Real-time Hack Detection & Prevention
DeFi Security Summit 2023 · 15 Jul 2023 · 3:40
Liyi Zhou, co-founder of D23E, presents three research papers on real-time defence for DeFi. The first detects attack transactions in the mempool, copies the adversary's contract and front-runs the attacker so the profit can be returned to the project. The second trains a large language model on past transactions to flag abnormal ones, and the third tests whether GPT-4 and Claude can find vulnerabilities in 52 DeFi attacks. Both models identify about 40 percent of them, with high false positive rates.
Speakers
Topics
From DeFi Security Summit 2023, hosted by DeFi Security Summit.
Transcript
okay our next speaker easily and he's going to talk about defy Arc detection and prevention thank you so we are a bit late already I will go really fast um so I'm a co-founder from d23e and we are working on um different aspects of the security life cycle so typically there are three um three very important cycles for any attacks so there's the before launch we do kind of auditing and we also use automated tools to find the vulnerabilities for more verification
fasting Etc we also have afternoon security so we have like vulnerability search intrusion detection prevention Etc and also after incident right we have a circuit breaker Etc so the core members of d23 has worked in the entire cycle of D5 security and we have quite a lot of Publications here so I would like to share three Publications we have done this year with collaborated with other word leading researchers the first one is the blockchain invitation game um in essence we detect attack transactions in Memphis
and we copy the diversary contract to create our imitation contracts and we also generate an imitation transaction and then we front around the attacker and steal the the profits they were earned and then we will return the profit to the D5 projects that's the first paper so for technical details you can check out the link on the top the second paper is blockchain large number model so in essence we build a large language model trained on previous transactions for D5 protocols to learn what's the normal behavior for transactions then once there's a abnormal transaction enters the system we will try to rank
the transactions and if it passes a certain announce threshold we will issue an alarm and this will trigger potential defenses such as emergency posts just the second paper and the result is 49 out of the 124 attacks among the top three most available are among the top three most transactions for past attacks the third paper I want to share is this do you still need a manual smart contract audit the answer is yes for sure but what we actually did in the paper is we have this data set with 52 D5 attacks with the source code and the actual vulnerability and we also have a volume list from one
of our previous papers listing all the water abilities we have in in D5 and then we do some prompt engineering ask large number models if there is an attack in the smart contract a lot or not the answer is yes or no with some detailed specification of the vulnerability and then we compare the answer given by large luxury models with the actual vulnerability and we found out that both trip D4 and Cloud can correctly identify 40 of the vulnerabilities but the downside is it's having a very high false positive rate so that's it thank you
[Applause]