ContractGuard：面向以太坊区块链智能合约的入侵检测系统

赵淦森; 谢智健; 王欣明; 何嘉浩; 张成志; 林成创; ZihengZhou; 陈冰川; ChunmingRong

doi:10.11959/j.issn.2096-109x.2020025

您当前的位置：

首页 >

文章列表页 >

ContractGuard：面向以太坊区块链智能合约的入侵检测系统

专栏：区块链技术 | 更新时间：2024-06-03

- ContractGuard：面向以太坊区块链智能合约的入侵检测系统
- ContractGuard:defend Ethereum smart contract with embedded intrusion detection
- 网络与信息安全学报 2020年6卷第2期页码：35-55
- 作者机构：
  
  1. 华南师范大学计算机学院，广东广州 510000
  2. 广州市云计算安全与测评技术重点实验室，广东广州 510000
  3. 华南师范大学唯链区块链技术与应用联合实验室，广东广州 510000
  4. 拉卡拉集团，北京 100080
  5. 香港科技大学,中国香港 999077
  6. VeChain Foundation Limited,Singapore 238463
  7. 广东财经大学，广东广州 510000
  8. Stavanger University,Norway Stavanger 4036
- 作者简介：
  
  [ "赵淦森（1977- ），男，广东东莞人，华南师范大学教授、博士生导师，主要研究方向为信息安全、区块链" ]
  [ "谢智健（1995- ），男，广东云浮人，华南师范大学硕士生，主要研究方向为软件测试、区块链应用" ]
  [ "王欣明（1980- ），男，香港科技大学博士生，主要研究方向为金融科技、软件测试与软件分析、区块链" ]
  [ "何嘉浩（1995- ），男，广东广州人，华南师范大学硕士生，主要研究方向为软件分析、区块链应用" ]
  [ "张成志（1963- ），男，中国香港人，香港科技大学教授、博士生导师，主要研究方向为软件工程" ]
  [ "林成创（1990- ），男，广东韶关人，华南师范大学博士生，主要研究方向为计算机视觉、医疗人工智能" ]
  [ "Ziheng Zhou（1979- ），男，新加坡人，博士，主要研究方向为区块链、共识算法、计算机视觉和机器学习" ]
  [ "陈冰川（1975- ），男，广东财经大学讲师，主要研究方向为人工智能、推荐系统和软件工程" ]
  [ "Chunming Rong（1969- ），男，挪威人，挪威工程院院士，挪威斯塔万格大学终身教授，主要研究方向为区块链" ]
- 基金信息：
  
  中华人民共和国香港特别行政区政府资金资助项目;HKSAR(RGC/GRF16202917);国家重点研发计划基金资助项目;The National Key R＆D Program of China(2018YFB1404402);广东省重点研发计划基金资助项目;Guangdong Science ＆Technology Fund(2019B010137003);广东省科技计划基金资助项目;Guangzhou Science ＆ Technology Fund(2016B030305006);广东省科技计划基金资助项目;Guangzhou Science ＆ Technology Fund(2018A07071702);广东省科技计划基金资助项目;Guangzhou Science ＆ Technology Fund(201804010314);广东省科技计划基金资助项目;Guangzhou Science ＆ Technology Fund(2012224-12);唯链基金会资金资助项目;VeChain Foundation(SCNU-2018-01);广东省教育厅特色创新项目（自然科学）;Guangdong Provincial Department of Education Characteristic Innovation Project (Natural Science)(2017KTSCX074)
- DOI：10.11959/j.issn.2096-109x.2020025
  中图分类号： TP393
- 网络首发：2020-04，
  
  纸质出版：2020-04-15
- 稿件说明：
移动端阅览
赵淦森, 谢智健, 王欣明, 等. ContractGuard：面向以太坊区块链智能合约的入侵检测系统[J]. 网络与信息安全学报, 2020,6(2):35-55.

Gansen ZHAO, Zhijian XIE, Xinming WANG, et al. ContractGuard:defend Ethereum smart contract with embedded intrusion detection[J]. Chinese Journal of Network and Information Security, 2020, 6(2): 35-55.
赵淦森, 谢智健, 王欣明, 等. ContractGuard：面向以太坊区块链智能合约的入侵检测系统[J]. 网络与信息安全学报, 2020,6(2):35-55. DOI： 10.11959/j.issn.2096-109x.2020025.

Gansen ZHAO, Zhijian XIE, Xinming WANG, et al. ContractGuard:defend Ethereum smart contract with embedded intrusion detection[J]. Chinese Journal of Network and Information Security, 2020, 6(2): 35-55. DOI： 10.11959/j.issn.2096-109x.2020025.

