistan
2 Department of Computer Science, Abdul Wali Khan University Mardan, Mardan, Khyber Pakhtunkhwa 23200, Pakistan
3 Department of Electrical Engineering, Sarhad University of Science and Information Technology, Peshawar, Khyber Pakhtunkhwa 25000, Pakistan
4 Department of Computer Science, MY University, Islamabad 44000, Pakistan
5 Department of Computer Science and IT, University of Engineering and Technology, Peshawar 25000, Pakistan
6 Department of Computer Science, Al Ain University, Abu Dhabi, United Arab Emirates
7 Department of Information Systems, College of Computer and Information Sciences, Princess Nourah bint Abdulrahman University, Riyadh 11671, Saudi Arabia

Corresponding author: Hend Khalid Alkahtani ([email protected])

This work was supported by the Princess Nourah bint Abdulrahman University Researchers Supporting Project, Princess Nourah bint
Abdulrahman University, Riyadh, Saudi Arabia, under Grant PNURSP2023TR140.

ABSTRACT IoT-based remote health monitoring is a promising technology to support patients who are
unable to travel to medical facilities. Due to the sensitivity of health data, it is important to secure it against
all possible threats. While a great deal of work has been done to secure IoT device-cloud communication and
health records on the cloud, insider attacks remain a significant challenge. Malicious insiders may tamper,
steal or change patients’ health data, which results in a loss of patient trust in these systems. Audit logs in the
cloud, which may point to illegal data access, may also be erased or forged by malicious insiders as they tend
to have technical knowledge and privileged access to the system. Thus, in this work, we propose a Cloud
Access Security Broker (CASB) model that (a) logs every action performed on user data and (b) secures
those logs by placing them in a private blockchain that is viewable by the data owners (i.e., patients). Patients
can query the blockchain, track their data’s movement, and be alerted if their data has been accessed by an
administrator or moved outside the cloud storage. In this work, we practically implement a web application
that receives health data from patients, a CASB that securely stores the records in the cloud, and integrate
a private blockchain that immediately logs all actions happening in the backend of the web application and
CASB. We evaluate the system’s security and performance under varying numbers of patients and actions.

INDEX TERMS Insider attack, private blockchain, cloud access security broker, remote health.

I. INTRODUCTION virus or other illnesses has increased. Remote health monitor-

Busy lifestyles make regular medical checkups difficult for ing utilizing smart IoT devices could help people unwilling
many people, especially for chronic conditions like diabetes or unable to visit the doctor regularly. Health monitoring
and hypertension. Some patients may be less mobile for IoT devices connect to a mobile app via Bluetooth to share
medical reasons, such as the weak and elderly or those with patients’ health data with doctors and receive medical sug-
motion sickness, light sensitivity, or social anxiety. In the gestions. Such a system, depicted in Figure 1, allows remote
recent Covid-19 pandemic, concern about contracting the medical consultations. Due to the sensitivity of health data
and high-security requirements in this domain, a remote
The associate editor coordinating the review of this manuscript and health monitoring system must secure user health data at
approving it for publication was Tyson Brooks . all stages. It is important to ensure (CIA) confidentiality,
2023 The Authors. This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License.
12062 For more information, see https://creativecommons.org/licenses/by-nc-nd/4.0/ VOLUME 12, 2024
H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

integrity, and availability of patient data [1]. If patient data The solution to the detection of insider attacks is continuously
is mismanaged or leaked, the lack of privacy will damage the auditing system activities. For auditing, log data is used to
system’s reputation, reduce patient trust and hence leave it store user actions with timestamps. However, tampering with
with few users [2]. All possible threats to patient data must log data itself is an issue. Malicious administrators with log
be secured by a successful remote health monitoring system. access can modify log data to cover their tracks after ille-
gally accessing patients’ health data. To solve this problem,
an immutable logging system is needed. Blockchains present
a natural solution for immutability. The blockchain is an
immutable, decentralized, and distributed ledger. It consists
of several blocks which contain data representing transac-
tions with timestamps. Each block contains the previous
block’s hash stored in the block’s header. The first block in
any blockchain is the Genesis block, which does not have
any hash of the previous blockchain. Once data is stored
in the blockchain, it can neither be updated nor removed.
Because each block contains the previous block’s hash, and
if any record is updated or removed from the first block, the
next connected block hash cannot be matched. If somehow,
FIGURE 1. IoT-based health monitoring system. we match the hash of the first two blocks, and then we need to
connect the second with the third block and also the third with
A large amount of work has been done to secure various the fourth and up to the last block of the blockchain by using
aspects of remote monitoring, such as authentication, access the previous block hash matching scheme and this process
control, and secure storage. Notably, Cloud Access Security is very difficult or impossible. Therefore, it is known as an
Broker (CASB) is a complete solution for securing cloud immutable ledger [13], [14], [15]. In this paper, we present
data, monitoring its movement and managing access policies. a blockchain-based logging system that will be integrated
Several CASB products are available commercially, such with our proposed CASB architecture to benefit from the
as Bitglass CASB [3], Lookout CASB [4], CISCO cloud- security properties of CASB while ensuring visibility into
lock [5] and Microsoft Cloud App Security [6]. A CASB attempted insider attacks. We will deploy a web application
provides many security services, including malware detec- that receives patients’ health data (from their mobile devices
tion, cloud configuration, single sign-on for authentication or medical staff, e.g., doctors or nurses) and passes it to the
and identity management, user behavior analytics, encryp- CASB to securely store in a public cloud service. Likewise,
tion, key management, and access control [7], [8]. However, the web application also receives data retrieval requests and
even with CASB deployment, insider attacks remain a key passes them to the CASB to process according to its access
challenge. Insider attacks are known to cause significant data control policies, which in turn passes the data back to the web
breaches. According to the report of ObserveIT in 2020, application. Each action of the web application backend and
60% of data breaches were caused by insider attacks [9]. the CASB, whether it is related to data storage or retrieval,
According to a survey by Colombia University researchers, is logged immediately into a private blockchain. To be effec-
50% of organizations suffered operational disruption because tive at detecting insider attacks, logging systems usually need
of insider attacks, 48% reported the loss of critical data to be monitored, i.e., someone needs to continuously read the
and intellectual property, and 37% experienced damage to logs and identify when illegal access has occurred. In our
their brands [10]. These attacks may be perpetrated by a case, we would define illegal access as an action performed
malicious administrator (e.g., disgruntled employees, spies, on user data that is not directly or indirectly initiated by
opportunists looking to expose/sell data for money) who has the user. For example, if a doctor updates a patient’s record
privileged system access and is familiar with the system and the patient approves it for upload into the system, the
policies. As a classical example, a medical device packag- data will be encrypted, indexed, and stored in the cloud. All
ing business let go of an employee, Christopher Dobbins, of these actions stem from the patient initiation of approv-
in March 2020. After March, when receiving his last pay- ing their data for upload. However, if the patient has not
ment, he hacked the company’s computer network, gained interacted with the server at all but their data is being down-
administrator access, and destroyed 120,000 documents, loaded, decrypted, or shared, then this defines a breach that
causing delays in medical equipment delivery [11]. Typical is potentially an insider attack. Practically, manual analysis
insider attacks in the eHealth domain are tampering, selling, of logs is impossible given their large volume, and it is also
or publishing patients’ health data, such as a breach discov- difficult and potentially ineffective to define rules covering
ered by the Florida hospital where two hospital staff procured all possible legal and illegal access scenarios for automated
patient data sheets, including personal data such as phone analysis [16]. Therefore, we go with a simpler approach and
numbers, names, and addresses. Two years of data were com- simply give the data owners (i.e., patients) visibility into the
promised and possibly used for false insurance claims [12]. private blockchain. Every data item gets assigned a tracking

