发表机构
Faculty of Electronics and Information Technology, Warsaw University of Technology（华沙理工大学电子与信息技术学院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
该研究提出基于压缩相似度的无训练本地发现原语，通过合成交易语法、过滤高信号合约、构建行为图，实现以太坊开放世界无需直接资金关联的 Sybil 节点发现，经多类测试验证有效性。
AI 中文摘要
Sybil 攻击者是区块链参与者，他们采用普通用户的特征来利用空投或影响治理。当前 Sybil 节点检测方法包括构建图，这需要被检查钱包之间的代币转移；也有使用机器学习算法的方法，但这些方法将该任务视为闭集分类问题，使其易受攻击策略或规避策略频繁变化的影响。我们解决以下问题：基于压缩的相似度能否在没有直接金融关联的情况下区分 Sybil 机器人、真实用户和套利机器人钱包；高信号合约对 Sybil 发现有何影响，以及行为图在时间漂移和对抗扰动下的鲁棒性如何。我们的方法从 EVM（以太坊虚拟机）轨迹中合成符号交易语法，分别捕获交易节奏、执行结构和功能意图；使用我们自己的协议 Blind-Spot Protocol 过滤高信号合约；采用基于 Gzip 的 NCD 构建用于 Sybil 发现的行为图。我们针对监督机器学习基线、时间拆分和合成伪装压力测试验证该框架。最终，我们贡献了一种用于 Sybil 候选发现的漏损感知行为框架，其核心 NCD 原语无需监督训练，可在无明确资金关联的情况下扩展可疑种子钱包，我们将该方法定位为开放世界区块链审计的无训练本地发现原语，而非正式的开集识别系统。
英文摘要
Sybil attackers are Blockchain actors that adopt the characteristics of regular users to exploit airdrops or influence governance. Current methods of Sybil actor detection include constructing graphs, which requires token transfers between examined wallets. Machine learning algorithms have been employed as well, but they treat the task as a closed-set classification problem, making them vulnerable to frequent changes in attack strategies or evasion tactics. We address the following questions: can compression-based similarity differentiate Sybil bots, organic users, and arbitrage bot wallets without direct financial links? What is the effect of high-signal contracts on the discovery of Sybils, and how robust are behavioral graphs under temporal drift and adversarial perturbations? Our approach synthesizes a symbolic Transaction Grammar from EVM (Ethereum Virtual Machine) traces, capturing separately transaction rhythm, execution structure, and functional intent. The high-signal contracts are filtered with our own protocol, called the Blind-Spot Protocol. Gzip-based NCD is used to construct a behavioral graph for Sybil discovery. We validate this framework against supervised machine learning baselines, a temporal split, and synthetic camouflage stress tests. Ultimately, we contribute a leakage-aware behavioral framework for Sybil candidate discovery. Its core NCD primitive requires no supervised training and can expand suspicious seed wallets without explicit funding links. We position the method as a training-free local discovery primitive for open-world blockchain audits, rather than as a formal open-set recognition system.
CommentsAccepted as a full paper and scheduled for presentation at the European Conference on Advances in Databases and Information Systems (ADBIS 2026)