摘要

以太坊智能合约本质上是一种在网络上由相互间没有信任关系的节点共同执行的已被双方认证程序。目前，大量的智能合约被用于管理数字资产，使智能合约成为黑客的重要攻击对象。常见的攻击方法是通过利用智能合约的漏洞来实现特定操作的入侵攻击。ContractGuard 是首次提出面向以太坊区块链智能合约的入侵检测系统，它能检测智能合约的潜在攻击行为。ContractGuard 的入侵检测主要依赖检测潜在攻击可能引发的异常控制流来实现。由于智能合约运行在去中心化的环境以及在高度受限的环境中运行，现有的IDS技术或者工具等以外部拦截形式的部署架构不适合于以太坊智能合约。为了解决这些问题，通过设计一个嵌入式的架构，实现了把 ContractGuard 直接嵌入智能合约的执行代码中，作为智能合约的一部分。在运行时刻，ContractGuard通过相应的context-tagged无环路径来实现入侵检测，从而保护智能合约。由于嵌入了额外的代码，ContractGuard一定程度上会增加智能合约的部署开销与运行开销，为了降低这两方面的开销，基于以太坊智能合约的特性对 ContractGuard 进行优化。实验结果显示，可有效地检测 83%的异常行为，其部署开销仅增加了36.14%，运行开销仅增加了28.17%。

Abstract

Ethereum smart contracts are programs that can be collectively executed by a network of mutually untrusted nodes.Smart contracts handle and transfer assets of values

offering strong incentives for malicious attacks.Intrusion attacks are a popular type of malicious attacks.ContractGuard

the first intrusion detection system (IDS) was proposed to defend Ethereum smart contracts against such attacks.Like IDSs for conventional programs

ContractGuard detects intrusion attempts as abnormal control flow.However

existing IDS techniques or tools are inapplicable to Ethereum smart contracts due to Ethereum’s decentralized nature and its highly restrictive execution environment.To address these issues

ContractGuard was designed by embedding it in the contracts.At runtime

ContractGuard protects the smart contract by monitoring the context-tagged acyclic path of the smart contract.As ContractGuard involves deployment overhead and deployment overhead.It was optimized under the Ethereum Gas-oriented performance model to reduce the overheads.The experimental results show that this work can effectively detect 83% of vulnerabilities

ContractGuard only adds to 36.14% of the deployment overhead and 28.27% of the runtime overhead.

关键词

Keywords

references

NAKAMOTO S . Bitcoin:a peer-to-peer electronic cash system [EB ] .

BUTERIN V . A next-generation smart contract and decentralized application platform [J ] .

ATZEI N , BARTOLETTI M , CIMOLI T . A survey of attacks on Ethereum smart contracts (SoK) [C ] // International Conference on Principles of Security and Trust . 2017 : 164 - 186 .

KRUPP J , ROSSOW C . Teether:gnawing at Ethereum to automatically exploit smart contracts [C ] // 27th USENIX Security Symposium (USENIX Security 18) . 2018 : 1317 - 1333 .

CHEN T , LI X , LUO X , ZHANG X . Under-optimized smart contracts devour your money [C ] // Software Analysis,Evolution and Reengineering (SANER) . 2017 : 442 - 446 .

KALRA S , GOEL S , DHAWAN M , et al . ZEUS:analyzing safety of smart contracts [C ] // NDSS . 2018 .

BRENT L . Vandal:a scalable security analysis framework for smart contracts [J ] . arXiv preprint arXiv:1809.03981 , 2018

ZAKRZEWSKI J , . Towards verification of Ethereum smart contracts:a formalization of core of solidity [C ] // Working Confer-ence on Verified Software:Theories,Tools,and Experiments . 2018 : 229 - 247 .

NIKOLIĆ I , KOLLURI A , SERGEY I , et al . Finding the greedy,prodigal,and suicidal contracts at scale [C ] // The 34th Annual Computer Security Applications Conference . 2018 : 653 - 663 .

GRECH N , KONG M , JURISEVIC A , et al . MadMax:surviving out-of-gas conditions in Ethereum smart contracts [J ] . Proceedings of the ACM on Programming Languages , 2018 , 2 : 1 - 27 .

JIANG B , LIU Y , CHAN W K . Contract fuzzer:fuzzing smart contracts for vulnerability detection [C ] // 33rd ACM/IEEE International Conference on Automated Soft-ware Engineering . 2018 : 259 - 269

LIAO H J , LIN C H R , LIN Y C , et al . Intrusion detection system:a comprehensive review [J ] . Journal of Network and Computer Applications , 2013 ( 36 ): 16 - 24 .

Understanding the DAO attack [EB ] .

Parity multisig hacked again [EB ] .

ZHANG T , ZHUANG X , PANDE S , et al . Anomalous path detection with hardware support [C ] // The 2005 International Conference on Compilers,Architectures and Synthesis for Embedded Systems . 2005 : 43 - 54 .

FENG H H , KOLESNIKOV O M , FOGLA P , et al . Anomaly detection using call stack information [C ] // 2003 Symposium on Security and Privacy . 2003 : 62 - 75 .

GARFINKEL T , ROSENBLUM M . A virtual machine introspection based architecture for intrusion detection [C ] // NDSS . 2003 : 191 - 206 .

WOOD G . Ethereum yellow paper [EB ] .