VOLUME 12, 2024 12063

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

ID, and the patient can simply use a blockchain explorer tool peer-to-peer distributed ledger system for financial transac-
to view the logs that include the given ID. That way, the tions [17]. The blockchain is one of the emerging technolo-
patient can see if their data has been accessed by someone gies because of its immutability attribute, it is employed
not authorized by themselves. to secure the integrity of data [18]. Once data is stored in
While this approach does suffer from the drawback that the blockchain, it can neither be removed nor updated. Due
users are not always tech-savvy or responsible enough to to the decentralized mechanism of blockchain, the data is
closely monitor their data, we argue that just the fact that logs stored in all the connected nodes; as a result, these nodes
are viewable by many users will serve to discourage insider can protect the data from being lost. In addition, many con-
attacks, as blockchain records are permanent. If an insider sensus algorithms (proof of work, proof of stake, proof of
does succeed in a data breach, their actions can be imme- idea, proof of authority, and many others) establish trust
diately traced back by the data owner using the data item’s among all of the participant nodes when it comes to stor-
tracking ID, or an external observer such as a regulatory body. ing data and sharing it [19]. There is a wide variety of
As part of our future work, we will strengthen this approach existing methods that can be used to identify an insider
by coupling the system with an automated intrusion detection attack based on log data by applying blockchain technol-
system that inspects logs and reports anomalies to users, but ogy. Kumar et al. proposed a blockchain-based healthcare
for now, we believe the system is sufficiently effective to deter system for patients to monitor and grant access to data.
insider attacks. The major contributions of this paper are as They recommend Blockchain-Based Privacy-Preserving and
follows: Robust Healthcare Data, which employs a public key to store
• We propose a blockchain-based secure, transparent, and encrypted data in the cloud and a private key to update it,
auditable logging mechanism for recording actions per- to assure authorized access to patients’ medical data. Mean-
formed on sensitive data (such as health records) that while, the hash of data will be recorded in the permission
can give immediate visibility into breaches caused by blockchain [20]. Sahai et al. proposed the Verity framework,
malicious insiders. which is extensible with any SQL database. All insert, delete,
• We practically implement and analyze the feasibility and update operations will be performed in the database,
(in terms of latency) of integrating a permission-based and a fixed size of the salted cryptographic hash of each
blockchain for continuous logging of data access events tuple of the database, known as a tuple, will be kept in the
with our cloud access security broker. blockchain [21]. Cueva-Sanchez et al. [22] proposed keeping
• We present an analysis of the security properties of the the record of the wood supply chain using cloud blockchain to
proposed blockchain. ensure the transparency and integrity of forestry data and also
The remaining paper is organized as follows. Section II reduce illegal logging and prevent internal or external temper-
discusses the related literature to detect insider attacks. ing of registration, trees, and authorized certificate records.
Section III outlines the foundational theories and tech- Zieglmeier et al. [23] proposed a pseudonym provisioning
nologies that underpin our proposed solution. Section IV system also named P3 for the secure usage of log data while
describes our suggested methodology and architecture while the metadata will be stored in blockchain and pseudonym data
Section V shows the implementation details/technologies for with related identifiers will be stored separately. Moreover,
all modules of the system. Section VI presents the proposed the anomaly data are modified data and impossible to re-
system’s results, including the security proof and the system identify. Adlam et al. [24] proposed a Hyperledger fabric
performance relative to the amount of data and number of based on zero-knowledge proof blockchain infrastructure to
users. Section VII describes the complete security analysis store the audit log of Electronic Health Records. The purpose
of the proposed model. Section VIII discusses the compari- of this solution is too safe the audit log data from tampering
son of the proposed methodology with the existing scheme. by different criminal attacks. Ma et al. [25] proposed two
Section IX concludes the paper and Section X discusses open methods which are baseline and enhanced methods for effi-
future directions. ciently storing log data and overcoming the indexing problem
of an immutable Blockchain system. All [22], [23], [24], [26]
II. LITERATURE REVIEW techniques are good for reducing the storage cost of log data
A remote health monitoring system is an important step and also increasing the system speed but on the other hand
towards supporting reduced mobility patients’ medical needs due to the usages of off-chain in [22] and [23] and multi-
by enabling doctors to remotely monitor their vitals and chain in [24] and [25] they compromise the immutability,
provide advice. However, given the sensitivity of health data, Decentralization, Data availability and also drop the trans-
the system needs high security to prevent tampering and parency of the system. By using the off-chain, the data will
unauthorized access due to insider attacks from potentially be stored in any local database or other cloud-based central-
adversarial users and devices. Existing work has provided ized system but the hash of the given data will be stored in
security schemes for various aspects of remote health mon- the block chain [27]. Similarly, in the multichain concept,
itoring or secure access to health data. there is no smart contract will be deployed and each node
In 2008, Nakamoto, and Satoshi proposed Bitcoin as communicate with the other by using a digital signature
the first blockchain-based application which contains a while the smart contract is one of the important assets in
12064 VOLUME 12, 2024
H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

the blockchain to achieve the transparency and autonomy of of the process. Moreover, due to the usage of the capacity
data [28]. algorithm, the proposed system will become more costly
Now to overcome the immutability, Data availability, to produce higher-capacity hard drives, and higher-capacity
and transparency problems of the system. Ivan Chisti- malware may affect the system [39]. With the help of a
akov et al. [29] proposed a Directed Acyclic Hypergraph private blockchain, Yenugunti et al. suggested a collaborative
(DAG) which is based on a token therefore automatically intrusion detection system. Using a trust score consensus
timestamped and secures multiple-component data using technique with a trust score range of 1-100, this system
logging. Rakib et al. [30] proposed a blockchain-based frame- is designed to identify malevolent insiders. Although this
work to store log data and also query and audit system method is beneficial in that only one node performs trans-
the given data. They also ensure that the given system is actions, it still requires all other nodes to verify them. After
transparent, has data accountability, and data confidentiality. the transaction has been verified, the node will be given
Zhao et al. [31] proposed a method for drastically addressing a trust score; if the score is high enough, the node will
the throughput of blockchain using hierarchical processing be considered trustworthy or wise transaction will be dis-
and logging of large amounts of data. Hsu et al. [32] proposed carded [40]. However, issues arise when some trustworthy
a block chain-based autonomous log management model and nodes carry out a successful transaction while the rest of
also access control for securing IoT from cyber security. the network has not been validated trustworthy node as a
But all these [30], [31], [32] methods are based on Bitcoin potential threat node. Klinkmuller et al. [41] proposed an
which contains a proof of work consensus algorithm. Within Ethereum Logging Framework (ELF) with a cost-efficient
the proof-of-work consensus mechanism, the miner will be smart contract and also extracting log data into a common
selected by successfully solving a problem, and once chosen, format. Both [34], [41] store data in text file which is in JSON
it will be able to carry out transactions and store data within format while the file is available in the cloud therefore log
the blockchain. The miner transaction can be validated by any data file tampering is possible by any insider malicious user.
other connected node in the network. However, selecting each Moreover, the text files which just contain plain text, are often
node as a miner requires a significant level of computation thought to be malicious due to the nature of their content.
power to solve the puzzle, which also takes an excessively Tuan et al. [42] Proposed a blockchain logs management
long amount of time [33]. system for smart gird with ciphertext policy Attribute-based
In a similar vein, to reconcile high computational encryption to establish fine-grained access control. While
power and rapid data storage many researchers proposed introducing blockchain novel signature chain for efficient
state-of-the-art solutions, Ahmed et al. [34] proposed a logs protection. Lu et al. [43] proposed a shadow chain for
blockchain-based logs management to ensure log audit secu- storing log data in a decentralized manner for auditing data
rity named BCALS. The main purpose of this framework is sharing between different parties. The system can solve inter-
to develop a secure and immutable audit log security that nal leaks, facilitate data sharing among distrusted institutions,
the admin cannot modify it. The proposed system contains and even change. To overcome the problem of data reading in
Auditability, Immutability, Decentralization, and Analysis blockchain they will use a homomorphic encryption scheme.
Support But they can use a Proof-of-concept consensus Moreover, hybrid storage in introduced to store only the hash
algorithm which is mostly employed for testing or feasibility of log data in the blockchain of the shadow chain. Both [42]
analysis of any software, so it is not applicable for secu- and [43] use encryption in log data, as we know that log
rity purposes [35]. Mendon et al. [36] proposed an Audit data does not contain any personally identifiable information
chain to assure log integrity using proof of existence (POE). about users, but it does contain very little information that can
On the other way, The Proof of existence can be obtained be used to track malicious users, therefore, perform encryp-
by taking the hash of a file or document, which can then tion log data and allows only authorized user to view log make
be stored in the blockchain using a timestamp just like the system more expensive and time-consuming process.
off-chain [22] concept, while the actual data of every doc- The analysis of the existing work shows in Table 1, that
ument or file is available in either a local database or a myriad techniques and technologies have been proposed to
cloud-based system [37]. So, by using POE we can compro- address the insider attacks. According to the first section,
mise the immutability, Transparency, and Data availability. various solutions were proposed to detect insider attackers
Jadidi et al. [38] proposed a framework to detect the anomaly by applying different use cases like supply chain, wood chain,
of industrial control systems. The given system contains two general cloud system, and health record to continuously mon-
stages. The first step is the collection of logs in a secure itor the system activity and also store data into a different type
and distributed manner using blockchain while the second of blockchain like Hyperledger or Ethereum but we see that
step detect the anomaly of blockchain. But for storing data many techniques [23], [24], [25] not solve the immutabil-
in blockchain they use byzantine fault tolerance (BFT) with ity problem completely instead of that they only store the
proof of capacity consensus algorithm while BFT is vul- hash of give data using off-chain approach but on another
nerable to Sybil attack and it also has scalability issues hand [29], [30], [31] to solve the problem of immutability but
because each node requires communication at every step their proposed solution is based on bitcoin, therefore, they

VOLUME 12, 2024 12065

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

TABLE 1. Comparative analysis of existing schemes that use blockchain. In the same manner, if we wish to add a new block, it will
connect at the end of the current blockchain rather than the
center or the beginning of the chain. The sp: genesis block is
the first block in a blockchain and it does not include a hash
value from the previous block. However, the header of each
subsequent block does include a large amount of information,
including the block number, the hash of the previous block,
the nonce value, the total number of transactions, and the hash
of all of the transactions contained in the block [44]. Blocks in
the Bitcoin network are verified through a process called min-
ing, which involves solving a complex mathematical problem
and validating the block’s transactions and header against
the network’s consensus rules. Once the data has been saved
in the blockchain, it cannot be altered or deleted [15]. the
fundamental blockchain structure of the proposed model is
depicted in Figure 2.

