How AI Based Threat Detection Can Save Web3 | Andrew Beal - Forta

okay we good yeah okay all right well thanks everybody for coming uh my name is Andy I lead the ecosystem team at uh Florida Network and I'm going to talk about uh how Ai and uh based threat detection uh can save web 3 so this is a security smart contract security related uh talk little bit about fora if you're not familiar fora is a um decentralized monitoring Network for layer one and layer 2 blockchains so the analogy I like to use is we're like a giant security camera and alarm system uh we're middleware so we sit on top of these These Chains and we've got hundreds of cameras running on the network that that are watching for stuff that looks weird suspicious exploits fishing attacks things like that we spun out of open Zeppelin uh in Fall of 2021 so we've been around for about two and a half years and over that time have worked with um some prominent companies in the space around threat detection um we generate a lot of data and we provide it to a lot of companies uh as well okay so quick agenda I'm going to talk about detecting exploits in advance how we do that at Florida I'm also going to talk about how we use machine learning to identify malicious smart contracts and I'll finish by talking about why we should start shifting our Focus from threat detection to threat prevention it's great to detect the exploit uh but it's even better if you can detect it and stop it okay so threat detection what does that mean to me for the for the purpose of this conversation it's identifying malicious actors and transactions in real time so again you know we're we're like a security camera that's watching everything happening and we want to flag all the bad stuff so little context when we started in November 2021 there was Zero threat detection happening um a lot of that had to do with the fact that the industry was you know three and a half years more immature back then um but a lot of it had to do with the fact too that I think from a security standpoint most people were very focused on code and predeployment security there was very little attention if any paid to post- deployment security Beyond a bug Bounty program um and virtually zero you know zero um part of the security budget was spent on on on on that as well so fast forward 2 and a half years uh till now there's a lot more threat detection happening there are a dozen plus companies that do this really well today including fora um there are a lot more tools that are available to defi protocols that make this easier and there's a ton of threat intelligence that's generated in real time that we can all use uh to protect ourselves so how do we detect exploits uh little mental model I want you guys to walk away with so most attacks follow these four stages and I'll walk through them and kind of uh explain the flow here so first is funding so an attacker when they're attacking a protocol they need some Capital to do that at a minimum to pay for gas fees um they don't want to pull that out of their binance account for example or their metamask wallet so they're usually going to avisc the source of those funds through a privacy preserving protocol like tornado cash um then they're going to use those funds to deploy a new contract we call this the attacker contract this is the preparation stage of an attack at some point after they deploy the contract they'll invoke that it can happen in subsequent blocks it can happen in the current block um but that's the that's what we would consider the attack transaction and then if the attack's successful and they've success they they have stolen funds they will then like Rel launder those back through privacy protocols dexes Etc at a minimum you want to get out of assets that have like a Black List like a usdc or something like that right um so this is the flow that the vast majority of smart contract exploits follow uh and I wanted to share this because we're wanted to show you there's a lot of things that happen before the exploit transaction and these are all the signals that we're looking for when we're trying to detect exploits in advance so the goal for us is to detect things with high confidence in the preparation stage of an attack so right after that malicious smart contract's been deployed we want to flag it and we want to notify as many people as we can about it um we do a couple different things to those contracts we'll do static analysis on it which I'm going to talk a lot more about that's where the machine learning comes in we also do Dynamic analysis so we will fuzz the contract we'll simulate it we'll throw a bunch of parameters at it to see what happens so let's talk a little bit more about the static analysis piece so we train a model to try and tell the difference between a contract that's malicious and a contract that's benign obviously if you have you know Decades of data at your disposal your model is going to be really good we don't have that um you know we've got about four or five years of malicious smart contracts at our disposal um so we've got 700 sort of confirmed militia smart contracts that we can train models with we've got a heck of a lot more good benign contracts that we can use uh to differentiate so that's so that's helpful uh I point this out just because as more contracts get deployed the data set gets larger models get better at learning Etc so um machine learning will keep getting more more precise over time as it has more data um so what happens here um the model will essentially go in and it will extract the bite code plus the inputs from