Mastering Web3 Security Using AI | Tamaghna Basu - DeTaSECURE

[Music] can start okay cool yeah so hi everybody uh good morning good afternoon um so it's been a little delayed because I just uh arrived a couple of hours back so it took a while to come come here but yeah I think uh this talk is mostly about uh uh web security and uh and AI how um you can actually use both of this together and uh how this can help you to uh become like a much better in terms of security so um why we're talking about this obviously we understand security is growing um the problem is actually increasing on a day by day um and uh it's not only a single so let's take a step back from Web Two versus web 3 we're talking about Industries like every industry has has problems uh in terms of security uh data Bridges happening money is getting stolen across the industry so uh doesn't matter whether you're building uh Healthcare product or uh defi product or probably something else uh you the threats are real right and um when you look into geography obviously we see this region obviously has higher and then obviously other region also has so there are a lot of growth in terms of geography uh in terms of domain specific Target and uh if you talk about especially the space we are in web3 space uh we seeing we've seen billions of dollar growth in terms of money get stolen uh and when I say this attack this attack is mixed of fraud scams technical attack non-technical fishing social engineering everything so overall this actually has lot of uh lot of issues uh and definitely uh we have we know that there's audit there is compliance and all this there but then still that's not solving the problem so what is the next step we can do how we can uh create various kind of um various kind of tools for which kind of we can use for our own benefit so uh a little bit about myself my name is tamagna BAS I'm the founder and CEO of data secq we are a cyber security company uh earlier I built a web to cyber security company financial fraud detection in the banks and all this stuff and now we are more focusing on web3 industry so essentially what uh as a company we build and that's kind of the background of how we ventured into uh web three security and what uh how we envision uh the the kind of future road map about the security aspect um so what we see is when you talk about security is a very generic word u and primarily we see there are two part of it one part is audit and other part is monitoring the fraud uh monitoring transaction monitoring aspects right and now these two are hand being handled into different has a two different problem statement but think from a project sponsor if you are building a product uh if you are actually a person founder of a new protocol You're Building um all you care about is your product secured or not at the end of the day all you care about whether uh you need to look you have done enough to actually protect your data protect your users and their data their value their money and their uh kind of you know whatever they have invested so we see that security is a journey it's not a for single problem statement from the beginning to end so before launch you need different kind of security like audit uh uh all this kind of vulnerability detction but post launch you need different kind of security which is fraud monitoring and so with this Vision we have built this product and again all these modules we have built at open source we have actually kind of published it in the public where people can use it on their own and uh and as part of that obviously we partnered with a lot of Foundations and we kind of try to build it as as partner solution along with different kind of you know protocols and not and U let me walk you through my journey uh how we got into this space so the first product we have built something called behavioral Biometrics or behavioral analytics so what is that mean is this is my encounter with AI and let's say how I fell in love with AI I'm a Tey obviously I'm a developer Builder um now 10 years back when I started my first company we wanted to solve the financial fraud problem for the convention world and uh there is already a lot of rule based architecture built and that is exactly what is happening in web3 world today if you talk about chain analysis and other various kind of uh platform which is used they do transaction monitoring and the first stpe of transaction monitoring is define various kind of rules right U let's say blacklisted sanction wallets you know are you doing transaction with some suspicious kind of entities or not uh look into the volume of transactions rug pull detection wh alert is all about various pattern of detection ction right is this going through the normal pattern and do we see a spikes in terms of transactions it could be a frequency of transaction it could be a volume of transaction etc etc so those rule-based architecture is already been in place uh it is solving the problem but still we see a lot of challenges lot of frauds are happening so we looked into that okay what is the gap there and how we can solve that problem so essentially what it realize that and eventually it come down to Identity majorly one is obviously you you are actually having a kind of entity which is by nature suspicious if you're a hacker or probably someone with a wrong intentions obviously you will steal money uh that is there however the lot of incidents happen where the identities get compromised your identity gets compromised your wallet gets compromised money gets stolen from there uh whatever is the reason it could be fishing attack social engineering attack or maybe um man in the middle as someone snift your private key or something like that so we kind of took that as a challenge and first level we say how we can protect identity with different other factors it's not about no longer password it's no longer about multiactor authentication how we can do it so the first stage we did is we kind of looked into something called behavioral analytics now anybody heard about this term behavioral analytics okay um so