increase computational power, storage cost as well as may

be malicious attacks like in [34], [36], [38], and [41] DDOS
or 51% attacks are also possible. Moreover, researchers also
provide the solution to solve the above problem but these
have many drawbacks in the sense of complex infrastructure,
storage costs including gas fees, poor read-write data. as well
as the vulnerability of storing log data in text files. So,
we will require a solution that will monitor all the activity
held in the health monitor system and have no single point FIGURE 2. The basic structure of blockchain.
of failure, scalability, non-repudiation, integrity, data privacy
and confidentiality, more reliable and immutable that nobody
can tamper, steal, or manipulate the log data. The required 1) FEATURE OF BLOCKCHAIN
solution also can protect data from different cyber-security The blockchain contains many features that have contributed
attacks like DDOS attacks and 51% attacks, as discussed in to its widespread adoption. The detail of some important
the security analysis section. features is given below:
• Immutability: Since the blockchain’s transactions are
III. BACKGROUND based on a hash function, which is irreversible, any
In this section, we describe the necessary background tech- attempt to modify or delete data once it has been
nologies and related concepts that form the building blocks added to the ledger would necessitate updating the entire
of our proposed solution. We cover two technologies here, blockchain hash. Moreover, each node in a distributed
cloud access security broker and block chain. network operates its blockchain that communicates with
the networks of other nodes in the network through
A. BLOCKCHAIN a decentralized protocol. Therefore, the record cannot
Blockchain is a decentralized and distributed ledger that be altered from the local blockchains of any other
may record any transaction or data in its blocks. The most nodes [13].
well-known application of blockchain technology is Bitcoin, • Decentralized Consensus: All transactions on a
which was proposed by Satoshi Nakamoto in 2008 [17]. The blockchain are validated by a network of users, rather
application of a cryptographic hash function ensures that each than a single authority. This consensus mechanism helps
block in a blockchain is related to the block that came before to prevent fraud and ensures the integrity of the net-
it. It uses the cryptographic technique of hash chaining to work [14].
ensure the integrity and authenticity of data. It involves taking • Transparency: Blockchain offers transparency by pro-
a block, hashing it with a cryptographic hash function, and viding a public ledger of all transactions that have
then appending the resulting hash value to the next block. occurred on the network. This ledger is a decentralized

12066 VOLUME 12, 2024

H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

and distributed database that is maintained by a network state of the ledger. In simple terms, a consensus algorithm is
of nodes, each of which has a copy of the ledger. Any- a set of rules that determine how nodes in a network reach
one can access the blockchain and view all transactions an agreement on the validity of a transaction and add it to
that have occurred, including the amount transferred, the blockchain. Several consensus algorithms play a crucial
the time and date of the transaction, and the addresses role in blockchain technology as they ensure that all nodes
of the sender and recipient. This transparency enables in a network agree on the state of the blockchain. Some
individuals and organizations to verify the authenticity of the commonly used consensus algorithms in blockchain
and accuracy of transactions, and it also makes it more include Proof of Work (PoW), Proof of Stake (PoS), Proof
difficult for bad actors to manipulate or corrupt the of Authority (PoA), Delegated Proof of Stake (DPoS), and
data [15]. Practical Byzantine Fault Tolerance (PBFT), among others.
Availability: Blockchain technology ensures availability Proof of Authority (PoA) is a consensus algorithm that relies
by being a decentralized and distributed system that is main- on a group of approved validators to verify transactions and
tained by a network of nodes. Each node in the network has create new blocks on the blockchain. Unlike PoW and PoS,
a copy of the blockchain ledger, and if one node goes offline where participants compete to solve a cryptographic puzzle
or experiences a failure, the other nodes in the network can or stake their tokens to become validators, PoA requires val-
still maintain the availability of the ledger and continue to idators to be approved by a central authority or a consortium
process transactions. In addition, blockchain technology uses of entities. PoA is known for its speed and energy efficiency,
a consensus mechanism to ensure that all nodes in the network as it doesn’t require large amounts of computational power or
have the same copy of the ledger. This ensures a single source energy consumption to validate transactions [47].
of truth is available to all nodes on the network [44].
4) SMART CONTRACTS
2) TYPE OF BLOCKCHAIN Smart contracts are typically written in a programming lan-
The three most common forms of blockchains are Public, guage that is specifically designed for the blockchain, such
Private, and Consortium. The following characteristics of as Solidity for the Ethereum blockchain. The code of a smart
each blockchain are consistent across all of them. That is, in a contract is stored on the blockchain, which makes it trans-
P2P network, each node maintains its ledger and may access parent and immutable. This means that once a smart contract
the blockchain data maintained by all other nodes. In [45] a has been deployed, it cannot be changed or modified, and its
public blockchain, every node has access to all of the data execution is guaranteed to follow the rules that were defined
in the blockchain and can participate in transactions. It is in the code [41]. Smart contracts are executed automatically
immutable but anonymous where nobody can get the personal to meet certain conditions. These conditions are typically
information of any user. Bitcoin is the best-known public based on data that is stored on the blockchain, such as the
blockchain. Public blockchains may incur high processing balance of an account, the timestamp of a transaction, or the
and storage overhead. It is not a secure place to save vital outcome of a previous contract execution. One of the key
or private information. Private blockchains [46], often called benefits of smart contracts is that they can automate com-
permission-based blockchains, are only accessible to those plex processes and transactions, which can save time, reduce
who have been granted access. With this blockchain configu- costs, and improve efficiency. For example, in the context
ration, only authorized nodes can conduct transactions. Since of decentralized networks, smart contracts can be used to
private blockchains see a smaller volume of transactions, they automate lending, borrowing, and trading, which eliminates
often have a lower data storage requirement and a faster the need for intermediaries and reduces the risk of fraud.
transaction time. Enterprises and other types of organizations Smart contracts can also help to increase transparency and
make extensive use of private blockchains. In addition, it is accountability in contractual relationships, as all parties can
useful for achieving information that is both private and see and verify the terms of the contract and its execution
vital [44]. on the blockchain [48]. Overall, smart contracts have the
potential to revolutionize the way that contracts are executed
3) CONSENSUS ALGORITHM
and enforced, offering many benefits in terms of efficiency,
security, and transparency.
In a blockchain network, each participant uses a procedure
known as a consensus algorithm to reach an agreement with
everyone else in the network and is also able to ensure trust in 5) TYPE OF BLOCKCHAIN
unidentified nodes in the distributed computing system. The The process of performing the transaction in the blockchain
blockchain consensus procedure is made up of a few partic- is storing any digital record and validating whether the store
ular goals, such as reaching a consensus, working together, record is correct or not. To perform any transaction in the
giving equal rights to every node, and requiring each node to blockchain depends on the blockchain type or consensus
take part in the consensus process. Consensus algorithms are algorithm as discussed above like in public blockchain or
a crucial component of blockchain technology, as they enable bitcoin any connected node can perform the transaction which
all participants in a distributed network to agree on the current is also known as a miner. The miner will be selected based

VOLUME 12, 2024 12067

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

on the POW consensus algorithm by solving a puzzle. When Encryption, logging, single sign-on, authentication, alerting,
the miner performs the transaction, it will be validated by all tokenization, anti-malware software, credential mapping, and
other nodes. If 51% of nodes validate the transaction then it intrusion prevention systems are all examples of security
is stored in the blockchain but if not validate the transaction, checks that may be provided by CASB [50]. The basic archi-
then it will be discarded and rewards will be given to the tecture of CASB is provided in Figure 3.
miner [17]. Moreover, in a private blockchain, there are a
fixed number of validators selected by the specific organiza-
tion that is responsible for storing data in the blockchain and
also checking whether data is correct or not [49]. Overall, the
transaction life cycle in the Bitcoin network involves the fol-
lowing steps: creation, broadcasting, verification, inclusion in
a block, confirmation, and finality of transactions.
Creation A transaction is created when a user initiates a
transfer of digital assets from one account to another. The user
must provide details such as the recipient’s public address,
and the amount of assets to be transferred. Broadcasting:
Once a transaction is created, it needs to be broadcast to
the network so that it can be validated and added to the
blockchain. Broadcasting is typically done using a peer-to-
peer network, and once the transaction is broadcasted, it is
FIGURE 3. The basic structure of cloud access security broker.
available to all nodes in the network. Verification The next
step is verification, where nodes on the network validate
the transaction to ensure it is valid and doesn’t violate any
rules or double-spend the same coin. The validation process 1) CASB’S FOUR MAIN PILLARS
is carried out by specialized nodes called validators, who In CASB, there are several brokers and each broker contains
ensure that the sender has sufficient funds to complete the these four main pillars that ensure CASB in one of the
transaction and that the transaction hasn’t already been spent. efficient security mechanisms. All these important pillars are
Inclusion in a block Once the transaction has been validated, discussed as given below:
it is added to a block of transactions. A block is a collection of • CASB for visibility: A CASB visibility strategy pro-
validated transactions that are bundled together and added to vides full transparency for the use of cloud apps,
the blockchain in sequential order. Each block contains a ref- including those that have been sanctioned as well as
erence to the previous block, which creates a chain of blocks those that have not been sanctioned, which are referred
that make up the blockchain. Confirmation After a block to as shadow IT. The cloud detection analysis delivers
containing the transaction has been added to the blockchain, a risk evaluation for each cloud service that is being
it needs to be confirmed. This involves waiting for a certain utilized. This offers business security experts the ability
number of subsequent blocks to be added to the blockchain, to decide whether to continue allowing the app to be
creating a level of security against fraud, double spending, ccessed or whether to prohibit it. This information is also
and other attacks. The number of blocks needed to confirm helpful to build more grained controls, such as providing
a transaction varies depending on the specific blockchain, varied amounts of access to data based and application
with some requiring just one confirmation, while others may on an individual’s technology/device, location, and field
require several. Finality: The final step in the transaction of activity. Another purpose for this information is that
lifecycle is finality. Once a transaction has been confirmed by it is useful in assisting with finer controls [50], [51].
the required number of blocks, it becomes irreversible and is • Data Security/Loss Prevention Using CASB: A great
considered final. At this point, the recipient can safely assume number of businesses have already begun moving
that the transaction is complete, and the cryptocurrency has their information technology resources outside of their
been transferred to their address. in-house data centers and onto numerous cloud environ-
ments, as well as the extensive catalog of online apps
provided by SaaS (Software as a service) vendors. The
B. CLOUD ACCESS SECURITY BROKER (CASB) organization staff already exchanging valuable informa-
Cloud Access Security Brokers, also known as CASBs, are tion via platforms such as Amazon S3 [52], Microsoft
points of providing security that are located between cus- 365 [53], salesforce [54], and others. Businesses must
tomers and service providers. As the use of SaaS (Software as link their existing data loss prevention (DLP) technology
a Service) grows in businesses, cloud access security brokers with a cloud access security broker (CASB) solution to
become an increasingly important tool for information secu- gain knowledge of critical information moving between
rity experts. Additionally, they could have authority within on-premises and cloud environments. Because of this,
the organization that who has access to what resources. Also, companies can monitor the individuals who have access

