►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/decentralized-threat-detection-bots/
Decentralized threat detection bots are a recent area of research and development for protecting the ecosystem. This talk will cover concepts and recent research on detection bots and implementation patterns including heuristic-based, time-series based, multi-block, and TX simulation. Examples involving prior exploits will be included, as well as tools, limitations, the potential for automated threat prevention, and areas for further research.
Speaker(s): Jonathan Alexander
Skill level: Beginner
Track: Security
Keywords: security,risk,monitoring
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
There
are
a
number
of
contributors
to
this
presentation
whose
work
I'll
be
citing
here.
A
lot
of
the
information
and
research
is
been
conducted
by
these
individuals.
It
includes
Christian
Seifert,
who
is
researcher
and
Residence
at
forta,
Mariko
wakabashi,
who
is
lead
machine
learning,
engineer
at
open,
Zeppelin,
Dario
laboulio,
who
is
security
researcher
at
open
Zeppelin?
A
We
are
starting
to
see
increasing
Acceptance
in
the
space
that
security
needs
to
be
end
to
end
and
that
part
of
end
end
is
secure.
Part
of
end
and
security
includes
runtime
monitoring
and
threat
detection.
We
have
multiple
leading
security,
audit
firms,
open
Zeppelin
chain
security,
hellborn
mixed
bytes,
who
are
beginning
to
make
recommendations,
along
with
their
audits,
for
a
smart
contract
monitoring
that
can
be
done,
post
deployment.
A
The
recommendations
include
covering
protocol
assumptions
and
invariants
critical
protocol
variables,
known
protocol
risks
that
have
been
considered
acceptable,
the
use
of
the
use
of
privileged
functions
and
the
transfer
of
privileges
on
chain
and
cross-chain,
synchronization
and
oracles,
and
keeping
track
of
the
state
of
data.
That's
meant
to
be
kept
in
sync
across
these
different
environments
and
also
external
contracts
and
protocols
that
a
that
your
protocol
May
rely
on
as
well
as
identified
attacks
that
may
follow
certain
patterns
that
are
already
known,
and
this
monitoring
is
meant
to
cover
the
knowns.
A
The
things
like
specific
attack
patterns
that
we
might
see.
So
that's
one
thing
when
we
might,
we
want
to
monitor
the
known
unknowns
which
would
be
places
in
the
protocol
where
you
know
you're,
not
sure
what
might
happen,
and
you
might
want
to
monitor
that
and
then,
very
importantly,
the
unknown
unknowns.
So
we.
B
A
A
So
the
challenge,
though,
with
runtime
monitoring,
is,
if
you
take
that
whole
list,
it's
very
difficult
to
implement
the
full
set
of
monitoring
that
you
might
want,
especially
when
you
get
into
some
of
these
areas
that
are
not
the
responsibility
of
the
protocol
team
themselves,
such
as
other
protocol
implementations
and
their
risks,
and
updates
to
those,
as
well
as
things
like
the
different
attack
patterns
that
have
been
seen
in
the
ecosystem,
but
also
maybe
new
and
emerging,
and
we
see
new
attack
patterns
emerging
all
the
time.
So
we
at
open
Zeppelin.
A
We
started
working
on
post
deployment
tools
and
specifically
monitoring
a
few
years
ago,
and
this
led
us
to
the
realization
of
the
challenges
here
and
we
decided
to
build
and,
along
with
a
number
of
Partners,
now
have
launched
a
decentralized
network
for
runtime
threat
detection.
It's
called
forta
I'm,
going
to
be
citing
some
of
it
in
this.
In
this
presentation
and
a
lot
of
the
research
that's
here
has
been
done
by
people
working
in
in
and
around
Florida
forta.
You
can
go
check
it
out.
It
is
it's
a
decentralized
network
of
scan
nodes.
A
There's
thousands
of
scan
notes
running
now
across
number
of
number
of
main
Nets,
and
the
way
it
works
is
that
you
build
Bots
threat.