the contract convert them into op codes and then start analyzing patterns and we want to analyze patterns from known malicious contracts with patterns from known benign cont contracts um just to give you a sense of what some of the common op code patterns are um this is in a blog post on the fora website too if you want to kind of read the more context around this um but on the left are the top 10 most common op codes uh in malicious smart contracts so you'll see at the top it's like push 20 Push 20 and push Etc on the right are the top 10 most uncommon op codes so so you're going to see a lot more of in uh you know benign non-malicious contracts so we've got you know 700 examples of stuff on the left we've got hundreds of thousands of examples of stuff on the right and you train a model with this and then you release it into the wild and you let it predict uh you let it predict whether the the newest contract that gets deployed on chain is is good or bad so in practice okay I just walked through this I front run myself here um I'm going to skip this one okay so the benefits of using ml as opposed to simple heuristics so we do use a lot of heuristics which are kind of more rigid Like hard-coded rules um but ml's ml's great because it can come up with those characteristics for you so the objective is to identify patterns um if you had a really small amount of data which wouldn't be great for ML to begin with you in theory could do this manually um but when you have hundreds of thousands of contracts that you're trying to look at letting a machine analyze those patterns for you is just much more uh much more efficient it's also going to be able to recognize patterns that you know we might not be able to identify ourselves so uh up until now everything I've described we would call negative reputation-based uh monitoring so we're looking for things that are that we know are bad malicious there's another form of monitoring that uh is also very effective and that is is sort of emerging in web 3 and it's called anomaly detection and an anomaly is just something that looks weird or is different than what's normal so in the context of a a defi uh protocol you would want to figure out what your normal user Behavior looks like and kind of create a profile around that and then use that sort of normal behavior profile to then screen that against incoming transactions to see if you see anything that doesn't look like that if it doesn't look normal you label that as uh anomalous a lot of exploits using this approach would be lab as anomalous and so um this is another you know sort of complimentary approach that you can use to detect uh exploits and other other sort of threats in advance um show of hands how many people are surprised by this so today most smart contract exploits are detected in advance does that surprise anybody yeah um there are a lot of teams out there monitoring for this stuff today um you can monitor mempool transactions you can monitor processed transactions you can use negative reputation based approaches you can use anomaly based approaches um but there's a ton of people watching and analyzing smart contracts and transactions and most exploits are detected in advance um now that does not mean that they are just because they're detected doesn't mean that they're that they're prevented um and and I think D5 protocols today given all the threat intelligence that's now available and there's just going to there's just going to be more and more available to you so we're you know detection is going to keep getting better and better faster more precise def5 protocols need to ask themselves now if I know that a transaction or an EA or an address is bad in advance what what do I want to do about it do I want to accept that this is not a this is not a question that I think any smart contract developer has been forced to ask themselves previously because we just didn't have the data but now that we do I think this is a a prudent thing to consider um what we're focused on for the last two and a half years has been detection there is a ton of this happening now we're shifting our Focus to prevention so we got all this great data now how do we stop these attacks um and something that we're really interested in right now uh and I just kind of want to PL a seed with the audience here is uh transaction screening so now that we know have some sense of what's good and what's bad in theory you can stop bad stuff and let good stuff come through whereas previously 100% of stuff was coming in whether it was you know whether you knew about it or not whether it was good or bad um you can do transaction screening at the Smart contract level you can also do it lower in the tech stack um and leverage Builders and relays and sequencers to do it there and just tell them you know what logic you want them to follow um there are experiments happening at at at both levels I'm really optimistic about about both it obviously brings up some questions around censorship uh but I think those are you know it's a it's a a welcom conversation to have and I think there there's a path forward um so I just wanted to plant that seed I think over the next year or two we're going to see a lot more uh experiments with transaction screening simply because we have so much data now that it's you know it's it's uh it's prudent to at least start testing out uh that approach to see if you can stop exploit that way so I'll stick around for a few minutes if anybody wants to chat about you know ml based threat detection or transaction screening happy to chat thank [Applause] you