what essentially it does it has various aspects so we kind of started with a very ambitious initi uh initiative um can someone guess which movie is this anybody it's from one of the Mission Impossible movie it talks about the walking pattern analysis or gate analysis so the person walks through the Vault it analyzes the The Walking pattern of the person and sees is this the same person or not so this is called gate analysis so there are different kind of AI model you can build around gate analysis based on template you know machine learning and which can actually identify you as a unique individual based on your walking pattern because what it say is that your walking pattern is unique um this is also been built as a computer vision problem uh people have created a lot of analytics on computer vision which captures through camera your working pattern and does it but what essentially we have built we have built a model which actually sits on your mobile it can be integrated to your mobile applications of uh which actually sits on your mobile and it captures the sensor data gyroscope accelerometer data when you're walking and based on that walking pattern it can identify that is it is it unique person same person or not so we kind of created various kind of model around that and idea was this can be a very simple SDK Library which you can integrate to any kind of wallets any kind of uh uh mobile app where you wanted to protect your identity so tomorrow hypothetically let's say if this model is integrated to your wallets and um again you know you the idea was even if your private key is compromised someone actually stolen and you actually I import it to my wallet but then the because my working pattern is different versus ver you walking pattern is different we can go ahead and predict that uh is this uh this is not the same person who is using now there is lot of race conditions lot of U kind of you know uh boundary Edge conditions are there what if I'm drunk what if I'm injured you know what is what if I'm kind of uh running suddenly you know my pattern changes for whatever is the reason um what if over the age pattern changes right aging is also a factor right your uh um mental health is also a factor are you tensed are you relaxed like that and the forget about all this the biggest problem is mobiles orientation the orientation of a mobile in your pocket so there's a lot of things are there so although we get like 98 97% uh sorry 93 to 94% accuracy we realize that this is not a scalable solution because if as a startup as a small company we want to address all this problem this cannot be solved but the good part of this solution is the data stays in a mobile so it's basically the privacy is preserved so that is one of the core fundamental of what you're building right now we move to the next kind of Behavioral aspects we say you know what there's a simpler aspect also is there called keystroke Dynamics your typing pattern how you type uh that's also unique um so this looks like a quite stable model we build it we have kind of started with a web2 world where we have kind of mobile banking internet banking kind of solution we've integrated and web3 World also we are kind of offering this to a lot of wallet companies to do that however the idea is this a very very well uh researched algorithm the models has been open source it's been published a lot of white papers are there if you want to kind of build it you can actually build a model around that and that is very easy you can now integrate to if you're building a wallet or any kind of mobile app integrate that with you to protect their user identities now again I'm not saying this is going to give you 100% security but this can give you on one extra layer of analytics which can help you to protect maybe 80% of the current spectrum of ATT attack which is happening there so this is like how you protect identity on that now the other reason is gestures gestures is another very interesting factor which we didn't realize when we actually are doing this research but we realize that even on gesture like how I swipe how I probably kind of swipe up swipe down uh and holding pattern I am holding the phone in two hands versus I am a person who hold the phone in a one hand there are different kind of this kind of we call it like uh like a metadata or like a additional factors we kind of identified and realize that is also can be used for uh this kind of identity protections so essentially this is called the behavioral analis aspect where you can create lot of keystroke Dynamics and gesture based analytics which help you to give you a lot of protection on your identity level on your uh end user wallet or applications so so with this obviously we have built kind of a scoring algorithm but however as I said these are all kind of happy to share all the data what we have you know if any of of you are interested also now while doing it and I come from a security background I realized you know what this looks like the defensive side of f let's see how we can use AI for offensive aspects so uh so kind of I tried to create a lot of uh research paper and understand that you know what the although thanks to chat gbt today is much easier I'm talking about much back before the gbt world uh which got released back in 2020 can I create a clone of myself using AI so essentially what I've created is a a bot which looks like me talks like me uh it sounds like my voice and then obviously it responds with the same amount of humor same amount of let's say uh kind of attitude which which I generally respond back and there's been there a historical data we have used it so uh so what it is this is again a open source project we published all the report how it been done the step by step walk through which you can use but uh when I build it there was no chat GPT there so we use something the old kind of gpt1 gpt2 kind of model which you built but the same architecture can be used which can be integrated with let's say uh telegram or Whatsapp using too or any other kind of API and you can actually create a b clone bot