Detection,
Bots,
they're
deployed
as
containers
onto
the
network
they're
run
on
multiple
scan
nodes,
and
it
is
those
results,
then
that
are
brought
together
to
detect
threats.
A
So
so,
and
the
idea
here
is
that
for
protocol
teams
we
I
mean
sorry,
am
I,
like
literally
standing
right
in
front
of
the
slides,
the
the
for
protocol
teams
back
to
the
prior
Slide,
the
the
challenge
of
trying
to
do
sufficient
and
real
end-to-end
monitoring
and
threat
detection
now
is
not
just
the
team
doesn't
just
have
to
do
it
themselves.
They
can
take
advantage
of
a
community
of
threat
detection.
We
can
work
together
to
have
a
real,
complete
solution.
A
So,
first
of
all,
I'd
like
to
share
with
you
some
observations
from
research.
That's
been
done
on
threat
detection
that
hopefully
you'll
find
a
little
bit
interesting.
The
first
thing
is
that,
as
we
look
at
the
history
of
attacks,
we
begin
to
see
a
very
common
pattern
of
a
set
of
stages
that
an
attacker
goes
through,
and
this
starts
with
funding
obtaining
funds
that
will
be
used
to
carry
out
the
attack.
A
It
moves
to
preparation
and
there's
a
number
of
steps
that
are
common
in
different
kinds
of
attacks.
It
may
involve
deploying
a
smart
contract
which
is
going
to
be
used
to
carry
out
the
attack.
It
may
involve
token
impersonation
act.
It
may
involve
the
transfer
of
privileges
or
making
use
of
privileged
functions,
and
then
there
are
different
kinds
of
fraud
techniques
that
we
see
being
carried
out
to
prepare
for
stealing
funds
and
and
we'll
get
into
some
of
that
a
little
bit
later.
The
next
stage
is
exploitation.
That's
where
the
actual
attack
occurs.
A
The
funds
that
they've
obtained
and
they
move
them
to
try
to
you
know,
hide
the
trail
and
and
exit
with
funds.
One
of
the
other
interesting
things
in
reese
in
the
research
is
that
looking
at
a
quite
a
large
number
over
180
attacks
over
the
last
three
years,
specifically
in
defy,
we
see
that
over
half
of
the
attacks
are
not
have
been
non-atomic,
and
what
that
means
is
that
in
the
exploitation
phase
it
is,
it
is
more
than
one
transaction
and
typically
many
transactions.
A
That's
used
to
carry
out
the
completion
of
the
attack
and
why
that's
important
is
it
means
there
is
a
time
frame
over
which
the
exploit
occurs
and
therefore
early
detection
could
be
useful
to
taking
action
and
possibly
mitigating
the
full
effect
of
the
exploit.
So
so
that's
another
interesting
fact.
A
Another
observation
is
that
attackers
often
use
more
than
one
account.
This
may
be
obvious,
but
as
researchers
have
looked
at
this-
and
you
may
have
seen
this
in
some
other
presentations,
we
can
use
heuristics
to
associate
attacker
accounts
through
and
then
by
associating
attacker
accounts
into
clusters,
we
are
able
to
track
and
attack
through
those
stages,
as
I
just
talked
about,
even
if
many
accounts
are
being
used.
A
155
external
accounts
were
identified
as
tagged
as
having
an
exploit
in
ether
scan
and
then
those
accounts
were
associated
to
a
set
of
smart
contracts
that
those
accounts
deployed.
So
we
had
a
set
of
benign
contracts
and
we
had
a
set
of
malicious
contracts
using
a
classification
of
the
top
100
op
codes
in
each
of
those
smart
contracts.
A
We
see
incredible
success
in
being
able
to
identify
contracts
that
are
benign.
So
in
this
case
of
the
benign
contracts
night
with
98
accuracy,
the
classification
algorithm
is
able
to
say
that
is
not
a
malicious
contract
and
in
the
case
of
the
set
of
malicious
contracts,
in
this
case,
21
malicious
contracts.