GIFFIN J T , JHA S , MILLER B P . Efficient context-sensitive intrusion detection [C ] // NDSS . 2004 .

XU H , DU W , CHAPIN S J . Context sensitive anomaly monitoring of process control flow to detect mimicry attacks and impossible paths [C ] // International Workshop on Recent Advances in Intrusion Detection . 2004 : 21 - 38 .

BALL T , LARUS J R . Efficient path profiling [C ] // 29th Annual ACM/IEEE International Symposium on Microarchitecture , 1996 : 46 - 57 .

BELAZZOUGUID , BOTELHO F C , DIETZFELBINGER M . Hash,displace,and compress [C ] // European Symposium on Algorithms . 2009 : 682 - 693 .

LUU L , CHU D H , OLICKEL H , et al . Making smart contracts smarter [C ] // 2016 ACM SIGSAC Conference on Computer and Communications Security . 2016 : 254 - 269 .

GROSSMAN S , . Online detection of effectively callback free objects with applications to smart contracts [C ] // ACM on Programming Languages , 2017 ( 2 ):48.

GRISHCHENKO I , MAFFEI M , SCHNEIDEWIND C . a semantic framework for the security analysis of Ethereum smart contracts [C ] // International Conference on Principles of Security and Trust , 2018 : 243 - 269 .

LARUS J R , . Whole program paths [C ] // ACM SIGPLAN 1999 Conference on Programming Language Design and Implementation (PLDI) . 1999 , 34 : 259 - 269 .

MELSKI D , REPS T . Interprocedural path profiling [C ] // International Conference on Compiler Construction . 1999 : 47 - 62 .

D’ELIA D C , DEMETRESCU C . Ball-larus path profiling across multiple loop iterations [J ] . ACM Sigplan Notices , 2013 , 48 : 373 - 390 .

SUMNER W N , ZHENG Y , WEERATUNGE D , et al . Precise calling context encoding [J ] . IEEE Transactions on Software Engineering , 2012 , 38 ( 5 ): 1160 - 1177 .

AMMONS G , LARUS J R . Improving dataflow analysis with path profiles [J ] . ACM SIGPLAN Notices , 1998 , 33 : 72 - 84 .

ERNST M D , COCKRELL J , GRISWOLD W G , et al . Dynamically discovering likely program invariants to support program evolution [J ] . IEEE Transactions on Software Engineering , 2001 , 27 ( 2 ): 99 - 123 .

KUMAR V , SANGWAN O P . Signature based intrusion detection system using SNORT [J ] . International Journal of Computer Applications ＆ Information Technology , 2012 , 1 ( 3 ): 35 - 41 .

CUI W , PEINADO M , WANG H J , et al . Shieldgen:automatic data patch generation for unknown vulnerabilities with informed probing [C ] // 2007 IEEE Symposium on Security and Privacy (SP’07) . 2007 : 252 - 266 .

DANNEN C . Introducing Ethereum and solidity [M ] . Berlin : SpringerPress , 2017 .

ZHUANG X , SERRANO M J , CAIN H W , et al . Accurate,efficient,and adaptive calling context profiling [J ] . ACM Sigplan Notices , 2006 ( 41 ): 263 - 271 .

LI X , JIANG P , CHEN T , et al . A survey on the security of blockchain systems [C ] // Future Generation Computer Systems . 2017 .

MANNING D A . Solidity security:comprehensive list of known attack vectors and common antipatterns [J ] .

DERIVATIVES D N | T . A survey of solidity security vulnerability [EB ] .

BEC spiked 4000% on first trading day,another pump-and-dump scheme [EB ] .

WANG X , CHEUNG S C , CHAN W K , et al . Taming coincidental correctness:coverage refinement with context patterns [C ] // ICSE . 2009 : 45 - 55 .

Truffle Suite.Sweet Contracts [EB ] .

BALL T , LARUS J R . Optimally profiling and tracing programs [J ] . ACM Transactions on Programming Languages and Systems (TOPLAS) , 1994 , 16 ( 4 ): 1319 - 1360 .

TJHAI G C , PAPADAKI M , FURNELL S M , et al . Clarke,investigating the problem of IDS false alarms:an experimental study using snort [C ] // IFIP International Information Security Conference . 2008 : 253 - 267 .

Understanding the DAO attack [EB ] .

An in-depth look at the parity multisig bug [EB ] .

Post-mortem [EB ] .

Detecting integer arithmetic bugs in Ethereum smart contracts [EB ] .

Smart contract wallets created in frontier are vulnerable to phishing attacks [EB ] .

MerdeToken [EB ] .

CryptoKitty [EB ] .

StatusNetwork [EB ] .

DecentralizedVoting [EB ] .

PoolShark [EB ] .

Etherscan [EB ] .

SafeMath OpenZeppelin [EB ] .

浏览量

1513

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于SM2数字签名算法的环适配器签名方案

DNS异常检测：大规模实验分析

去中心化公钥基础设施综述

基于SM3的变色龙哈希函数及其应用

ADS-B安全研究综述