12068 VOLUME 12, 2024

H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

to important data across their whole network without compromised is referred to as a log’s ‘‘forward security’’.
sacrificing security. Applying security protocols such After a successful attack, a malicious administrator may
as protecting information rights, access control, encryp- engage in multiple types of attacks. An insertion attack occurs
tion, tokenization, and prevention of data loss, are some when fake log entries are generated, which can either over-
examples of measures that might be taken to reduce the load or interrupt the log management system, resulting in a
amount of organizational data that is lost or stolen [50], denial of service (DOS). Modification or reorder attacks may
[55], [56]. alter logs in such a way that their integrity is compromised.
• Threat Protection with CASB: The Cloud Access Secu- A withhold attack may launch a delayed attack to disrupt the
rity Broker (CASB) helps businesses improve their log management system.
knowledge of the data stored in the cloud by provid-
ing a variety of capabilities for detection, monitoring, 2) DESIGN GOALS
and prevention. The CASB can apply machine-learning Malicious administrators (or generally, high privileged users)
techniques to rapidly recognize suspicious behavior if are the main threat considered in our proposed remote health
a user tries to hack the system to get unauthorized monitoring system. Thus, our proposed model is designed to
access to information or makes an attempt to do so. meet the following security goals.
To stop and prevent malware assaults, a broad vari-
ety of technologies and techniques are deployed. Some • The immutability of the proposed system is a primary
examples of these technologies and methods include requirement, and it must ensure that once log data has
dynamic and static malware analysis, adaptive access been stored in cloud storage, it cannot be removed,
control, and threat intelligence. For instance, the CASB updated, or altered in any way.
will trigger an alert if a developer attempts to access • Decentralization is essential in that audit log data is
customer data within an application that is used for sales stored in multiple, independently accessible locations
because only salespeople should be authorized to view to provide a fail-safe against the possibility of a single
that data. In the first scenario, the CASB does not restrict point of failure.
access to the client’s information and does not notify an • Our model must ensure non-repudiation by employing
administration. However, in the second scenario, it does digital signatures that are based on asymmetric key
restrict access to the client’s information and it alerts an encryption.
administration [55], [56]. • The integrity of the log data should be ensured through
• Compliance using CASB: A CASB equipped with effec- the utilization of a blockchain hashing algorithm such
tive data privacy safeguards that are dispersed across as SHA-256.
various applications can help with this. By providing • The audibility of data should be ensured. Each node
features for policy awareness and data classification, should be able to perform an audit, i.e., a check on log
CASBs also help ensure compliance with data residency data, before storing it on a private blockchain.
regulations like HIPAA, GDPR, and regulatory stan- • Scalability is a critical factor given the large number
dards like ISO, PCI-DSS, and others [51], [55]. of devices and users in a remote health monitoring
system, especially when time-consuming blockchain
operations are involved. As we only integrate a pri-
IV. PROPOSED SOLUTION DESIGN vate blockchain that has a pre-defined fixed number of
A. THREAT MODEL AND DESIGN GOALS nodes, we do not envision that this will be an issue in
1) THREAT MODEL the implementation.
As we see in section I, there are a large number of IoT devices • Easy tracking of data by end users is important as our
and users connected to a remote health monitoring system to security model relies on data owners themselves being
send and receive vital data via the network. To protect sen- able to determine if a breach has occurred. Any user
sitive patient information, a CASB is a good framework that should have visibility of their data, i.e., they should be
is responsible for key management, access control, authen- able to view log data by employing a tracking-ID.
tication, encryption/decryption, as well as monitoring user
activity with a log management system. Administrators are B. DESIGN AND ARCHITECTURE
key users of the remote health monitoring system who are In our proposed system, we assume that a patient uses
most familiar with system policy as well as have the highest IoT-based wearable devices that continuously measure var-
level of access. Hence, insider attacks can originate from ious health metrics and send data to the cloud. As the
malicious administrators who can tamper or illegally obtain health record is very sensitive, it is, therefore, crucial to
or distribute patient records and delete the log generated secure access to the web-based application used by medical
against the action performed. Thus, in a log management practitioners for viewing patient data. Our system imple-
system, one of the most important considerations is how ments a CASB to enforce strict access control. Moreover,
audit logs will be protected from malicious actors. The pro- a blockchain-based log management system is integrated with
tection of logs from modification after a system has been the CASB to continuously store audit log data, which contains

VOLUME 12, 2024 12069

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

information about each action that was done on a patient’s (say, office computers). The workflow is similar to the patient
data, indexed by a tracking ID. Logged information includes workflow, except that the main function of medical staff is
the IP address and other identifying information of the user adding updates to patient health records (for example, the
who accessed the data item and the time when the user acted. summary of a hospital visit) or retrieving medical records of
Our proposed architecture is shown in Figure 4. We now their patients. Access control functionality is managed by the
describe each of its components, users, and the overall work- CASB and described in the following section.
flow below:
D. CLOUD ACCESS SECURITY BROKER
This is the first of the two main security components we
propose to use as part of our solution. The CASB works as
an access control and managing module. We propose to use
an identity-based encryption scheme such as CP-ABE [57]
such that patients can specify exactly which medical staff are
allowed to view their data. The scheme can be managed by
CASB (i.e., CASB itself can be the key management author-
ity) while the hospitals using the system, or a regulatory body,
can be the attribute authority for schemes such as CPABE.
We leave the specifics of the scheme to the deployment
as the encryption is not our main contribution and many
schemes have already been proposed and shown to work well
in practice such as in our earlier work [58]. The main point is
that CASB can ensure fine-grained and flexible access control
through an appropriate encryption scheme.
FIGURE 4. Proposed architecture.

E. LOGGING MODULE
Secure logging is the second main security component we
C. END USERS propose in our solution. This module is specifically targeted
The end users of the system are either patients or medical at deterring insider attacks.
professionals who view patient data. Both entities interact The intuition behind this module is that malicious insiders,
with the Cloud Access Security Broker (CASB) for storage such as CASB administrators who have admin-level privi-
and retrieval of data through end-user devices shown in the leges, can be deterred from misusing their privileges if there
figure. exists a permanent, public, and tamper-resistant record of
all their actions. We, therefore, propose a rigorous logging
1) PATIENTS module integrated with CASB. The key idea is to integrate
The patient-CASB communication workflow is shown in the CASB with a secure and immutable log. When CASB
Figure 4. Patients’ end-user devices will be smartphones, performs any action on a user’s request, such as retrieving
installed with an application that receives data from wearable patient data in response to a patient’s request to view his data,
devices and aggregates it in the form of daily, weekly, or asyn- the logging module is triggered automatically. A single record
chronous (urgent) updates. The application also encrypts of the action will be generated containing the initiating user
aggregated data with the patient’s key (encryption scheme ID (in this case the patient’s ID), the action requested, the
discussed later) before sharing it with the CASB. When the unique tracking ID of the data item that is accessed, and the
patient data is received by the CASB, CASB indexes it and timestamp. This record will then automatically be added to
sends it to cloud storage. When the patient wishes to view the immutable log.
the data item, he can search for it through a unique and easy- Specifically, in our design, we propose a private blockchain
to-search tracking ID composed of the date of upload, time to serve as this immutable log. Thus, each action will trigger
of upload, and device that triggered the update (e.g., smart- a transaction on this blockchain, where the content of the
watch_dailyupdate_31/08/22_21:59). A search query will be transaction will be the record specified above. As described in
generated by the patient’s mobile application and received by Section III-A, a private blockchain has several different kinds
the CASB, which will in turn search for the record from cloud of users. We now describe what the role of each kind of user
storage and return it in its encrypted form to the patient’s will be. The nodes can be any user or device that interacts
device, where it will be decrypted. with a private blockchain to view the saved record.

2) MEDICAL STAFF 1) VALIDATOR

Medical staff will interact with the CASB through a secure Every user of a private blockchain is not authorized to per-
desktop or web application deployed on their official devices form transactions and validation. Therefore, we introduce

12070 VOLUME 12, 2024

H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

some specialized nodes known as validators which are

defined by the organization using the system. The validators
are responsible for performing transactions on our private
blockchain. Against every user action that generates a log
record, a real-time transaction will be performed on the
private blockchain by one of the defined validator nodes.
Once all other nodes verify this transaction, as outlined in
Section III-A, the transaction is immutably stored in a private
blockchain. This validation is a fully automated process and
no user, even administrators or insider users, will be involved
in it.

