Ethereum Security Inteligence Redefinded Novel approach to Transaction Threat Analysis

Transcript

[Music] thank you folks uh yeah hi all I'm Alex I am an R&D engineer at tender and today I'll be talking about our approach to transaction threat analysis uh so yeah my background I come from uh data science and machine learning uh areas and in general before joining T tender I didn't have much exposure to blockchain or blockchain uh security but while I was working on it I realized that a lot of Concepts from data science can quite naturally be

uh transferred to transaction security so let's start so why exactly I'm seeing transaction security because that's the level at which we do security analysis so I don't know if you're familiar with this screenshot if you ever used Tel Explorer so this is just a part of transaction which is unrolled so you can see here there are multiple jumps inside a single contract there are calls or different contracts delegate calls there also uh uh storage persisting so like you can see in a single transactions you pretty much have a huge graph of just things happening all around so that's why I wanted to to

emphasize that transactions trans transaction is a clearly rich multi-dimensional source of information from which we can learn a lot what is happening on blockchain uh yeah like I said I come from data science background and here I would like to mention the concepts which I found can easily be translated into into blockchain security so on the one side on on on one side we have data on the other side compute related to data we have data quantity so of course you need a lot of data to well create any insight out of it data quality so the data you have should be quite accurate and in

general should have a lot of context more context merrier data privacy uh well in general like you still want to keep some private informations out of the way so you cannot really create Insight out of all information and data relevance so some some data points can be relevant uh at some time then later can be not that relevant or they maybe only apply to some specific security problems not to all of them on the other side we have compute so here you can see like generally the four uh four steps of of the computer pipeline we have data Gathering where raw data is gathered and stored we have data

pre-processing where row data is just uh enriched with additional context and metadata so so it's easier to be used later we have model training and insight creating where you create some inside from which we can later in the inference uh uh step uh predict some next actions or or do some risk analysis so let's go quickly one by one uh data quantity in blockchain so good thing here like blockchain is huge we have a lot of data there and what's even better that blockchain is kind of an immutable data set so what happen once that pretty

much is persistent cannot be changed so you can use it for good uh for example on ethereum Main night we have more than million transactions a day up until now there have been more than two billion transactions and like I said each transaction is a graph of things happening so that's really really a lot of a lot of data nowadays L2 Solutions are trending so like we have even like more transactions happening like on Bas abum there are like five Millions five million transactions a day on like the the elto solutions C compile there are more more than 10 Millions transactions a day and not just that we're having a lot of transactions there's also more and more new users more new addresses

being active each day and not just that they are active they're also active in different uh blockchain ecosystems so we have some users being active in defi some in gaming which is really good because we can not just learn a lot but we can learn a lot in different subsections and probably be even better in solving specific specific problems of security on blockchain data quality okay so I mentioned we have a lot of data but a problem here is is that that data is quite raow and low level so it's not really usable at the basic stage you get it from different rpcs that's why it's it's quite important to use domain expertise uh

like knowledge of protocol mechanics of uh generally historic thread types analysis of some older hacks uh to enrich the me uh enrich the the uh data with some context uh and the idea here is to reduce the noise increase the signal Clarity and just all in all uh have better data in a meaning that it's even in some cases human readable so we can even sometimes analyze it by hand this is uh pretty much the gist of my presentation today I'll return back to it in the second part of presentation with more detail data privacy uh so this one is a bit interesting here because so in general uh blockchain is transactions

are implicitly transparent so you can kind of see what is happening there but thing is that user is not fully identified but it it has like pseudonymous uh address by what by which is identified and if you really uh want to L it link it to some real word entities which is not really done that often you have to go through a a bit more uh uh of but a bit longer process of analysis and that's only done in some sensitive Financial activity cases so yeah in general you can say that there is an issue of of balancing transparency and anonymity on on blockchain regarding security uh data relevance so one thing

here I said we have a lot of data but thing the thing is uh as networks are continuously evolving so you have protocol up upgrades all the time and on top of that like like I said L2 Solutions are training trending nowadays so generally user behavior is kind of changing uh uh you cannot really use all data all the time so you can always be kind of up to dat and make sure that the data you're using is relevant to the current state of situations and also one thing I previously mentioned for some more specific security problems like you can only use maybe uh uh def data like Swap and and trade transactions if you just want to do defy risk analysis or for for

example for nft security you should maybe only be checking uh transactions related to nft marketplaces okay so back to the other side compute like I said first stage data Gathering so yeah once again like good thing we have an abundance of data but a problem there is that you have to find a really efficient way to to process it and store it so it's really really important that you kind of do it in parallel much much faster than in general how in real time transactions are happening so it's of utmost importance to have a high quality fast transaction Trace Source uh if you

