  In recent years several distributed ledger technologies based on directed
acyclic graphs (DAGs) have appeared on the market. Similar to blockchain
technologies, DAG-based systems aim to build an immutable ledger and are faced
with security concerns regarding the irreversibility of the ledger state.
However, due to their more complex nature and recent popularity, the study of
adversarial actions has received little attention so far. In this paper we are
concerned with a particular type of attack on the IOTA cryptocurrency, more
specifically a Parasite Chain attack that attempts to revert the history stored
in the DAG structure, also called the Tangle.
  In order to improve the security of the Tangle, we present a detection
mechanism for this type of attack. In this mechanism, we embrace the complexity
of the DAG structure by sampling certain aspects of it, more particularly the
distribution of the number of approvers. We initially describe models that
predict the distribution that should be expected for a Tangle without any
malicious actors. We then introduce metrics that compare this reference
distribution with the measured distribution. Upon detection, measures can then
be taken to render the attack unsuccessful. We show that due to a form of the
Parasite Chain that is different from the main Tangle it is possible to detect
certain types of malicious chains. We also show that although the attacker may
change the structure of the Parasite Chain to avoid detection, this is done so
at a significant cost since the attack is rendered less efficient.
