[论文解读] Towards Effective Detection of Ponzi schemes on Ethereum with Contract Runtime Behavior Graph

Ruichao Liang, Jing Chen+7 more|arXiv (Cornell University)|Jun 3, 2024

Spam and Phishing Detection被引用 4

一句话总结

该论文提出PonziGuard，一种通过建模智能合约运行时行为并利用图神经网络（GNNs）进行图分类，以检测以太坊上庞氏骗局的新方法。在真实数据集上，其精确率为96.9%，召回率为98.2%，F1得分为97.5%，并识别出以太坊主网上805个实际存在的庞氏合约，包括0-day骗局。

ABSTRACT

Ponzi schemes, a form of scam, have been discovered in Ethereum smart contracts in recent years, causing massive financial losses. Existing detection methods primarily focus on rule-based approaches and machine learning techniques that utilize static information as features. However, these methods have significant limitations. Rule-based approaches rely on pre-defined rules with limited capabilities and domain knowledge dependency. Using static information like opcodes for machine learning fails to effectively characterize Ponzi contracts, resulting in poor reliability and interpretability. Moreover, relying on static information like transactions for machine learning requires a certain number of transactions to achieve detection, which limits the scalability of detection and hinders the identification of 0-day Ponzi schemes. In this paper, we propose PonziGuard, an efficient Ponzi scheme detection approach based on contract runtime behavior. Inspired by the observation that a contract's runtime behavior is more effective in disguising Ponzi contracts from the innocent contracts, PonziGuard establishes a comprehensive graph representation called contract runtime behavior graph (CRBG), to accurately depict the behavior of Ponzi contracts. Furthermore, it formulates the detection process as a graph classification task on CRBG, enhancing its overall effectiveness. The experiment results show that PonziGuard surpasses the current state-of-the-art approaches in the ground-truth dataset. We applied PonziGuard to Ethereum Mainnet and demonstrated its effectiveness in real-world scenarios. Using PonziGuard, we identified 805 Ponzi contracts on Ethereum Mainnet, which have resulted in an estimated economic loss of 281,700 Ether or approximately $500 million USD. We also found 0-day Ponzi schemes in the recently deployed 10,000 smart contracts.

研究动机与目标

• 解决现有基于规则和静态分析方法因判别能力弱和可解释性差而无法可靠检测庞氏合约的局限性。
• 克服基于交易的检测方法因缺乏真实交易历史而无法识别0-day庞氏骗局的可扩展性问题。
• 利用运行时行为——特别是动态数据流和执行轨迹——作为更有效的信号，以区分庞氏合约与良性合约。
• 开发一种基于图的表示方法，即合约运行时行为图（CRBG），以捕捉庞氏合约独有的行为模式。
• 将庞氏检测建模为图分类任务，利用图神经网络（GNNs）提升检测的准确率与可解释性。

提出的方法

• 对智能合约进行静态分析，识别潜在的庞氏逻辑，并生成模拟典型投资行为的合成交易序列。
• 在合约执行过程中使用动态污点分析，结合这些合成交易，收集关于数据流和控制流的详细运行时数据。
• 基于污点分析结果构建合约运行时行为图（CRBG），将程序元素表示为节点，运行时观察到的数据/控制依赖关系表示为边。
• 应用图神经网络（GNNs）学习CRBG的表示，并将其分类为庞氏或非庞氏合约。
• 将检测任务建模为图分类问题，实现从运行时行为模式端到端的学习。
• 使用合约模糊测试调用合约，收集运行时信息，从而实现在真实交易发生前检测0-day庞氏骗局。

Figure 1. Opcode Frequency Distributions. The KL divergence between Ponzi and non-Ponzi contracts ranges from 0.011 to 0.018, while the KL divergence between different Ponzi contracts ranges from 0.012 to 0.016.

实验结果

研究问题

• RQ1 与操作码或交易模式等静态特征相比，运行时行为是否能提供更具判别力的信号以检测庞氏合约？
• RQ2 相较于静态分析，使用动态污点分析和运行时数据在多大程度上提升了检测准确率与可解释性？
• RQ3 基于图的合约执行行为表示（CRBG）能否有效建模庞氏合约的结构特征？
• RQ4 所提出的基于GNN的CRBG分类方法在检测已知及0-day庞氏骗局方面的有效性如何？
• RQ5 该方法是否具备在以太坊主网上实际部署的可扩展性，并能发现此前未被检测到的恶意合约？

主要发现

• PonziGuard在真实数据集上达到96.9%的精确率、98.2%的召回率和97.5%的F1得分，优于现有最先进方法。
• 该方法通过利用运行时行为图实现最高可解释性，提供可解释的检测过程。
• PonziGuard成功识别出以太坊主网上805个庞氏合约，估算造成281,700 Ether（约5亿美元）的经济损失。
• 该方法在新部署的10,000个智能合约中检测到0-day庞氏骗局，证明其可在真实交易发生前识别恶意合约。
• 研究证实，操作码级别的特征在庞氏与非庞氏合约之间无显著差异，验证了动态行为建模的必要性。
• 静态分析工具因过度近似而将如'squareRootPonzi'合约等误判为正例，凸显了基于运行时检测的优势。

Figure 2. Contract Runtime Behaviors. (a) is obtained from the Ponzi contract in Listing 1 , and (b) is obtained from a gambling contract (non-Ponzi contract).