2) AUDITOR
After performing a transaction and storing data in the private
blockchain, the auditor can view each blockchain data using
a decentralized web app (DAPP). If the auditor can detect
any intrusion in the system, then they can report the relevant FIGURE 5. Logs data flow.
administrator or any other user. For example, if a malicious
administrator removes patient data from the cloud storage
managed by CASB, while the data deletion process can only then take the desired action, which may include blocking the
be initiated by the patient according to CASB policy, the log user because they are a malevolent administrator.
stored in the private blockchain can be detected by the auditor Data Verification for Insertion Into the Blockchain: To
and they can report those administrators. detect intrusion with a private blockchain, we implement a
proof of authority algorithm with the Ethereum blockchain.
3) VIEWERS (CASB USERS) As we discuss in sections IV-D CASB is only accessible
All users that are registered with the system and allowed to to approved users. Moreover, Once the log data has been
interact with the CASB, i.e., all patients and medical staff, but generated by the cloud, it will be automatically sent to a
will have the status of only viewers for the private blockchain. decentralized app. Based on a smart contract, the log data is
They cannot add any transaction to the blockchain, but they initiated by one validator. According to the proof of authority,
are allowed to explore the blockchain and view the stored there are a fixed n number of authorized nodes that are already
logs. the intuition behind this module is to (a) deter mali- selected as shown in Figure 6. The private blockchain receives
cious insiders from the illegitimate use of their authority, the request from the authorized node and generates the new
as they will know that their actions are publicly viewable by block of transactions that needs to be inserted in the peer-
patients as well as their colleagues and employers, (b) add to-peer blockchain network. After creating a new block, the
transparency in the system for patients, who will feel at ease validator node is considered a primary node and automati-
if they can see what is happening to their private data, and cally arranges the transaction of log data into the block and
(c) to reduce the dependence on the auditor. With a large user verifies it. After the verification of log data by the primary
base, a very large volume of actions is likely to be stored on node all other also verifies the transaction and the block has
the blockchain every day; hence, for an auditor to track illegal
accesses from the logs is not very scalable. We argue that a
patient who is concerned about the security of his data can
simply use a blockchain explorer tool to track his data through
its tracking ID and alert the administrator if any unauthorized
access is discovered.
The overall workflow of the logging module is summarized
in Figure 5. After the initialization of the system, the user can
interact with CASB and perform any activity on it. The log
data will be generated and stored in the private blockchain
by using a validator node. Any user will be able to view the
data through a blockchain explorer tool. Many such tools are
available like Blockchain [59], and Etherscan [60] The user,
who can be a doctor or a patient, looks for the data using the
tracking ID. If he does not discover any breaches, then there
is no cause for concern; but, if he discovers any undesirable
behaviors, he must submit an alert to the auditor, who will FIGURE 6. Implementing proof of authority.

VOLUME 12, 2024 12071

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

TABLE 2. The main feature of our design goal.

FIGURE 7. Data pre-processing steps.

in a risk-free and deterministic setting when you use

Ganache as your development kit. Ganache is a desk-
top application that is compatible with Ethereum and
includes an easy-to-navigate user interface.
• Wallet: We use MetaMask wallet to perform
blockchain transactions when log data has to be stored.

B. SIMULATING IOT DEVICES UPDATES

We use a dataset generated from wearable IoT devices to
simulate updates transmitted from IoT devices to CASB.
We used a wearable IoT device dataset downloaded from the
UCI machine learning repository [61] in the form of .txt files.
This data consists of twelve different activities and 3 sensor
devices including Heart monitoring, effects of exercise on the
ECG, and blood pressure. We follow pre-processing steps for
this data as shown in Figure 7. For the data cleaning process,
been authenticated. In the end, consensus based on proof of we have used the Rapid Miner software [62].
authority is achieved then a new block will be added to the
private blockchain while any other user including the auditor, C. PRACTICAL IMPLEMENTATION
an Authorized user by CASB can be allowed to view this data. We have implemented our system for empirical evaluation of
For intrusion detection, any user like an authorized user by its performance. We performed the experiments on an HP
CASB (patient or doctor) feels data breaches, they search for Core i5 laptop with 8GB RAM, a 2.6GHz processor, and
the log action by interacting decentralized app and sending a 2GB AMD graphic card. The machine ran the Windows
the request to the auditor. Moreover, the Auditor also feels any 10 operating system and a Google Chrome web browser.
kind of real health data also performs the desired action on the • Cloud Access Security Broker (CASB): We devel-
malicious user. In summary, we highlight the main features oped CASB using the PHP programming language
of our design against each of the design goals in Table 2, while data was stored on Google Cloud. We used
specified in Section IV-A. Google API for adding, viewing, updating, and deleting
data from Google Cloud. We used an XAMPP local
V. IMPLEMENTATION server to run our system. The front end of CASB was
A. TECHNOLOGY STACK created using HTML and Bootstrap. When a user per-
We use the following technology stack for each of the main forms any action on the system, the log data is created
components: at the backend of our application. The created logs
• Cloud Storage: For storing patient data generated by appear in the Google Chrome Developer Console (for
IoT devices, we use Google Cloud storage. development purposes only) as shown in Figure 8.
• Frontend: The front web application consists of • Permissioned blockchain: We created a Ganache-
HTML, CSS, and JavaScript programming languages. based local blockchain with several accounts for per-
For developing the Dapp (Decentralized Application) forming transactions. Similarly, we wrote blockchain
to display log data, we use React.js, a JavaScript library. smart contracts using the Solidity programming lan-
• Backend: The CASB will be developed using PHP as a guage and deployed them using Truffle. For the
backend programming language and smart contract of front-end design to display data, we used the JavaScript
Ethereum blockchain written in Solidity. library React.js. We used Web3.js to monitor and dis-
• Blockchain environment: We use Ganache which play historical transactions, and MetaMask Wallet to
offers multiple nodes with 100 Ether per node. We may interact with the blockchain from the front end and
build, test, and release your smart contracts and Dapp validate new transactions, as shown in Figure 9.

12072 VOLUME 12, 2024

H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

FIGURE 10. Searching logs data.

FIGURE 8. Logs data creation.

VI. EXPERIMENTAL EVALUATION
We evaluated our system using the time to transfer log data
to the blockchain, relative to the size of the log. The result is
shown in Table 3. At the backend of our own design Cloud
Access Security Broker (CASB)-based prototype, we write
script (Code) that calculates the time of log action and dis-
plays the result in terms of seconds on the front end of the
screen. To run the system, we perform different actions like
adding, deleting, or viewing patient data in web applica-
tions. The log data will be generated automatically at the
backend of the system based on these actions. The log data
is then automatically loaded in DAPP and a transaction is
performed to store log data in a private blockchain. Each
block contains the most recent logs information, such as
UserID 6712 doctors viewed the patient record on 2022-08-
09 at 19:56:06 where an IP address is 192.172.1.1:30. Also
Other important information includes the hash of the previous
FIGURE 9. Blockchain transaction. block, the transaction hash, the block number, the transaction
number, the account number that performs the transaction,
and the timestamp. The log data will be retrieved from the
• Searching the blockchain-based log data: After stor- blockchain and shown in a web application, either as a whole
ing the log data in the private blockchain, the next or against a specific search query. We also report the retrieval
step is to retrieve the data from the blockchain so that and search time in our evaluation results. Table 3, shows the
the auditor can easily detect any malicious activity. results against varying log sizes and number of actions. The
As we discussed in Section IV-A, patients can also column headers are described below:
access stored log data from the blockchain. Due to the • Action: Represents the number of actions performed by
large amount of log data, it would be very difficult for different users at the same time (e.g., view, add, delete,
patients or auditors to find unwanted activity. There- update data).
fore, we also develop a searching module as shown • T1: Time required to create log data (at the backend)
in Figure 10. Thus, any user can easily search for a against the number of user actions.
specific record by entering the tracking ID or other key- • T2: Time to store data, i.e., into the private blockchain.
words. If any data leak or unauthorized user access is • T3: Time to retrieve data from the private blockchain
observed, then patients can send an alert to the auditor for the auditor or patient and display it on the web app.
to take action against the intruding user. During data retrieval, the web application shows all of

VOLUME 12, 2024 12073

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

TABLE 3. Time in seconds for storing log data against different log sizes
and number of actions.

FIGURE 11. Creation and retrieving of logs data.

the log’s data stored in the blockchain, from the first

block to the most recent block.
• Total T: Represent overall time from the user being
acted storing log data into the private blockchain, i.e.,
T 1 + T 2.
• ST: The searching time of log data from the blockchain
using a tracking ID. The search interface only returns
log information in response to a tracking ID query.

A. LOG SIZE FIGURE 12. Logs data storing time.

WE start our analysis by varying the number of actions
performed by users at the same time, as the log data size
increases with the number of actions. As expected, the time we find satisfactory, as in practice, such a large number of
to store data increases with the log size. However, the overall actions is not anticipated to occur in parallel. In the next
size of the log against 500 actions performed by users is only step, we calculate the time to store the logs in the private
53.3 KB. Extrapolating from this, the system will require blockchain. As we see from Figure 12, only storing one action
approximately 10,000 actions to be performed simultane- from the log data takes up to 20 seconds, although the size
ously for a log size of only 1 MB. Thus, log storage is not of this data is only 111 Bytes. However, this is standard as
expected to be a problem in the real implementation of this storing data in a blockchain requires several steps, and we can
system. see that the time increases very little with a manifold increase
in data size. Thus, the blockchain storage time seems to have
B. LOG DATA STORAGE IN BLOCKCHAIN very little dependence on data size or an increased number
In our second parameter, we analyzed the total time from of actions. The last step is to fetch the log data from the
creating log data in the CASB to displaying it in the web private blockchain and display it in the web app from where
app for an auditor. For this purpose, we calculate the time the auditor can read the data. The time to read data from the
at different stages of the log creation workflow. We start with blockchain is very small, approximately 2 seconds when up
time to create log data as shown in Figure 11. For the max- to 500 actions are performed by users at the same time. More-
imum number of actions, we tested against, i.e., 500 actions over, the increase in retrieval time when data size increases is
where 53.3 KB of log data will be generated, the creation also very low. This is good for our system’s security because
of the log takes only 1.3 seconds. Similarly, the given result if data retrieval from the blockchain became very slow with
shows that when the number of actions increases, the time a large amount of data being retrieved, it would allow a
of creating a log also increases. We extrapolate that when malicious user to carry out a denial-of-service attack by
23,000 user actions are performed at the same time, only adding a lot of data or tying up the system in a large retrieval
then the time to create logs will exceed 1 minute, which request.

