ContractGuard:defend Ethereum smart contract with embedded intrusion detection

Gansen ZHAO; Zhijian XIE; Xinming WANG; Jiahao HE; Chengzhi ZHANG; Chengchuang LIN; ZHOU Ziheng; Bingchuan CHEN; RONG Chunming

doi:10.11959/j.issn.2096-109x.2020025

您当前的位置：

首页 >

文章列表页 >

ContractGuard:defend Ethereum smart contract with embedded intrusion detection

Special Column:Blockchain Technology | 更新时间：2024-06-03

- ContractGuard:defend Ethereum smart contract with embedded intrusion detection
- Chinese Journal of Network and Information Security Vol. 6, Issue 2, Pages: 35-55(2020)
- 作者机构：
  
  1. 华南师范大学计算机学院，广东广州 510000
  2. 广州市云计算安全与测评技术重点实验室，广东广州 510000
  3. 华南师范大学唯链区块链技术与应用联合实验室，广东广州 510000
  4. 拉卡拉集团，北京 100080
  5. 香港科技大学,中国香港 999077
  6. VeChain Foundation Limited,Singapore 238463
  7. 广东财经大学，广东广州 510000
  8. Stavanger University,Norway Stavanger 4036
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020025
  CLC： TP393
- Online First：2020-04，
  
  Published：15 April 2020
- 稿件说明：
移动端阅览
Gansen ZHAO, Zhijian XIE, Xinming WANG, et al. ContractGuard:defend Ethereum smart contract with embedded intrusion detection[J]. Chinese Journal of Network and Information Security, 2020, 6(2): 35-55.
DOI：

Gansen ZHAO, Zhijian XIE, Xinming WANG, et al. ContractGuard:defend Ethereum smart contract with embedded intrusion detection[J]. Chinese Journal of Network and Information Security, 2020, 6(2): 35-55. DOI： 10.11959/j.issn.2096-109x.2020025.

摘要

以太坊智能合约本质上是一种在网络上由相互间没有信任关系的节点共同执行的已被双方认证程序。目前，大量的智能合约被用于管理数字资产，使智能合约成为黑客的重要攻击对象。常见的攻击方法是通过利用智能合约的漏洞来实现特定操作的入侵攻击。ContractGuard 是首次提出面向以太坊区块链智能合约的入侵检测系统，它能检测智能合约的潜在攻击行为。ContractGuard 的入侵检测主要依赖检测潜在攻击可能引发的异常控制流来实现。由于智能合约运行在去中心化的环境以及在高度受限的环境中运行，现有的IDS技术或者工具等以外部拦截形式的部署架构不适合于以太坊智能合约。为了解决这些问题，通过设计一个嵌入式的架构，实现了把 ContractGuard 直接嵌入智能合约的执行代码中，作为智能合约的一部分。在运行时刻，ContractGuard通过相应的context-tagged无环路径来实现入侵检测，从而保护智能合约。由于嵌入了额外的代码，ContractGuard一定程度上会增加智能合约的部署开销与运行开销，为了降低这两方面的开销，基于以太坊智能合约的特性对 ContractGuard 进行优化。实验结果显示，可有效地检测 83%的异常行为，其部署开销仅增加了36.14%，运行开销仅增加了28.17%。

Abstract

Ethereum smart contracts are programs that can be collectively executed by a network of mutually untrusted nodes.Smart contracts handle and transfer assets of values

offering strong incentives for malicious attacks.Intrusion attacks are a popular type of malicious attacks.ContractGuard

the first intrusion detection system (IDS) was proposed to defend Ethereum smart contracts against such attacks.Like IDSs for conventional programs

ContractGuard detects intrusion attempts as abnormal control flow.However

existing IDS techniques or tools are inapplicable to Ethereum smart contracts due to Ethereum’s decentralized nature and its highly restrictive execution environment.To address these issues

ContractGuard was designed by embedding it in the contracts.At runtime

ContractGuard protects the smart contract by monitoring the context-tagged acyclic path of the smart contract.As ContractGuard involves deployment overhead and deployment overhead.It was optimized under the Ethereum Gas-oriented performance model to reduce the overheads.The experimental results show that this work can effectively detect 83% of vulnerabilities

ContractGuard only adds to 36.14% of the deployment overhead and 28.27% of the runtime overhead.