haven't tried check tle Next Step data pre-processing so yeah like I mentioned beforehand uh the data you get from from most of the sources is quite raw you have to pre-process it uh in best possible cases you even get to some kind of human inter interpretable level uh I the idea here is to use the general expert knowledge so this like I like I said I'll return back to this in the second part of my presentation uh the training process well it's a bit interesting here so yeah I said we had a lot of data but I never mentioned any

labels so in general it's quite hard to find labeled data sets for blockchain specifically for security issues it's it's quite hard to find them and you find them there in generally not full uh you always have something missing and you have to spend a lot of resources just to maybe label it manually so standard supervised learning here is quite impractical one of the alternative strategies you want you may want to try here is to develop some heris sixs uh to kind of autogenerate weak labels we call them weak because you're not you're not really 100% sure they are fully true but you just create a lot of them and you

hope that your training algorithm will just catch what's the the G is there combine those with the small amounts of strongly labeled data data you have and you can probably bootstrap some uh original Insight with time more data would come and you could definitely may get to to better performances and in the end inference uh so this part of the of the uh compute pipeline is the only one which is uh visible to the end user so here the biggest issue is to make it extremely fast we are talking here about like subsecond execution times and why is that because in general blockchain transactions have some latency by Design you what you don't want to do is to

like uh make the user spend even more time waiting for transaction to to be checked for some security risks you want it you want it to look like it's not even happening and just give the user the green light like your your transaction is good to go or your transaction is potentially risky okay so like I said in the second part of presentation I'll focus more more about on on the data pre-processing where we increase quality of the row data we get at the beginning by mentioning a couple of examples how you how you can uh just enrich address intelligence whereby address intelligence I mean the information you have about an address either static or dynamic meaning the one that is uh the

insights you can you can learn uh by looking at the addresses activity on chain the first one one of my favorite examples add similarities so we know that addresses are like 40 Carles long you would say it chances that their similar addresses are quite low but the Sim similarity here here I Define it a bit different I just look at the like four first four and last four characters and why is that is because like in a lot of applications like platforms where you just have your transaction listing and stuff just for the sake of practicality of the user interface only those characters are

shown and you have like three dots in in between so that's why an attack like address poisoning is is quite possible and in the latest analysis I did it's quite of and it's happening like every every like 10 15 minutes you can find an example of it so on the right you can see an example of it let's say we have the purple address the Alex one which is regularly transacting with the blue address 1 2 3 4 so I'm regularly talking that's an address I trust and all is good then we have an attacker who generates a bunch of addresses like it's it's not that expensive they can generate a bunch of them and then they can go through uh uh like latest blocks

and just try try to find one address which is active there and which is similar to any of their addresses so in this case we have the red address which has has the same first four and last four uh characters as as the blue address and the attacker can just send some small amount to me or even like near zero doll value amount with a single goal just to enter my contact list and for example if my contact list looks like this I've only boled the first four and last four uh uh characters because chances are like only those would be shown I would have to like hover over it or just to just check it out if I'm if I'm not checking full of the stuff I can just click on the on

the on the uh attacker's address and transact with them and send them some assets similar thing can happen also with with token symbols you can easily find like thousands of CopyCat of usdt and usdc tokens I just search on coin gecko people are creating them all the time just uh because they want something like this happen they want an user to accidentally just click on that token maybe try to to buy it or something like that next thing token value Trend so imagine uh if you when you're uh when you're just like buying a a token or doing something with it in General on

most applications you only see like its current value you don't see its Trend so you cannot see a situation like this which you're probably familiar with this example it happened like 10 15 days ago but nevertheless the thing here is uh uh this token is clearly unstable this is an example of rockpool rockpool is an attack which is where where the token holders or creators just hold large amounts of of of that token uh they just wait for its value to to be built a lot and then they just sell all of it and the the value plummets so in cases where you know just the current value you cannot really be sure what's happening with it when you know the trend you can

maybe have much more insight into what you're doing like you can have you can have a signal saying okay this is clearly an unstable token are you sure you want to trade with it guess usage so this one is also interesting uh on the left side I'm mentioning user gas usage stats which is which is pretty much like basic statistics basic statistics the uh about the gas usage a user has when is when is sending transactions so here I just fixed random EA which has a huge sample size like they have like more than 2500 uh sorry uh more than 20 255,000 transactions in their history

