Runtime Threat Detection and Automated Response

Transcript

all right people will be coming back in I think we're gonna do I'm going to do a very short introduction introduction little talk and um we will be setting up I think workshop stations around the room for people who want to do workshops I am Jonathan Alexander I'm CTO at open Zeppelin and at open Zeppelin we just had a lot a lot of discussion about Security reviews it says audits there and we also work on open Zeppelin contracts which was just to just just discussed a little bit and opens Upland Defender and what I'm going to talk about here

just for a few minutes is about a little over a year ago we started working on a project for runtime monitoring and threat detection and we ended up launching a new project called forta Florida went live as a network about three months ago and it is a decentralized monitoring and threat detection Network completely permissionless now so well permissionless for people to participate in so you can go take advantage of what's there I'm just going to talk about it for a couple minutes to give you an introduction and then invite you

over to see a workshop where we're going to go through developing Bots for forta fort is comprised of two main components one is scan nodes and these are decentralized off-chain nodes a scan node is attached to a specific blockchain Network and gathers logs and transaction data for each mine block and passes those to four to bots which are independent components written by developers deployed to the network and that do the can do a variety of things to detect issues

look for problems look for events look across can look across other services can actually make API calls out to other things can look across multiple blockchains can look across can keep history and therefore and emit alerts which are then gathered up by a scan node and broadcast to users in the network currently we have Scan nodes running on seven networks we invite people to bring scan nodes up for other evm compatible networks Ford is designed to be not just DVM compatible but currently the scan nodes just are today only supporting evm

compatible networks we're supporting l1s and l2s today this this slide was actually made a few weeks ago we now have over 10 000 scan nodes running and um we have somewhere around a thousand Bots now running on the network you can go to Explorer at florida.network and see the data and you can also search there you can see the kind of information that's being emitted the the main logic of monitoring is conducted by these Bots there's a bot SDK go to docs.fore.network there's sdks today for JavaScript and python we're working on sdks for golang and rust you can do custom bot development meaning

you can write any kind of Bot that you want but there are a number of templates now available and they're organized in the docs into what are called threat detection kits and there are threat detection kits for defy for governance for nfts for stable coins for Bridges and what these are is a set of already existing Bots that are looking for specific aspects related to these different areas as well as some other templates which are not Bots but just code templates that then you can use if you want to build Bots for a specific project or you you just have ideas of other community Bots that might be useful to people

um you can also just go utilize existing Bots if you go to the app at app.florida.network you can browse there um there's in the app there's a set of curated protocols that are already using for the um there's new ones coming online we've had we've had a number of community grants issued by projects such as Ave and balancer to to where they've put out specs of bots that they would like to see and and then people have applied and and been granted that have been have received those grants to develop for the Bots for them um you can go subscribe to those Bots okay I'm seeing time already and

um you can also see those Bots see the source code copy them for your projects and make use of them you can also use AIML techniques in Bots here's an example of a bot you can find in GitHub which is using a live a library called profit from meta which and allows it to do anomaly detection on prices so if you want to just monitor for anomaly on events or prices you could do that with affordabot and then send alerts and finally last thing I'll say is you can hook this up you can also hook up forta for automated response we have some projects doing this today you can use open Zeppelin Defender for that you

could use other tools but for as an example maybe you detect something and then maybe that detection is going to lead to some action you could key you could send a transaction which still has to be reviewed and signed by people but you could you know you can start to automate responses based based on detection so we're going to be doing a workshop on for to come learn about how to write four to Bots and we'll show you more thanks