关键词

Keywords

references

NAKAMOTO S . Bitcoin:a peer-to-peer electronic cash system [EB ] .

BUTERIN V . A next-generation smart contract and decentralized application platform [J ] .

ATZEI N , BARTOLETTI M , CIMOLI T . A survey of attacks on Ethereum smart contracts (SoK) [C ] // International Conference on Principles of Security and Trust . 2017 : 164 - 186 .

KRUPP J , ROSSOW C . Teether:gnawing at Ethereum to automatically exploit smart contracts [C ] // 27th USENIX Security Symposium (USENIX Security 18) . 2018 : 1317 - 1333 .

CHEN T , LI X , LUO X , ZHANG X . Under-optimized smart contracts devour your money [C ] // Software Analysis,Evolution and Reengineering (SANER) . 2017 : 442 - 446 .

KALRA S , GOEL S , DHAWAN M , et al . ZEUS:analyzing safety of smart contracts [C ] // NDSS . 2018 .

BRENT L . Vandal:a scalable security analysis framework for smart contracts [J ] . arXiv preprint arXiv:1809.03981 , 2018

ZAKRZEWSKI J , . Towards verification of Ethereum smart contracts:a formalization of core of solidity [C ] // Working Confer-ence on Verified Software:Theories,Tools,and Experiments . 2018 : 229 - 247 .

NIKOLIĆ I , KOLLURI A , SERGEY I , et al . Finding the greedy,prodigal,and suicidal contracts at scale [C ] // The 34th Annual Computer Security Applications Conference . 2018 : 653 - 663 .

GRECH N , KONG M , JURISEVIC A , et al . MadMax:surviving out-of-gas conditions in Ethereum smart contracts [J ] . Proceedings of the ACM on Programming Languages , 2018 , 2 : 1 - 27 .

JIANG B , LIU Y , CHAN W K . Contract fuzzer:fuzzing smart contracts for vulnerability detection [C ] // 33rd ACM/IEEE International Conference on Automated Soft-ware Engineering . 2018 : 259 - 269

LIAO H J , LIN C H R , LIN Y C , et al . Intrusion detection system:a comprehensive review [J ] . Journal of Network and Computer Applications , 2013 ( 36 ): 16 - 24 .

Understanding the DAO attack [EB ] .

Parity multisig hacked again [EB ] .

ZHANG T , ZHUANG X , PANDE S , et al . Anomalous path detection with hardware support [C ] // The 2005 International Conference on Compilers,Architectures and Synthesis for Embedded Systems . 2005 : 43 - 54 .

FENG H H , KOLESNIKOV O M , FOGLA P , et al . Anomaly detection using call stack information [C ] // 2003 Symposium on Security and Privacy . 2003 : 62 - 75 .

GARFINKEL T , ROSENBLUM M . A virtual machine introspection based architecture for intrusion detection [C ] // NDSS . 2003 : 191 - 206 .

WOOD G . Ethereum yellow paper [EB ] .

GIFFIN J T , JHA S , MILLER B P . Efficient context-sensitive intrusion detection [C ] // NDSS . 2004 .

XU H , DU W , CHAPIN S J . Context sensitive anomaly monitoring of process control flow to detect mimicry attacks and impossible paths [C ] // International Workshop on Recent Advances in Intrusion Detection . 2004 : 21 - 38 .

BALL T , LARUS J R . Efficient path profiling [C ] // 29th Annual ACM/IEEE International Symposium on Microarchitecture , 1996 : 46 - 57 .

BELAZZOUGUID , BOTELHO F C , DIETZFELBINGER M . Hash,displace,and compress [C ] // European Symposium on Algorithms . 2009 : 682 - 693 .

LUU L , CHU D H , OLICKEL H , et al . Making smart contracts smarter [C ] // 2016 ACM SIGSAC Conference on Computer and Communications Security . 2016 : 254 - 269 .

GROSSMAN S , . Online detection of effectively callback free objects with applications to smart contracts [C ] // ACM on Programming Languages , 2017 ( 2 ):48.

