Function name sequences enable real-time blockchain attack detection
Function Name Is All You Need to Detect Blockchain Application Attacks
Cryptography and Security
Summary
Blockchain apps called decentralized applications (dApps) sometimes have bugs that attackers exploit, causing people to lose money. Detecting these attacks is hard because it often needs special rules or access to the app’s code, which isn’t always available. The authors show that just looking at the names of functions called in a transaction can reveal what the transaction does and catch attacks. They built a tool named TxLucent that uses these function names to detect attacks quickly and accurately without needing the app’s code or manual rules.
What this means in practice
- •For blockchain security teams: Identify and flag malicious transactions in real time using function call patterns instead of source code.
- •For transaction monitoring services: Provide fast detection of blockchain application attacks for broader transaction streams without needing contract source code.$Commercial implications: Enables new or improved commercial real-time security monitoring products that scale across many contracts without source access.
Authors
Rui Xi, Zehua Wang, Karthik Pattabiraman
Abstract
Blockchain application attacks, targeting business logic bugs in decentralized applications (dApps), have been an increasing concern to their developers and users, causing significant financial loss. Existing attack detectors either rely on handcrafted rules for detection, or need difficult-to-obtain smart contract source code to analyze attack transactions. This makes them brittle and inapplicable in practice. In this paper, we argue that function name sequences suffice to capture the high-level semantics of a transaction, and hence can be used to detect blockchain application attacks. Our empirical study on transactions from 424 real-world attack incidents shows that 98.46% of call traces can be resolved to function names, whereas only 74.78% invoke contracts with available source code. Based on this observation, we propose TxLucent (pronounced "translucent"), an automated framework to detect blockchain application attacks by extracting application semantics from transaction call traces. TxLucent maps call traces to function name sequences and uses a transformer to learn semantics from such sequences. Consequently, TxLucent can detect attacks without relying on hand-coded patterns or source code. Our results show that TxLucent achieves a 1.56% false negative rate on 424 known incidents with 14,611 attack transactions, and an estimated 0.0017% false positive rate for benign transactions from over 500 million transactions on the Ethereum blockchain. Finally, TxLucent takes an average of 24.90 milliseconds to analyze a transaction, thus supporting real-time attack detection on popular blockchains.