of yours uh which can uh can be used or misused right used because then you can actually create this as a as a knowledge bot as a as a bot like which can which you can feed in lot of your knowledge and help scale Your solution in terms of AQ support Etc uh on the same time this can also be misused by social soci engineering attacks or fishing attacks kind of thing now these are some social proofs which where some people actually kind of uh thought that they're actually talking to me instead of talking to the B now why I'm saying this because this was a research I did when the co During the covid period there's nothing else to do sitting at home I said let's do it but when I kind of realized this aspect of let's say adversarial AI I've realized that this opened a new era new kind of you know door to a new world of of attack vectors that's what we call it now you can be as Innovative as possible create different kind of attacks and and that that can actually U Know scale up in a in a multi multi-layer uh multi-stage attacks right and and I kind of Deep dive into it again these are the few if you want to take a screenshot these are the links of the slide The Talk The GitHub report and everything where there the prop the kind of process we have created now uh now what what what what would we understood with this is sorry uh is uh there are different kind of attacks you can actually simulate and create now when I'm talking about attack think from a hacker point of view we're not talking about specifically web right now because there lot of kind of uh attack which is very much similar and applicable to doesn't matter which industry you are for example fishing attack is it can apply to any kind of targeted organization uh organization whom I can Target now what is the payload I'm delivering there and what I'm kind of trying to achieve through the fishing attack might differ between let's say company to company or what is my objective for example you know here probably my intention is to steal you a private key versus somewhere else I might wanted to just compromise your account and get your password right but essentially what I've realized that now you can use AI to bypass AI you can use AI to actually create lot of model which can actually trigger certain attacks and that can actually um uh kind of make use of various data points to fool you and essentially I've created also a Workshop around that and the idea is we can actually do bypass facial recognition spam filters bypass any kind of bots which does a gatekeeper of different kind of Channel like Discord and this and that kind of thing you can do byes so this kind of very scary but obviously I don't teach anymore because I kind of found this very scary in terms of you know uh this attack vectors now we try to create a lot of model around that now while I'm doing it uh on creating all this kind of model we realize that U the the web three space growing massive in terms of attacks uh and we see this whatever pattern I've been actually thinking uh let's a capture or a bot uh detection human detection mechanism which has been used in lot of wave3 projects to prevent Bots to access your protocol and it's very easy to bypass them so so that is where I know we actually moved into this and say okay why don't you try to defend that and and um and coming back to kind of what kind of uh various uh data points we see um we see kind of obviously billions of kind of money is getting stolen uh even in 2023 um we see that uh it's Market was not good but then kind of almost more than almost $2 billion worth of uh scams and hacks happened now uh even in 2024 it's been what like just couple of months now um even here also we see that kind of in 2 months time more than more than half a million uh sorry 500 million plus or like half a billion kind of dollar worth of money is stolen and uh and if you see uh these are not the exhaustive list obviously these are like few of the things uh we can see apart from that there are a lot of other attacks there um and um if you just if you from how many of you from security background here if I may ask okay 1 2 3 okay um so you guys are doing a lot of analysis around that but uh when you and when you look into the kind of attack methodology or we call it moders operand right how it's happened or what exactly been been happened here a lot of times it's not a very complicated attack methodology and this is very similar to what we have been seeing uh as a attack Vector in in the in the in the conventional World which I was talking about you know how we can use AI to actually create those attack vectors so so in a nutshell um this is the few top uh kind of uh uh attack options which I have seen like unauthorized access which is basically know Access Control was not there proper in different layers be it smart contract be it you know the centralized infra decentralized infra uh that's got social engineering definitely stealing private key through social engineering attacks and all this stuff price manipulation business logic bypass and then reentrance attack now um obviously the question comes probably reentrance attack is one of the most popular one most know one of the pretty old one and a lot of time people say that this attack is no longer valid or probably is is it's not kind of there but then when you look into some of other data data points and this is like one of the repository which has been uh kind of uh uh published by like this person uh which is a historical uh chronological list of re-entrance attack happened across uh all the over entire web3 world and uh you can see that you know although this is a very popular very well-known attack uh we know how it happens there a lot of detection mechanism is there we still see this attack is still there uh in the industry and there is lot of uh lot of kind of attack happened and this is repo is good because it actually has indexed all the contract victim contract exploit contract a sample exploit contract which you can use the transaction histories and everything so this could be like a depository where you can look