A
A
We
see
that
they
follow
very
similar
patterns,
and
so,
if
we
look
deeper
into
the
patterns
in
this
case,
taking
a
even
more
advanced
kind
of
approach
to
classification,
where
using
techniques
from
natural
language
processing
grouping
together,
op
codes
into
groups
collections
in
order
and
then
analyzing
the
use
of
those
different
groups
again
with
classification.
In
this
case,
the
researchers
looked
at
over
12
000,
benign
contracts
over
a
hundred
malicious
contracts
and
then
using
the
the
tfidff
TF
IDF
NLP
technique
of
grouping
feeding
it
into
the
classification.
A
A
These
also
produce
detectable
on-chain
patterns,
and
so
in
this
case
you
can,
we
can
use
heuristic
based
approaches.
Just
to
look
for
these
patterns
of
you
know,
accumulation
or
repeated
kind
of
actions
that
might
be
carried
out
by
a
single
account
or
again,
a
cluster
of
connected
accounts
that
are
that
are
carrying
out
some
kind
of
fraud
attack
on
a
lot
of
users
and
then,
and
then
you
know
going
to
steal
those
users
tokens
they
might
do
it.
A
We've
seen
this
happen
in,
in
certain
cases,
we've
seen
attackers
who
do
all
the
preparation
up
front,
and
then
they
carry
out
the
attack
all
at
once.
We've
seen
some
cases
where
the
attack
just
continues
over
time,
but
in
this
case
using
a
heuristic
based
technique
in
and
then
using
public
data
about
ice
fishing
attacks
that
occurred
over
a
one
week
period
in
the
month
of
September.
A
This
technique
was
used
was
able
to
with
95
percent
Precision
predict
that
a
that
ice
fishing,
an
ice
fishing
attack
was
underway.
So
in
this
case
it
made
12
predictions
that
there
was
a
nice
fishing
attack
and
or
I'm
sorry.
It
may
have
I
probably
have
the
data
runs,
probably
like
13,
and
but
it
was
95
percent
accurate.
It's
a
very,
very
low
number
of
false
positives
and
of
the
21
ice
fishing
attacks
that
were
known
publicly
to
avert
that
we
could
see
historically
had
occurred
that
week
it
actually
predicted
12
of
those.
A
So
again,
these
are
promising.
Kind
of
this
is
kind
of
the
research
that's
going
on
and
some
of
the
things
we're
seeing
so
now
what
I'd
like
to
do
is
share
with
you.
Some
threat
detection
bot
techniques
that
can
be
used
to
detect
some
of
the
various
kinds
of
threats
that
we're
seeing
there
actually
will
be
a
workshop
tomorrow
on
photobot
development.
A
If
you're
interested
I
think
it's
tomorrow
afternoon,
I
don't
have
the
exact
details,
but
it'll
be
useful
for
you
to
know
just
up
front
that,
because
I'm
going
to
reference
it
in
a
couple
cases
that
photobots
you
implement
handlers,
you
can
Implement
in
JavaScript
or
python.
One
of
the
things
you
can
do
is
initialize.
You
have
your
own
environment,
it's
a
doctor
container
and
then
you,
you
kind
of
subscribe
to
either
handle
transaction
or
handle
block,
and
you
can
pretty
much
do
whatever
you
want.
A
You
can
also
look
up
other
alerts
that
have
been
emitted
by
other
Bots
and
ultimately,
what
a
bot
does
is
it
if
it
has
a
finding
if
it
if
it
finds
some
kind
of
threat
or
something
it
one
alerts
on
it,
shares
that
which
then
gets
published
and
again
other
Bots
can
take
advantage
of
that
or
users
can
take
advantage.
The
first
technique
that
I
want
to
discuss
and
on
I,
have
three
techniques
I'm
going
to
talk
about
and
in
each
of
these
I'm,
providing
some
examples
of
bots.
These
examples.
A
If
you
go
to
the
documentation
on
forta,
you'll
be
able
to
find
references,
or
if
you
go
to
the
Ford
Explorer,
you
can
also
look
up
Bots
by
name
and
they
most
of
them
are
open
source
and
you
can
link.
