Time-Travel Investigation : Toward Building a Scalable Attack Detection Framework on Ethereum

Research output: Journal Publications and Reviews (RGC: 21, 22, 62)21_Publication in refereed journalpeer-review

2 Scopus Citations
View graph of relations

Author(s)

  • Siwei WU
  • Lei WU
  • Yajin ZHOU
  • Runhuai LI
  • Zhi WANG
  • Xiapu LUO
  • Kui REN

Related Research Unit(s)

Detail(s)

Original languageEnglish
Article number54
Journal / PublicationACM Transactions on Software Engineering and Methodology
Volume31
Issue number3
Online publishedApr 2022
Publication statusPublished - Jul 2022

Abstract

Ethereum has been attracting lots of attacks, hence there is a pressing need to perform timely investigation and detect more attack instances. However, existing systems suffer from the scalability issue due to the following reasons. First, the tight coupling between malicious contract detection and blockchain data importing makes them infeasible to repeatedly detect different attacks. Second, the coarse-grained archive data makes them inefficient to replay transactions. Third, the separation between malicious contract detection and runtime state recovery consumes lots of storage.
In this article, we propose a scalable attack detection framework named EthScope, which overcomes the scalability issue by neatly re-organizing the Ethereum state and efficiently locating suspicious transactions. It leverages the fine-grained state to support the replay of arbitrary transactions and proposes a well-designed schema to optimize the storage consumption. The performance evaluation shows that EthScope can solve the scalability issue, i.e., efficiently performing a large-scale analysis on billions of transactions, and a speedup of around 2,300× when replaying transactions. It also has lower storage consumption compared with existing systems. Further analysis shows that EthScope can help analysts understand attack behaviors and detect more attack instances.

Research Area(s)

  • attack detection, Ethereum, vulnerability

Bibliographic Note

Full text of this publication does not contain sufficient affiliation information. With consent from the author(s) concerned, the Research Unit(s) information for this record is based on the existing academic department affiliation of the author(s).

Citation Format(s)

Time-Travel Investigation : Toward Building a Scalable Attack Detection Framework on Ethereum. / WU, Siwei; WU, Lei; ZHOU, Yajin et al.

In: ACM Transactions on Software Engineering and Methodology, Vol. 31, No. 3, 54, 07.2022.

Research output: Journal Publications and Reviews (RGC: 21, 22, 62)21_Publication in refereed journalpeer-review