into that how this attack happened now obviously the interest are different variations U which you can actually U understand and learn more further but the point I'm trying to say that something which is pretty old pretty kind of uh there it's still valid today and and uh and uh and it still still works now the question is why right is it like the audit not been done properly or is it like U maybe uh I don't know the answer like why because to my understanding a lot of time this is something which is going to be like one of the first things is being taught as a as a smart contract audit security uh courses right how we can identify Rey I know what happen so but then this is happening now why it's happening is a different discussion you know what went wrong there and all this but definitely it is there now why I'm saying is because something like that is very simple in in terms of pattern uh which can be trained using AI so essentially what you can do is there is a possibility you can actually create a model which has this idea you can train uh with these various patterns and that should be able to identify a lot of this kind of options now having said that obviously a lot of existing tools static analysis tool also does this kind of pattern analysis so uh so we can actually uh kind of uh look into sther and other tools which has done it but then uh the first part was you know create a model so the first stage what kind of uh we try to do is actually let's create a supervised model now how many of you are familiar with machine learning supervised model unsupervised model okay got it right so supervised model is obviously where we train data right so the one easiest option of creating a model is you actually uh and this pretty easy you can find let's say plethora of vulnerable contracts uh you actually flag them do the data cleansing create you know identify the code and you can do a different level you can do it on a high level code static code level or you can do on a compile code level you know create like different code sample repository of yours what is a good code version what is a bad code you know what kind of uh uh pattern is there and this is like one of the exercise we have done where we kind of created samples we have kind of labeled them in terms of Bad Code versus good code uh on specifically on one vulnerability reentrancy like that we have created a repository categorized by different different vulnerabilities and uh and we have trained uh various models uh along with that right so so first part is actually the data collection consolidation cleansing and labeling properly which is any machine learning problem if you go that is the first part of it like data data engineering you call you may call it right so that itself takes a quite quite a while time because if your data is not been properly structured your accuracy might get impacted and this is a continuous learning process it doesn't happen in day one itself you get the right data and you can do it you do something you understand then you change your pattern of data you understand that you know that might improving your data all so essentially once you get this kind of data uh we tried with various model and if you know the classifiers various kind of classifiers are available from binary classifier to Cann to kind of decision trees and all this so uh we kind of created uh different kind of of model and we have done a split 7030 split you can do different kind of splits also like 70% data used for training 30% for test and that also you can do randomly you can sampling of that data and all this so with that data you actually try to train and test your model classification model so essentially uh people who don't were not familiar with let's say the machine learning Trend test is nothing but you actually split your data set into halves majority of the half you take to train the model and the other part you use to test it which is like looks like an unknown data set for to your model which model hasn't seen it and then uh it will try to feed in and see how much accuracy I'm getting because the test data you already have leveled it you know what is right and wrong so you actually try to Bas on that what the model predicts and you can see that is it kind of predicting in terms of uh false positive or false negative or actually the right so so this is something kind of know the first exercise we have done uh this is again you know we're not getting to llms yet but uh the simple classification and risk scoring we also kind of come up with a probabilistic model around that saying that okay I classify this but what is my confidence score in terms of I know whether it's bad or not U so there are two layer of sub kind of uh um stages of validation we have created first level is you classify it in terms of is this vulnerable or not and second is what level of confidence I have and you can set a threshold let's say that you know if my confidence level is not more than 60% I will not consider that as a valid decision because my model is still learning right so first level is prediction uh classification second level is evaluating based on your risk score so so with this kind of uh approach uh you create a model and you try to test it out and uh and obviously what we try to do is we kind of integrated that into entire pipeline of your code cicd in terms of code deployment in blockchain so what essentially that means is let's say you're using remix and with remix you're writing a code and then you're eventually deploying it on probably one of the evm chain testnet or something like that so now you can create in different layer you can call this model at probably as a you create a plugin and ID layer level versus you can do it as a uh can create like this as a uh like a metam snap and you can call it from the wallet layer when you're signing the transaction probably deploying it or it can actually create this as a guard module in base you know native to your blockchain kind of thing also create so essentially this was one p where our vision was create a secured blockchain so we