EthScope: A Transaction-centric Security Analytics Framework to Detect Malicious Smart Contracts on Ethereum.

Lei Wu,Siwei Wu,Yajin Zhou,Runhuai Li,Zhi Wang,Xiapu Luo,Cong Wang,Kui Ren
2020-01-01
Abstract:As one of the representative blockchain platforms, Ethereum has attractedlots of attacks. Due to the existed financial loss, there is a pressing need toperform timely investigation and detect more attack instances. Though multiplesystems have been proposed, they suffer from the scalability issue due to thefollowing reasons. First, the tight coupling between malicious contractdetection and blockchain data importing makes them infeasible to repeatedlydetect different attacks. Second, the coarse-grained archive data makes theminefficient to replay transactions. Third, the separation between maliciouscontract detection and runtime state recovery consumes lots of storage. In this paper, we present the design of a scalable attack detection frameworkon Ethereum. It overcomes the scalability issue by saving the Ethereum stateinto a database and providing an efficient way to locate suspicioustransactions. The saved state is fine-grained to support the replay ofarbitrary transactions. The state is well-designed to avoid saving unnecessarystate to optimize the storage consumption. We implement a prototype namedEthScope and solve three technical challenges, i.e., incomplete Ethereum state,scalability, and extensibility. The performance evaluation shows that oursystem can solve the scalability issue, i.e., efficiently performing alarge-scale analysis on billions of transactions, and a speedup of around2,300x when replaying transactions. It also has lower storage consumptioncompared with existing systems. The result with three different types ofinformation as inputs shows that our system can help an analyst understandattack behaviors and further detect more attacks. To engage the community, wewill release our system and the dataset of detected attacks.
What problem does this paper attempt to address?