There
are
templates
that
mostly
are
what
I'm
covering
here
that
have
been
provided
by
either
the
Florida
Network
or
nethermind
or
lime
chain.
A
This
is
done
with
having
a
set
of
bots
that
atomically
detect
some
of
those
things
that
occur
in
funding
in
preparation
in
exploit
in
laundering.
You
can
have
individual
Bots
looking
for
individual
things
like
suspicious
contract
creation,
contract,
spoofing
ice
fishing,
large
transfers,
money
laundering.
A
You
can
also
have
Bots
that
identify
clusters
of
accounts,
and
we
have
there
are
example,
Bots
now
available
where
you
can
see
the
source
and
how
to
do
that.
And
finally,
once
you
have
these
Bots,
who
are
each
kind
of
making
an
individual
Discovery,
then
you
put
that,
together
with
a
pattern
matching
with
pattern
matching
on
the
various
alerts
and
being
able
to
then
declare
with
some
level
of
confidence.
This
is
what's
going
on.
A
A
The
second
technique
that
I
want
to
discuss
is
simulation.
In
this
case,
you
can
have
a
bot
that,
literally,
while
it's
executing
forks
mainnet
with
ganache
with
something
else,
you
can
fork
mainnet
and
then
run
simulations
to
detect
issues,
there's
kind
of
two
techniques
that
have
been
used
here.
One
is
if
you
have
a
known
protocol-
and
you
know
that
there
are,
if,
if
certain
things
happen
on
the
protocol,
then
you
would
know
that
there
must
be
something
wrong.
Perhaps
an
attack
underway.
You
could.
You
could
execute
those
in
simulation
after
every
single
block.
A
That's
been
mined
and
alert
if
the
if
the
transactions
failed.
An
example
here
is
a
liquidity
tester.
This
is
a
bot.
That's
been
written
to
take
a
defy
system,
identify
the
top
10
current
liquidity
holders
and
simply
execute
their
ability
to
exit
their
position
after
each
block,
and
in
the
case,
if
any
of
them
were
not
able
to
exit
their
their
position,
it
would
alert
the
other
technique
here
is
to
test
contracts,
and
we
have
a
couple
of
Bot
examples,
one
that
uses
fuzzing
one
that
doesn't.
A
But
in
this
case
the
simulation
is
to
take
a
deployed
contract,
Fork
the
network
and
then
basically
try
to
execute
every
single
method,
knowing
nothing
about
the
the
contract
itself,
just
detecting
it
through
code
and
trying
to
execute
it
and
looking
to
see
if
any
execution
results
in-
let's
say
a
large
funds
transfer
or
some
other
kind
of
unusually
anomalous
occurrence.
That
would
say
there
is
something
this
this
contract
is
trying
to
do
something
or
it
seems
to
result
in
a
big,
a
big
transfer
of
funds
and
therefore
is
suspicious.
A
The
final
technique
I
want
to
talk
about
is
the
use
of
machine
learning
in
bots.
In
the
case,
in
this
case,
you
can
take
a
machine
learning
model,
you
can
serialize
it
to
a
file
in
the
case
of
Florida,
you
can
deploy
models
with
the
bot
and
you
can
use
the
initialize
function
to
load
a
model
and
then
in
your
Bot
you
can
execute
the
model.
A
This
has
been
used
successfully
already
in
a
number
of
bots
that
do
anomaly
detection
and
also
a
malicious
contract
detection.
So
in
this
case,
for
example,
there
is
a
smart
change-
detector
bot
that
I've
referred
to
here
and
a
Time
series
analyzer
that
they
use
they
use
machine
learning,
algorithms
I
know
one
of
them
is
a
library
that
actually
The
Meta
team
developed.
That
is
very
good
at
detecting
outliers
and
D
deviation
with
a
limited
amount
of
false
positives.
So
it's
pretty
good
at
saying.
A
A
A
These
kinds
of
bots
so
I
want
to
wrap
up
just
with
a
couple
of
challenges,
and
you
might
have
been
thinking
about
some
of
these
as
I've
been
speaking.