12074 VOLUME 12, 2024

H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

D. SECURITY ANALYSIS
Having evaluated the performance, we now evaluate the secu-
rity of the proposed system with the list of certain desired
properties:

• Decentralized Distributed Ledger: We use blockchain

technology which is one of the best platforms for
achieving the distribution of data like a ledger. In the
blockchain, several nodes connect via a peer-to-peer
network. When the user performs any transaction in the
blockchain then all other connected nodes can access
the data by using any of the blockchain data access-
ing tools. And because the blockchain is decentralized
where every user has whole blockchain data. If one of
FIGURE 13. Total storing time of logs data from CASB to blockchain.
the nodes transfers into the dead state for some time,
then all other nodes will not be affected in scenes of data
accessing problems.
• Immutability: Immutability is a primary requirement
of the proposed system. The logs stored and accessed
offer many other cloud storages but once data stor-
age it can neither remove nor change updated only
offered by blockchain. According to, to proposed private
blockchain system, we apply proof of authority that
several already selected users can allow storing data in
the blockchain while after storing data every transaction
data has its hash value and each block header contains all
transaction hash. Moreover, the hash of the first block is
also stored in the second block header. Similarly, if any
FIGURE 14. Logs searching time.
malicious user tries to steal or record from the first
block transaction then the hash of the first block will not
match with the next block and the blockchain connection
C. OVERALL PERFORMANCE will be the brake. While blockchain is decentralized in
The result of the overall flow of log data from creating nature and everyone other node has its copy therefore
action to storing into the private blockchain can be calculated data breaches or immutability problems will be solved
by the sum of time to create and time to store data in the by matching the copy user’s nodes and recently updated
private blockchain as shown in Figure 13. We conclude that nodes.
the main delay in our system is in storing any piece of • Non-repudiation: In Non-repudiation, node A claims
data in the blockchain (as discussed above, even one action that they provide service to B while B says that A does
takes approximately 20 seconds to store, which is very high). not provide and service. Similarly, in our case, the log
Although this time does not seem to depend on increasing data was generated by CASB but validator 1 did not
data very much, it is high, to begin with. The reason is that perform any transaction and claimed that he performed
when a new block is added to the blockchain, all blocks the transaction. On the other side, only 2 validators
are traversed, and hashes are calculated which is a time- claim that A does not perform transaction while all other
consuming process. Thus, when even a single user action is validator turns mute. Then there is a digital signature
performed, the storage time in the blockchain is relatively based on the asymmetric key that helps to verify whether
high. Finally, we also evaluate our searching module because the transaction was performed by validator 1 or not.
a large number of users may interact with the searching • Integrity: In our proposed system, we use blockchain
module at the same time, causing possible delays due to a technology which is a distributed ledger while data
large amount of concurrent request traffic. In our evaluation integrity will be ensured by a hashing algorithm,
of this module, when we enter the tracking ID for a patient’s which is a built-in characteristic of the blockchain
data, it only takes 0.054 sec when the store’s data size is ledger.
0.111 kb as shown in Figure 14. When data size increases up • Scalability: In general, blockchain is a decentralized
to 10.7 KB, our retrieval time is still only 0.208. At 53 KB, network and the number of nodes may be increased over
the module takes 0.514 sec. Thus, even for a relatively large time while each node has equal right to perform transac-
log size (53 KB is generated against 500 user actions), data tions. Increasing the node to improve the scalability of
searching is quite efficient and peaks at only half a second. the blockchain network is a very big challenge. In our

VOLUME 12, 2024 12075

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

proposed system, we employed a private blockchain TABLE 4. Comparative analysis of existing schemes that use blockchain.
with a proof of authority (POA) algorithm. The POA
contains a fixed number of validators that allow to per-
form the transaction and also validate the transaction
performed by another validator. So, increasing network
node issues will be resolved and the proposed system
will be scalable.
• Privacy and data confidentiality: As we discuss in
section III, our proposed system consists of two parts.
The CASB provides security to real health data from out-
sider attacks and also integrates a private blockchain log
management system that continuously detects insider or
administrator activity. Moreover, the log data is gener-
ated based on each user action. It contains very minimal
information about the user like user designation, ID,
Date, time or IP while does not include any blatant
displays of personal data. The log data is only helpful for
auditors. Therefore, there’s no chance to steal or remove
real health data by using log information.
• DDOS attacks (resist): The DDOS (Distributed denial
of service) attack occurs in the blockchain network when
a large number of transactions are performed by some
malicious nodes to target normal traffic. In our proposed related systems like Madhwal et al. [29], Rakib et al. [30],
solution, this attack is not possible because we use the and Chien-Lung et al. [32] implement proof of work [33] in
POA algorithm which contains pre-authenticated nodes the consensus algorithm. However, when the number of nodes
also known as a validator. increases over time. it’s difficult to maintain the scalability
• 51% attacks (resist): Similarly, a 51% attack is also system. But in the proposed system, we used proof of author-
possible when the maximum node validates the wrong ity that contains pre-defined authenticated users who possess
transaction for example out of 100, the 51 nodes say the necessary permissions to execute. transactions.
validate the wrong transaction and store data in the Another key advantage over the prior proposed system is
blockchain. This attack is much harder in our pro- in terms of security: Our main objective is to maintain the
posed private blockchain network. Because only a privacy of patients’ real health; therefore, we use CASB to
pre-authenticated and fixed number of nodes are allowed secure records from outside attackers. Additionally, we incor-
to perform the transaction. porate a private blockchain to identify and mitigate potential
risks posed by internal actors with malicious intent. Further,
In the end, our private blockchain system has many features
to its advantage, our proposed system provides accessibility
that make it highly compatible with securely detecting insider
by allowing every user to view any log data by our search
attacks.
module as well as any authenticated nodes are permitted to
execute transactions. The proposed scheme also provides data
VII. COMPARISON OF REPRESENTATIVE SOLUTION integrity by the utilization of cryptographic hashing tech-
WITH PROPOSED SCHEMES niques, which guarantee the veracity of stored information.
In this section, we compare the essential qualities of the most
prominent solutions with our work as shown in Table 4. In our VIII. CONCLUSION
proposed system, we make a significant new contribution i.e., We have presented a private blockchain-based remote health
integrate the blockchain-based log mechanism directly with monitoring system to protect against insider attacks. The
CASB (Cloud Access Security Broker) and permanently store proposed system offers immutability, distribution, and partial
log data without the involvement of any type of log file. decentralization. The two components of our system are the
The proposed method relies on the inherent hashing prop- Cloud Access Security Broker (CASB) for managing real
erty of blockchain therefore it’s immutable. In contrast, health data and a private blockchain to continuously monitor
several existing methods, such as the one described by Cueva- each user’s behaviors for detecting insider attacks. CASB
Sanchez et al. [22], employ off-chain methodologies, which would provide end-to-end security, which includes Authen-
offer challenges in maintaining system immutability. The tication, Access Control, and Storage, while all user actions
proposed system also ensures non-repudiation by applying are logged and stored in the blockchain. However, due to
a digital signature that is based on an asymmetric key. This blockchain’s immutability, tampering or theft of log data is
digital signature aids in the verification of whether the trans- not possible. In addition, any user of the system including
action was executed by an authorized user or not. Existing the auditors, patients, or doctors can search their log data