and but you can see that like the mean gas usage is near 21k meaning they're mostly like doing just simple eth transfers but for this particular address I found an example where they are just maybe they wanted to do it maybe they didn't but they SP a lot of gas so in general this is a case where you would feel that the user would want to have a signal like okay in general you're spending much less gas are you sure you want to to uh create to submit this transaction because it's going to be much more expensive than you used to on the other side we're collecting the same uh statistics about gas usage but for uh each method of each contract so

here I have an example of Jad I'm not really familiar with the contract but there was an attack on it a month ago so it's collect fees uh function in general it has gas usage with this mean around 8 and a half million but a month ago somebody found an issue with it and they did an re-entrancy attack on it and that transaction spent spent three times more gas than it's then it is its average so like if uh if uh the owner of the contract had some kind of signaling like about their statistics with with gas usage they could they could have immediately known that something is

happening with their contract uh on the other side the contract itself might be malicious sometimes they might change their own implementation to some proxy uh and then but that can also be realized by perhaps uh seeing the decrease like a huge decrease in their guess usage historical contexts one more quite important thing so in general uh this is some some of the cases you want to be really aware of so whenever you're first time interacting with someone you want to have some kind of signal okay this is n UND to you are you sure you want to transact with them uh or also there are different types of

transactions so if there is an address which is constantly sending me some assets but maybe it's totally random to me I want to be aware when it's the first time I am sending assets to them or just approving them to to spend my assets uh on the right side you can see a bit more interesting uh uh case so there's no direct contact but for example let's say the node on the bottom is a tornado cache address tornado cache for those you who don't know it's it's just a mixing service where people just push their assets anonymously and then withdraw them at at some point using S confirmation codes uh it's used a lot for money laundering so you don't want to be

connected to them either directly or indirectly and this is a quite regular pattern where a malicious uh address the X One the red one uh creates has a bunch of proxy addresses through which they contact the tornado cash so they Deposit they withdraw cash there so they're doing some some uh uh uh some stuff which are not really supposed to be done and even though like it's not direct contact you still want to be aware that that uh of this pattern and you you the yellow of the Naim node don't want to have any contact with the red node and the last thing I want to

mention probably my favorite one is analyzing function execution flows and creating a correlation with uh of the function execution with well-known events like transfers approvals Burns meanss and stuff so this way by not doing the static analysis of a function but by doing like Dynamic analysis of its execution you can build a behavioral profile of the function and that way you can say okay so on the on the right side I have an example uh we have Teter super wellknown contract it has a function transfer from and as expected that function in like 99.97 percent successfully transfers uh assets from one of its parameters to another

and that's supposed to be happen and that's kind of you can be sure that the function for which you can even see the code is doing what it's supposed to be but below I I found some random unverified contract and I found some of its function which also has super hard correlation with a mint event so even though you cannot see its code uh you can kind of know what that function is doing so whenever new user maybe wants to call it that you can just say okay I'm not really 100% sure but probably this is what's going to happen so to sum up uh by leveraging like expert driven knowledge uh for data

process preprocessing we can transform raw blockchain data which is fully accessible uh to actionable intelligence improving track threat detection and model training and making real time inference faster thank you that's all by IEP for today if you have any questions feel free to ask thank you [Applause] Alexander questions from the room yep oh yeah um you mentioned needing quick access to trace data and then proposed using tenderly I already used tenderly just out of Interest how does tenderly get the trace dat dat quickly at the head of the chain oh yeah yeah yeah not really my area of expertise uh

but so in general especially for this case we did a lot of a lot of you know specific uh optimizations uh so most of them are around just having like the latest blocks like in some cash and and really really be much much faster to to be uh access but also we made sure that there's enough time to for for us to analyze them before processing to the next batch because it's quite important to still have that chronological order of stuff so you want to know okay this is what you learned here but that happened before the next thing we learned so yeah we did a lot of optimizations in both you know paralyzation uh uh uh for both

paralyzation and for both that temporal ordering of stuff okay so is there just a lot of Hardware as well you've just um attacking definit yeah yeah any more questions y you need so thank you for your talk I have a question for you since you are doing your PhD in graph Nal networks any you work in there sorry any work in graph Nal networks uh well yeah I mean uh so in general I like I just started my research so it's mostly about you know like raw graphs with not much context to them uh generally my like my the data sets I prefer are transactional

data sets currently I'm working mostly with you know like classical transactions like old banking systems uh but yeah I do plan to move a bit more to we3 I would say like there's definitely future there but in general I didn't see much much sexo research just because there's a lot of data in web like I said like each transaction is a graph for itself and then you have like the graph of all addresses contracts and stuff it's just like a very multi-dimensional problem which I think is going to be it's going to take some time to be sold [Music]