kind of natively integrated inside the blockchain which is actually uh with the Json RPC uh Interceptor uh and it actually the moment you try to deploy the code it it figure it out is this code bad or not if it is bad uh with the Str and threshold it actually kicks you out in terms of doesn't let you deploy the code so so in a nutshell essentially the idea is is first you create a model and you test it out a different kind of data set and then after that you try to create various hooks in terms of where you want to call the model to actually deploy uh figure it out it will work or not so uh I don't know if it'll work uh have a small demo how it works but uh let's see okay it's not visible I guess uh but essentially on the left side is what uh we have uh the remix and this is like a sample of re reentrance attack which is there and on the right side we're trying to kind of deploy it where uh the code is uh kind of uh get get evaluated by the model and on the down here if you're not be able but this is where actually get a confidence score in terms of what is the confidence score of a decision is it right or wrong and as a result result we actually can U can actually U uh decide based on the score and confidence that is it is it good or not should I consider the decision or not so uh so again this is the first part which kind of we have created um as a model and as I said the overall the vision we had is how do we secure the entire journey of uh development essentially that was the idea because uh as I said uh as a project you need different kind of security and different layer as a developer also you will be using it in different level so so essentially it's not only about the model but how you utilize the model what are the kind of various kind of uh access point you create around the model to make it very easy very easily uh easy to use and to adapt and and very seamlessly it integrates through your development Journey because uh one problem we have seen in my experience is security is always is cause considered to be a friction in terms of development right so something you want to make it more secure you actually cut down let's say access which means it's actually a problem so how do you make it very easy to uh easy and seamless in inherent part of a development cycle so what essentially kind of you know uh the architecture we propose and we actually try to say that you know what and this is why we reach out to various Partners saying that security is a effort of collaboration it cannot be done once alone so one side let's IDs should have intelligence in terms of plugins in terms of in uh something we can create which can give you static analyzing that is already there but then obviously you can create more analytical you know parameters then you can have a pre-commit hooks on your repository layer then you can have validators on your wallet layer and then obviously on the on the blockchain layer so so this is the first part of like you know the model but then idea was now let's do a risk scoring of it because what essentially we have understood that um I we wanted to make it very simple so without getting into how it's been done uh we should actually let's say can we come up with a very simple risk core and that can be used by anybody to First identify okay is it good or not and then you go into that uh go further to analyze that so uh so there are various kind of risk scoring algorithms available which is depending on different kind of qualitative quantitative and simulative so so uh So based on various kind of vulnerabilities uh one simply list is weightage kind of you know based algorithm where you can actually put various weight for your severities and and based on that you can actually create a RIS scoring algorithm um so so we kind of the second level is create a risk scoring algorithm and that algorithm actually helps you to do a first level of analysis that is it good or not because uh one problem with this approach of plugins and this thing is is too much of let's say text oriented too much of data oriented and you spend a lot of time to analyze the dat data but ideas as I say we want to make it very simplified so how we make it very simplified so first step is let's create a risk core so let's say the flow would be like that there is some entity or some engine or something some ml or some AI it first immediately tell you that okay what is the risk score is it 40 30 in the scale of 0 to 100 like that and this solves a productivity problem you don't have to go to two details of it and then based on that you go forward and you understand that uh if it is too risky then we can go ahead and analyze it so this is where kind of risk scoring algorithm comes where you actually when you build a model you should also kind of build a risk scoring around that because that will be very simple for you to analyze and understand so with this risk scoring you kind of uh create a model and then the next part is depending on which layer where you to we actually can you can actually try to do a indexing and kind of you know uh ranking various kind of onent contracts uh what essentially this will do this will give you like a profiling of uh high risk versus low risk kind of thing and this is where you actually as a as a as a security analysis you can automate this part so think of it like that you create a a model which has this risk scoring analytics uh integrated as a model uh and then you create this rapid with a crawler which continuously crawl through your explorers or various kind of blockchain whatever blockchain you to do and keep ranking this uh the various smart contracts uh this could be a contract belongs to a same project different projects uh depending on you know what is your portfolio if you're a VC probably in inst you wanted to look into all the contracts belongs to your companies who have invested so depending on that you can do so if you do this as a fully automated manner uh then you get the first level of uh let's say uh report where it says you know what I see kind of let's say average risk uh around 1200 contracts