There
are
challenges
here
that
we're
all
dealing
with
Atomic
attacks
are
obviously
a
challenge.
So
I
said
that.
Well
we
have
history
to
tell
us
that
more
than
half
the
attacks
are
non-atomic,
but
of
course
that
means
that
40
to
45
percent
of
the
attacks
are
Atomic.
Also,
private
transactions
can
be
used,
and
so
this
is
a
challenge
for
threat,
detection
and
monitoring.
A
These
are
things
that
Ford
is
working
on.
There
are
already
some
things
available
for
private,
but
these
are
also
areas
for
future
research
latency
by
the
way
on
the
Ford
network
is
about
40
seconds
from
Mind
Block
to
alert,
but
things
that
are
being
looked
at
are
possibility
of
trusted
private
scan
pools
for
people
who
want
to
monitor
in
secret,
pre-submission
or
mempool
transaction
scanning,
on-chain
alerts,
which
would
provide
a
possibility
for
on-chain
reaction
and
other
systems
that
can
be
used
for
automated
action
and
follow-up.
A
Open
Zeppelins
working
on
these
things
for
the
community
and
many
of
the
contributors
I
mentioned,
are
starting
to
work
into
these
things
and
and
to
wrap
up.
I
would
say
if
you
are
interested
bot,
Developers
security,
researchers,
data
scientists,
please
go
to
florida.org
and
you
can
learn
more
and
find
ways
to
get
involved
and
there's
various
grants
and
incentives
available
for
people
to
get
involved
and
with
that
undone.
And
if
there's
time
I'll
take
questions.
B
C
A
That's
well
I
mean
in
this
conver
in
this
presentation.
I
wasn't
so
much
getting
into
that,
but
that's
obviously
a
big
topic
of
conversation
for
everybody.
I
think
we
are
starting
to
see
well
well.
We
have
seen
many
attacks
in
the
wild
where
teams
have
paused
their
smart
contracts
and
we
even
saw
a
chain
pause
the
whole
chain.
A
A
You
know
I
think
you
may
have
heard
some
of
the
leading
D5
Protocols
are
starting
to
discuss
this
so
pausing
and
then
having
some
capability
to
you
know.
Deal
with
the
attack
is
is
kind
of
a
base
point,
but
there's
a
lot
to
get
into
there,
because
you
know
even
pausing,
depending
on
the
nature
of
the
attack,
may
not
solve
the
problem
right
and
and
I.
Think.
A
B
Right,
thanks
for
your
talk,
Jonathan
speaking
of
things
that
you
do
after
the
attack,
what
is
open
sibling
doing
today
with
that
information,
how
does
open
sibling
harness
that
information
to
transform
that
into
knowledge?
That
is
the
first
question
and
the
same
question:
is
there
anything
to
do
besides
a
smart
contract
audit
in
terms
of
things
that
you
can
do
before
that
attack
happens
like
this
scanning,
the
the
mempool
or
or
having
some
heuristic
in
there.
A
Well,
a
couple
two
parts
to
your
question:
the
first
first
one
is
that
open
Zeppelin
is
in
our
audit
practice.
We
are
now
when
we
do
an
audit.
We
typically
also
make
recommendations
because
about
what
should
be
monitored,
because
the
Auditors
have
good
insight
into
well
we're
training
on
our
Auditors
more
and
more
in
how
monitoring
can
help.
So
then,
the
monitors
also
the
Auditors,
also
understand
the
protocol,
and
they
can
say
to
a
team.
A
We
have
a
product,
we
have
a
product
platform
called
Defender,
we're
we're
working
on
how
to
automate
those
responses
that
we
were
talking
about
like
how
you
could
at
least
get
to
where
you
could
pause
as
quickly
as
possible
as
an
example.
So
we're
doing
all
those
things
and
we're
collaborating
I
know:
Forte
has
many
multiple
I
mentioned
chain
Security
in
halborn
and
mixed
bytes
are
all
doing
some
similar
things
I
think
yeah
we're
good.
Thank
you.