12076 VOLUME 12, 2024

H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

with ID from the blockchain and detect the administrator’s [9] ObserverIT Cost of Insider Threats Global Report 2020. [Online].
malicious behaviors. Moreover, we practically implemented Available: https://www.proofpoint.com/us/products/information-
protection/insider-threat-management
our system using the Ethereum blockchain and evaluated the [10] The Colombia University Researchers Perform Survey in 2019. [Online].
performance of the system. Available: https://delinea.com/blog/insider-threats-in-cyber-security
[11] Real world Insider Attack Example. [Online]. Available:
https://www.tessian.com/blog/insider-threats-types-and-real-world-
IX. FUTURE DIRECTION examples/
In the future, the proposed approach will be extended to [12] Insider Threats at Hospitals. https://resources.infosecinstitute.com/topic/
handle big log data. In the current scenario, we practically insider-threats-at-hospitals/
implement and test the performance with a small amount [13] H. Halpin and M. Piekarska, ‘‘Introduction to security and privacy on
the blockchain,’’ in Proc. IEEE Eur. Symp. Secur. Privacy Workshops
of data i.e., KB or MB but with time a large amount of (EuroS&PW), Apr. 2017, pp. 1–3.
data has been created which may be in GB or TB. Although [14] T. Yu, Z. Lin, and Q. Tang, ‘‘Blockchain: The introduction and its appli-
blockchain has no option to remove data. Moreover, the basic cation in financial accounting,’’ J. Corporate Accounting Finance, vol. 29,
no. 4, pp. 37–47, Oct. 2018.
requirement of our proposed system is that nobody can update
[15] P. Gomber, Hinz-O. Nofer M. Schiereck D.,’Blockchain, vol. 59. Cham,
or delete the log data. Therefore, due to increasing the size of Switzerland: Springer, 2017, pp. 183–187.
log data in the blockchain, we will require any mechanism to [16] M. Cinque, D. Cotroneo, and A. Pecchia, ‘‘Event logs for the analysis
compress this data. but the blockchain also has no option to of software failures: A rule-based approach,’’ IEEE Trans. Softw. Eng.,
vol. 39, no. 6, pp. 806–821, Jun. 2013.
compress this data. Therefore, the compression process will [17] S. Nakamoto, ‘‘Bitcoin: A peer-to-peer electronic cash system,’’ in Decen-
be possible on the cloud side that compresses every action tralized Business Review, 2008.
of the user and stores it in the blockchain also compression [18] F. Casino, T. K. Dasaklis, and C. Patsakis, ‘‘A systematic literature review
does not affect real health data processing. Furthermore, for of blockchain-based applications: Current status, classification and open
issues,’’ Telematics Informat., vol. 36, pp. 55–81, Mar. 2019.
strong tamper-evidence & audibility, in the future, we may [19] T.-V.-L. T.-V. Le and C.-L.-H. T.-V. Le, ‘‘A systematic literature review of
apply ledgerDB type stat-of-the art techniques that are capa- blockchain technology: Security properties, applications and challenges,’’
ble of facilitating verifiable data removals, a feature that is J. Internet Technol., vol. 22, no. 4, pp. 789–801, Jul. 2021.
highly sought after in various practical applications. This [20] M. S. Kumar and V. Nagalakshmi, ‘‘Secure transfer of robust health-
care data using blockchain-based privacy,’’ Cluster Comput., pp. 1–17,
functionality allows for the elimination of outdated records to May 2023.
optimize storage space and the concealment of some records [21] S. Sahai, M. Atre, S. Sharma, R. Gupta, and S. K. Shukla, ‘‘Verity:
to comply with regulatory requirements, all while maintain- Blockchain based framework to detect insider attacks in DBMS,’’ in Proc.
IEEE Int. Conf. Blockchain (Blockchain), Nov. 2020, pp. 26–35.
ing the system’s capacity to be verified. Similarly, in our [22] J. J. Cueva-Sánchez, A. J. Coyco-Ordemar, and W. Ugarte, ‘‘A blockchain-
proposed system we will integrate private blockchain with based technological solution to ensure data transparency of the wood
CASB (Cloud Access Security Broker) and make like bridge supply chain,’’ in Proc. IEEE ANDESCON, Oct. 2020, pp. 1–6.
structure but there is a little bit of chance that attackers may be [23] V. Zieglmeier and G. L. Daiqui, ‘‘GDPR-compliant use of blockchain for
secure usage logs,’’ in Evaluation and Assessment in Software Engineering,
trying to attack this bridge. Therefore, in the future, we will 2021, pp. 313–320.
try to apply a hardware-based TPM (Trusted Platform Mod- [24] R. Adlam and B. Haskins, ‘‘A permissioned blockchain approach to elec-
ule) type solution to prevent disabling this logging module tronic health record audit logs,’’ in Proc. 2nd Int. Conf. Intell. Innov.
Comput. Appl., Sep. 2020, pp. p1–7.
entirely.
[25] S. Ma, Y. Cao, and L. Xiong, ‘‘Efficient logging and querying for
blockchain-based cross-site genomic dataset access audit,’’ BMC Med.
CONFLICTS OF INTEREST Genomics, vol. 13, no. S7, pp. 1–13, Jul. 2020.
[26] S. Akbar, S. Khan, F. Ali, M. Hayat, M. Qasim, and S. Gul, ‘‘IHBP-
The authors declare no conflict of interest. DeepPSSM: Identifying hormone binding proteins using PsePSSM based
evolutionary features and deep learning approach,’’ Chemometric Intell.
REFERENCES Lab. Syst., vol. 204, Sep. 2020, Art. no. 104103.
[27] J. Eberhardt and J. Heiss, ‘‘Off-chaining models and approaches to
[1] S. Sengupta, ‘‘A secured biometric-based authentication scheme in IoT- off-chain computations,’’ in Proc. 2nd Workshop Scalable Resilient Infras-
based patient monitoring system,’’ in Emerging Technology in Modelling tructures Distrib. Ledgers, Dec. 2018, pp. p7–12.
and Graphics, 2020, pp. 501–518. [28] A. Ismailisufi, T. Popovic, N. Gligoric, S. Radonjic, and S. Šandi, ‘‘A pri-
[2] J. Sun, X. Yao, S. Wang, and Y. Wu, ‘‘Blockchain-based secure storage vate blockchain implementation using multichain open source platform,’’
and access scheme for electronic medical records in IPFS,’’ IEEE Access, in Proc. 24th Int. Conf. Inf. Technol. (IT), Feb. 2020, pp. 1–4.
vol. 8, pp. 59389–59401, 2020. [29] Y. Madhwal, I. Chistiakov, and Y. Yanovich, ‘‘Logging multi-component
[3] (2022). Bitglass CASB. [Online]. Available: https://www.bitglass. supply chain production in blockchain,’’ in Proc. 4th Int. Conf. Comput.
com/casb-cloud-access-security-broker Manage. Bus., Jan. 2021, pp. 83–88.
[4] (2022). Lookout CASB. [Online]. Available: https://www.lookout. [30] M. H. Rakib, S. Hossain, M. Jahan, and U. Kabir, ‘‘Towards blockchain-
com/products/casb-cloud-access-security-broker driven network log management system,’’ in Proc. IEEE 8th Int. Conf.
[5] Cisco Cloudlock. https://www.cisco.com/c/en/us/products/security/ Smart City Informatization (iSCI), Dec. 2020, pp. 73–80.
cloudlock/index.html [31] W. Zhao, S. Yang, and X. Luo, ‘‘Secure hierarchical processing and logging
[6] Microsoft Cloud App Security. https://www.microsoft.com/en- of sensing data and IoT events with blockchain,’’ in Proc. The 2nd Int. Conf.
us/security/business/siem-and-xdr/microsoft-defender-cloud-apps Blockchain Technol., Mar. 2020, pp. p52–56.
[7] Cloud-Access-Security-Broker-CASB. [Online]. Available: https://www. [32] C.-L. Hsu, W.-X. Chen, and T.-V. Le, ‘‘An autonomous log storage man-
techtarget.com/searchcloudcomputing/definition/cloud-access-security- agement protocol with blockchain mechanism and access control for the
broker-CASB Internet of Things,’’ Sensors, vol. 20, no. 22, p. 6471, Nov. 2020.
[8] Casb. [Online]. Available: https://www.proofpoint.com/us/threat- [33] N. Shi, ‘‘A new proof-of-work mechanism for bitcoin,’’ Financial Innov.,
reference/casb/ vol. 2, no. 1, pp. 1–8, Dec. 2016.

