时间旅行调查：在以太坊上构建可扩展的攻击检测框架
Time-Travel Investigation: Towards Building A Scalable Attack Detection Framework on Ethereum
摘要：
以太坊作为代表性的区块链平台之一，受到了大量的攻击。由于存在的财务损失，迫切需要进行及时的调查并发现更多的攻击实例。尽管已经提出了多个系统，但是由于以下原因，它们遭受可扩展性问题。首先，恶意合同检测和区块链数据导入之间的紧密耦合使得它们不可能重复检测不同的攻击。其次，粗粒度的归档数据使得它们重放事务的效率低下。第三，恶意合约检测和运行时状态恢复之间的分离消耗大量存储。在本文中，我们提出了一个可扩展的以太坊攻击检测框架的设计。它通过将以太坊状态保存到数据库中并提供一种有效的方法来定位可疑交易，从而克服了可扩展性问题。保存的状态是细粒度的，以支持任意事务的重放。状态是精心设计的，以避免保存不必要的状态，以优化存储消耗。我们实现了一个名为EthScope的原型，并解决了三个技术挑战，即，不完整的以太坊状态，可伸缩性和可扩展性。性能评估表明，我们的系统可以解决可扩展性问题，即，高效地对数十亿笔交易进行大规模分析，回放交易时速度提升约2,300倍。与现有系统相比，它还具有更低的存储消耗。三种不同类型的信息作为输入的结果表明，我们的系统可以帮助分析人员了解攻击行为，并进一步检测更多的攻击。为了让社区参与进来，我们将发布我们的系统和检测到的攻击数据集。
英文摘要：
As one of the representative blockchain platforms, Ethereum has attracted lots of attacks. Due to the existed financial loss, there is a pressing need to perform timely investigation and detect more attack instances. Though multiple systems have been proposed, they suffer from the scalability issue due to the following reasons. First, the tight coupling between malicious contract detection and blockchain data importing makes them infeasible to repeatedly detect different attacks. Second, the coarse-grained archive data makes them inefficient to replay transactions. Third, the separation between malicious contract detection and runtime state recovery consumes lots of storage. In this paper, we present the design of a scalable attack detection framework on Ethereum. It overcomes the scalability issue by saving the Ethereum state into a database and providing an efficient way to locate suspicious transactions. The saved state is fine-grained to support the replay of arbitrary transactions. The state is well-designed to avoid saving unnecessary state to optimize the storage consumption. We implement a prototype named EthScope and solve three technical challenges, i.e., incomplete Ethereum state, scalability, and extensibility. The performance evaluation shows that our system can solve the scalability issue, i.e., efficiently performing a large-scale analysis on billions of transactions, and a speedup of around 2,300x when replaying transactions. It also has lower storage consumption compared with existing systems. The result with three different types of information as inputs shows that our system can help an analyst understand attack behaviors and further detect more attacks. To engage the community, we will release our system and the dataset of detected attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