GRISHCHENKO I , MAFFEI M , SCHNEIDEWIND C . a semantic framework for the security analysis of Ethereum smart contracts [C ] // International Conference on Principles of Security and Trust , 2018 : 243 - 269 .

LARUS J R , . Whole program paths [C ] // ACM SIGPLAN 1999 Conference on Programming Language Design and Implementation (PLDI) . 1999 , 34 : 259 - 269 .

MELSKI D , REPS T . Interprocedural path profiling [C ] // International Conference on Compiler Construction . 1999 : 47 - 62 .

D’ELIA D C , DEMETRESCU C . Ball-larus path profiling across multiple loop iterations [J ] . ACM Sigplan Notices , 2013 , 48 : 373 - 390 .

SUMNER W N , ZHENG Y , WEERATUNGE D , et al . Precise calling context encoding [J ] . IEEE Transactions on Software Engineering , 2012 , 38 ( 5 ): 1160 - 1177 .

AMMONS G , LARUS J R . Improving dataflow analysis with path profiles [J ] . ACM SIGPLAN Notices , 1998 , 33 : 72 - 84 .

ERNST M D , COCKRELL J , GRISWOLD W G , et al . Dynamically discovering likely program invariants to support program evolution [J ] . IEEE Transactions on Software Engineering , 2001 , 27 ( 2 ): 99 - 123 .

KUMAR V , SANGWAN O P . Signature based intrusion detection system using SNORT [J ] . International Journal of Computer Applications ＆ Information Technology , 2012 , 1 ( 3 ): 35 - 41 .

CUI W , PEINADO M , WANG H J , et al . Shieldgen:automatic data patch generation for unknown vulnerabilities with informed probing [C ] // 2007 IEEE Symposium on Security and Privacy (SP’07) . 2007 : 252 - 266 .

DANNEN C . Introducing Ethereum and solidity [M ] . Berlin : SpringerPress , 2017 .

ZHUANG X , SERRANO M J , CAIN H W , et al . Accurate,efficient,and adaptive calling context profiling [J ] . ACM Sigplan Notices , 2006 ( 41 ): 263 - 271 .

LI X , JIANG P , CHEN T , et al . A survey on the security of blockchain systems [C ] // Future Generation Computer Systems . 2017 .

MANNING D A . Solidity security:comprehensive list of known attack vectors and common antipatterns [J ] .

DERIVATIVES D N | T . A survey of solidity security vulnerability [EB ] .

BEC spiked 4000% on first trading day,another pump-and-dump scheme [EB ] .

WANG X , CHEUNG S C , CHAN W K , et al . Taming coincidental correctness:coverage refinement with context patterns [C ] // ICSE . 2009 : 45 - 55 .

Truffle Suite.Sweet Contracts [EB ] .

BALL T , LARUS J R . Optimally profiling and tracing programs [J ] . ACM Transactions on Programming Languages and Systems (TOPLAS) , 1994 , 16 ( 4 ): 1319 - 1360 .

TJHAI G C , PAPADAKI M , FURNELL S M , et al . Clarke,investigating the problem of IDS false alarms:an experimental study using snort [C ] // IFIP International Information Security Conference . 2008 : 253 - 267 .

Understanding the DAO attack [EB ] .

An in-depth look at the parity multisig bug [EB ] .

Post-mortem [EB ] .

Detecting integer arithmetic bugs in Ethereum smart contracts [EB ] .

Smart contract wallets created in frontier are vulnerable to phishing attacks [EB ] .

MerdeToken [EB ] .

CryptoKitty [EB ] .

StatusNetwork [EB ] .

DecentralizedVoting [EB ] .

PoolShark [EB ] .

Etherscan [EB ] .

SafeMath OpenZeppelin [EB ] .

Views

1513

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Ring adaptor signature scheme based on SM2 digital signature algorithm

Anomaly detection in DNS: an empirical study

Survey of decentralized public key infrastructure

Chameleon hash function based on SM3 and its applications

Review of ADS-B security research

Related Author

Xu Xinyue

Xu Shujiang

Wang Lianhai

Zhang Shuhui

Shao Wei

Wang Qizheng

HOU Ronghao

HE Ming

Related Institution

Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science

Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences)

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Shield Lab, Trustworthiness Lab, Huawei Technologies Co., Ltd.

⁰