VOLUME 12, 2024 12077

 H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

[34] A. Ali, A. Khan, M. Ahmed, and G. Jeon, ‘‘BCALS: Blockchain-based [58] Z. Abaid, A. Shaghaghi, R. Gunawardena, S. Seneviratne, A. Seneviratne,
secure log management system for cloud computing,’’ Trans. Emerg. and S. Jha, ‘‘Health access broker: Secure, patient-controlled management
Telecommun. Technol., vol. 33, no. 4, Apr. 2022, Art. no. e4272. of personal health records in the cloud,’’ in Proc. 13th Int. Conf. Comput.
[35] D. M. Maslove, J. Klein, K. Brohman, and P. Martin, ‘‘Using blockchain Intell. Secur. Inf. Syst. (CISIS), 2021, pp. 111–121.
technology to manage clinical trials data: A proof-of-concept study,’’ JMIR [59] Blockchair. [Online]. Available: https://blockchair.com/ethereum/testnet
Med. Informat., vol. 6, no. 4, Dec. 2018, Art. no. e11949. [60] Etherscan. [Online]. Available: https://ropsten.etherscan.io/
[36] B. d. A. Mendonça and P. Matias, ‘‘Auditchain: A mechanism for ensuring [61] Mobile Health Dataset Named as Mhealt. [Online]. Available:
logs integrity based on proof of existence in a public blockchain,’’ in Proc. http://archive.ics.uci.edu/ml/datasets/mhealth+dataset
11th IFIP Int. Conf. New Technol., Mobility Secur. (NTMS), Apr. 2021, [62] Rapidminer. [Online]. Available: https://rapidminer.com/
pp. 1–5.
[37] Y. Zhang, S. Wu, B. Jin, and J. Du, ‘‘A blockchain-based process prove-
nance for cloud forensics,’’ in Proc. 3rd IEEE Int. Conf. Comput. Commun.
(ICCC), Dec. 2017, pp. 2470–2473.
[38] Z. Jadidi, A. Dorri, R. Jurdak, and C. Fidge, ‘‘Securing
manufacturing using blockchain,’’ in Proc. IEEE 19th Int. Conf. HAMZA JAVED received the B.S. degree in com-
Trust, Secur. Privacy Comput. Commun. (TrustCom), Dec. 2020, puter science from Pir Mehr Ali Shah Arid Agri-
pp. 1920–1925. culture University, Rawalpindi, Pakistan, in 2017,
[39] R. Upton, S. Clulow, M. J. Mahony, and J. Clulow, ‘‘Generation of a sex- and the M.S. degree in computer science from
ually mature individual of the eastern dwarf tree frog, Litoria fallax, from
the FAST-National University of Computer and
cryopreserved testicular macerates: Proof of capacity of cryopreserved
Emerging Science (NUCES), Islamabad, Pakistan.
sperm derived offspring to complete development,’’ Conservation Physiol.,
vol. 6, no. 1, Jan. 2018, Art. no. coy043.
He is currently a Lecturer with Muslim Youth
University, Islamabad. He was a Teacher Assis-
[40] C. Yenugunti and S. S. Yau, ‘‘A blockchain approach to identifying com-
promised nodes in collaborative intrusion detection systems,’’ in Proc. tant with FAST-NUCES, from August 2022 to
IEEE Int. Conf Depend., Autonomic Secure Comput., Int. Conf. Pervasive February 2023. His research work is carried out in
Intell. Comput., Int. Conf. Cloud Big Data Comput., Int. Conf. Cyber the field of blockchain, cryptography and health security.
Sci. Technol. Congr. (DASC/PiCom/CBDCom/CyberSciTech), Aug. 2020,
pp. 87–93.
[41] C. Klinkmüller, I. Weber, A. Ponomarev, A. B. Tran, and W. van der Aalst,
‘‘Efficient logging for blockchain applications,’’ 2020, arXiv:2001.10281.
[42] T.-V. Le, C.-L. Hsu, and W.-X. Chen, ‘‘A hybrid blockchain-based log
management scheme with nonrepudiation for smart grids,’’ IEEE Trans. ZAINAB ABAID received the Ph.D. degree
Ind. Informat., vol. 18, no. 9, pp. 5771–5782, Sep. 2022. from The University of New South Wales,
[43] F. Lu, W. Li, H. Jin, L. Gan, and A. Y. Zomaya, ‘‘Shadow-chain: A Australia. She is currently an Assistant Professor
decentralized storage system for log data,’’ IEEE Netw., vol. 34, no. 4, with the FAST-National University of Computer
pp. 68–74, Jul. 2020. and Emerging Science, Islamabad, Pakistan. Her
[44] M. Conti, E. S. Kumar, C. Lal, and S. Ruj, ‘‘A survey on security and research interests include malware detection and
privacy issues of Bitcoin,’’ IEEE Commun. Surveys Tuts., vol. 20, no. 4, mitigation, adversarial machine learning, secure e-
pp. 3416–3452, 4th Quart., 2018. health application, and the application of speech
[45] C. Jaikaran, Blockchain: Background and Policy Issues. Washington, DC, recognition to Arabic learning tasks.
USA: Congressional Research Service, 2018.
[46] C. V. Helliar, L. Crawford, L. Rocca, C. Teodori, and M. Veneziani, ‘‘Per-
missionless and permissioned blockchain diffusion,’’ Int. J. Inf. Manage.,
vol. 54, Oct. 2020, Art. no. 102136.
[47] E. Hofmann, U. M. Strewe, N. Bosia, E. Hofmann, U. M. Strewe, and
N. Bosia, ‘‘Background III—What is blockchain technology?’’ Supply
Chain Finance Blockchain Technology, 2018, pp. 35–49. SHAHID AKBAR received the bachelor’s degree
[48] N. D. Pattengale and C. M. Hudson, ‘‘Decentralized genomics audit in computer science and information technol-
logging via permissioned blockchain ledgering,’’ BMC Med. Genomics, ogy from the Islamic University of Technology,
vol. 13, no. S7, pp. 1–9, Jul. 2020. Bangladesh, in 2011, and the M.S. and Ph.D.
[49] S. Saxena, B. Bhushan, and M. A. Ahad, ‘‘Blockchain based solutions to degrees in computer science from Abdul Wali
secure IoT: Background, integration trends and a way forward,’’ J. Netw.
Khan University (AWKU), Pakistan, in 2015 and
Comput. Appl., vol. 181, May 2021, Art. no. 103050.
2021, respectively. His research interests include
[50] E. B. Fernandez, N. Yoshioka, and H. Washizaki, ‘‘Cloud access security
bioinformatics, digital image processing, biomed-
broker (CASB): A pattern for secure access to cloud services,’’ in Proc. 4th
ical engineering, machine learning, and deep
Asian Conf. Pattern Lang. Programs, Asian PLoP, 2015.
learning.
[51] S. Ahmad, S. Mehfuz, F. Mebarek-Oudina, and J. Beg, ‘‘RSM analysis
based cloud access security broker: A systematic literature review,’’ Cluster
Comput., vol. 25, no. 5, pp. 3733–3763, Oct. 2022.
[52] Amazon S3 Bucket. [Online]. Available: https://aws.amazon.com/s3/
[53] Microsoft365. [Online]. Available: https://www.microsoft.com/en/
microsoft-365/
[54] Saleforce. [Online]. Available: https://www.salesforce.com/in/?ir=1/
KIFAYAT ULLAH received the bachelor’s and M.S.
degrees in electrical engineering from the Sarhad
[55] E. B. Fernandez, N. Yoshioka, and H. Washizaki, ‘‘Patterns for secu-
rity and privacy in cloud ecosystems,’’ in Proc. IEEE 2nd Work- University of Science and Information Technol-
shop Evolving Secur. Privacy Requirements Eng. (ESPRE), Aug. 2015, ogy, Pakistan, in 2018 and 2021, respectively. His
pp. 13–18. areas of interests include automation, cyber secu-
[56] S. Eftimie, L. Dumitru, and V. Opriş, ‘‘Cloud access security brokers,’’ in rity, machine learning, and the IoT.
Education and Creativity for a Knowledge-Based Society, 2016.
[57] R. Xu and B. Lang, ‘‘A CP-ABE scheme with hidden policy and its
application in cloud computing,’’ Int. J. Cloud Comput., vol. 4, no. 4,
p. 279, 2015.

12078 VOLUME 12, 2024

H. Javed et al.: Blockchain-Based Logging to Defeat Malicious Insiders

ASHFAQ AHMAD received the M.S. and Ph.D. TAHANI JASER ALAHMADI received the B.S. degree in computer sci-
degrees in computer science from Abdul Wali ence and the M.S. degree in information technology (data management),
Khan University (AWKU), Pakistan, in 2016 and and the Ph.D. degree from the Faculty of Information Technology, Grif-
2023, respectively. Currently, he is an Assistant fith University, Australia, in 2019. She is currently an Assistant Professor
Professor with the Department of Computer Sci- with the Faculty of Computer and Information Sciences, Princess Nourah
ence, Muslim Youth University, Islamabad. His bint Abdulrahman University, Saudi Arabia. Her research interests include
areas of interests include machine learning, deep innovative research methods in data analysis and mining, the development
learning, and bioinformatics. of data analysis algorithms as a digital accessibility assessment tool, and
artificial intelligence implementation for enhancing digital accessibility. She
is a member of the Golden Key Society and a Media Access Australia. She
received multiple awards, such as the Google Doctoral Consortium Award,
Perth, in 2017; and the Institute for Integrated and Intelligent Systems (IIIS)
Award for Quality and Impact Research, Brisbane, in 2016.
AAMIR SAEED received the Ph.D. degree in wireless communication from
Aalborg University, Denmark. He is currently an Assistant Professor with
the Department of Computer Science and IT, University of Engineering and
Technology. His research interests include big data structures (LSM and
Bloom filters), micro-services architecture, and IoT with security in focus.

HEND KHALID ALKAHTANI (Member, IEEE) received the B.Sc. degree

in computer science from the School of Engineering and Applied Science,
The George Washington University, in 1992, the M.Sc. degree in information
HASHIM ALI received the Ph.D. degree in com- management from the Department of Engineering Management, The George
puter science from Abdul Wali Khan University Washington University, in 1993, and the Ph.D. degree in information secu-
Mardan, Pakistan. He is currently an Assistant Pro- rity from the Department of Computer Science, Loughborough University,
fessor with the Department of Computer Science, in 2018. She is an Assistant Professor with the Information Systems Depart-
Abdul Wali Khan University Mardan. His research ment, College of Computer and Information Sciences, Princess Nourah bint
interests include cloud computing, software test- Abdulrahman University. She has 23 years of work experience as a lecturer
ing, agile processes, energy-efficient systems, and and worked as a computer center president and a statistic center president
enterprise systems. He is proficient in computer with faculty collages. She received the award from SIDF Academy: Leading
systems, both theoretically and practically. Creative Transformation in Critical Time Program, Center for Professional
Development, Stanford University.

YAZEED YASIN GHADI received the Ph.D.

degree in electrical and computer engineering
from Queensland University. He is currently
an Assistant Professor of software engineering ALI RAZA received the bachelor’s degree in com-
with Al Ain University. He was a Postdoctoral puter science from the University of Peshawar,
Researcher with Queensland University before Pakistan, in 2013, and the M.S. degree in com-
joining Al Ain. He has published more than puter science from City University Peshawar
80 peer-reviewed journal and conference papers (CUSIT), Pakistan, in 2018. He is currently pur-
and holds three pending patents. His current suing the Ph.D. degree with Qurtuba University,
research is on developing novel electro-acousto- Peshawar, Pakistan. He is also a Lecturer with the
optic neural interfaces for large-scale high-resolution electrophysiology and Department of Computer Science, MY University,
distributed optogenetic stimulation. He was a recipient of several awards. Islamabad. His research interests include bioinfor-
His dissertation on developing novel hybrid plasmonic photonic on chip matics, machine learning, and deep learning.
biochemical sensors received the Sigma Xi Best Ph.D. Thesis Award.

VOLUME 12, 2024 12079