[Paper Review] EthScope: A Transaction-centric Security Analytics Framework to Detect Malicious Smart Contracts on Ethereum.

Lei Wu, Siwei Wu+6 more|arXiv (Cornell University)|May 17, 2020

Blockchain Technology Applications and Security19 references9 citations

TL;DR

EthScope is a transaction-centric security analytics framework that enables efficient, large-scale detection of malicious Ethereum smart contracts by recovering blockchain states, replaying transactions at scale, and allowing dynamic instrumentation for behavioral introspection. It achieves a 2,300x speedup over JSTracer and effectively detects six types of attacks on over 8 million transactions.

ABSTRACT

As one of the representative blockchain platforms, Ethereum has attracted lots of attacks. Due to the potential financial loss, there is a pressing need to detect malicious smart contracts and understand their behaviors. Though there exist multiple systems for smart contract analysis, they cannot efficiently analyze a large number of transactions and re-execute smart contracts to introspect malicious behaviors. In this paper, we urge for a transaction-centric security analytics framework for Ethereum, which provides an efficient way to quickly locate suspicious ones from a large number of transactions and extensible way to detect malicious smart contracts with analyst-provided scripts. We present the system design in the paper, which solves three technical challenges, i.e., incomplete states, scalability and extensibility. We have implemented a prototype system named EthScope to solve these challenges. In particular, the first component Data Aggregator collects and recovers critical blockchain states. The second component Replay Engine is able to {replay} arbitrary and a large number of transactions. The third component Instrumentation Framework exposes interfaces for an analyst to dynamically instrument smart contracts and introspect the execution of suspicious transactions. The comprehensive evaluation with six types of attacks demonstrated the effectiveness of our system. The performance evaluation shows that our system can perform a large-scale analysis on suspicious transactions (more than 8 million ones) and has a speed up of around 2,300x compared with the JSTracer provided by Go-Ethereum. To engage the community, we will release our system and a dataset of detected attacks on https://github.com/zjuicsr/ethscope.

Motivation & Objective

• To address the lack of scalable and extensible systems for detecting malicious smart contracts in Ethereum.
• To enable efficient analysis of large-scale transaction datasets by overcoming incomplete blockchain state and scalability limitations.
• To provide analysts with a flexible, script-based interface to dynamically instrument and introspect suspicious contract executions.
• To support comprehensive detection of diverse attack patterns through replayable, state-recovered transaction analysis.

Proposed method

• The Data Aggregator component collects and reconstructs critical blockchain states from on-chain data to ensure complete execution context.
• The Replay Engine enables high-throughput replay of arbitrary and large numbers of transactions using recovered states, ensuring consistent execution behavior.
• The Instrumentation Framework exposes runtime interfaces that allow analysts to inject monitoring logic into smart contracts during replay for dynamic behavior introspection.
• The system integrates state recovery, transaction replay, and dynamic instrumentation into a unified pipeline for transaction-centric security analytics.
• It supports analyst-provided scripts to extend detection logic, enabling flexible and extensible analysis of malicious behaviors.
• The framework is implemented as a prototype, EthScope, and evaluated on real-world attack patterns and large-scale transaction sets.

Experimental results

Research questions

• RQ1 How can we efficiently analyze large volumes of Ethereum transactions for malicious behavior without relying on full contract re-execution from scratch?
• RQ2 What mechanisms enable accurate state recovery and transaction replay for security analysis in a scalable manner?
• RQ3 How can we provide analysts with extensible, dynamic instrumentation capabilities to introspect suspicious contract executions?
• RQ4 To what extent can a transaction-centric framework outperform existing systems in speed and detection accuracy?
• RQ5 What types of smart contract attacks can be effectively detected using this approach across diverse transaction workloads?

Key findings

• EthScope achieved a 2,300x performance speedup compared to JSTracer when analyzing over 8 million transactions.
• The system successfully detected six distinct types of smart contract attacks in comprehensive evaluation.
• The Data Aggregator component effectively recovered critical blockchain states necessary for accurate transaction replay.
• The Replay Engine enabled high-throughput execution of large transaction batches, demonstrating scalability.
• The Instrumentation Framework allowed analysts to dynamically inject monitoring logic and observe execution flows in suspicious transactions.
• The prototype system was released with a dataset of detected attacks to support community research and reproducibility.