which I need to look into and then you go and deep dive so so security as I said you have to uh there a lot of uh times you spend time on something which is not important so essentially here what are trying to do prioritizing your work in terms of what is important I need to look for in terms of security and then then you can de dive and you can do uh do automated uh uh further analysis in terms of that so so this is where this is where you know the ranking algorithm comes which you can use it um now I just wanted to uh uh one second yes so so this part this is this is the first part of uh of the presentation where uh what we're trying to build is in terms of uh a kind of a pipeline of overall ml Ops or ml architecture where you not only build a model but you actually can uh create a complete end to end uh automated uh risk scoring platform where it actually helps you to do a lot of manual task which otherwise you are doing today and eliminate that uh with this kind of evaluation so that you can focus on more further analysis on the advanc uh level of uh vulnerabilities which is mostly L to business logic and stuff so this is this is the uh the first part uh of of the of the model so so is there any questions uh or do you do like uh later anybody has any questions okay so we'll move on so so the other part is as I say this is uh this is about creating a security stack uh this is not about uh I'll gorithms now there is other tools uh so the other part is obviously we can actually have lot of this kind of tool you can automate like using Docker and container you can do Slither um you can automate that uh like a Mythril or there is a smart Buck there a lot of other tools are there but but if you want to use let's say AI as a engine uh you actually have to create a u ml off stack when I say mL of Stack as I say it's uh AI is all about continuous learning so let's say I have 100 odd smart contracts or thousand contracts today which has certain kind of vulnerability which I have trained or I understood but then tomorrow something new attack Vector comes I have to continuously flag and feed that data back into the system and kind of learn it together so essentially this is a continuous pipeline where you create a data Lake first where you push keep pushing the data uh it could be flagged it could be labeled it could be like unsupervised and then with this data you continuously train your model so what essentially we have done on this is we have created an llm large language model and what it does and thanks to chat gbt obviously is nowadays even much easier where you can actually uh do a kind of model by yourself so there is two things I want to show you um so can you see the see uh yeah let me Zoom it so so let's say this is called uh llm bot um I'll just quickly show you how this can be built PR easily uh and you can do it so again first part is you need data so what essentially you do first you create your data set uh what essentially that means is um okay uh let me explain you the process and then probably I I'll try to show you uh how it it's been built so first I have as I said an initial uh research classification model what we built we anyway have labeled the data so we have created a repository or index of data which has let's say hundreds 200s of different kind of vulnerable smart contract uh with uh uh specific vulnerability uh reentrancy or uh you know any other kind of vulnerabilities are there so we've created the repository now in chat GPD you can create a bot where you can feed in the data so you can actually say you know what uh you now going to be a uh smart contract audit bought and here is my data point so we have created so we have indexed and craw through various kind of uh vulnerable smart contracts and also we have created uh what is the vulnerability what code part of the code has that vulnerability we have created that as a data and we feed in that data to the GPD saying that you know what this is what has been sampled where you can see that how this this has been exploited that's number one first stage the second stage is pull out all the audit reports from all the everything is public right pull out all the audit reports from all the all the companies and what whoever published the audit report right and and say that you know what this contract uh this is the contract source code and this had this these are the vulnerabilities which it had uh why don't you kind of learn from that and then you feed in all this data back to GPT where you there's a b creation uh uh flow and once you feed in all this data eventually this has the intelligence where you can actually say audit this smart contract and it should be able to do a smart contract audit there so let's see if I go to to uh let me try to go to let's say not more maybe uh polygon Explorer okay let's go to polygon [Applause] Explorer and let's say I go for I don't know uh top tokens something I'm just giving you some random think let's say this is the code I go to the contract and obviously this lot of time this contract has multiple uh files but let's say this is a contract I'm just giving you a very simple this is a very simple prototype you can copy paste the code and what I can do is I can say that audit this smart contract I going to paste the code so what say it will do it has actually actually kind of has Intelligence of how it is been do and then it actually can run and it can tell you uh yeah so what are the problems I can find and all these things it can actually do it so this is how I do and this is done using the uh GPT bot creation uh feature so actually if you don't know chat GPT you can actually create your own bot so so we can actually create uh okay this is not the one but uh um okay create here from here you can actually create a GPT Builder this is the one and so you can say that you know uh so like that you can create a smart contract thisis so again um you have to try it out obviously it's not that always 100% perfect but then once you do this you create and then in the configuration SE section here you can go and here you can name your GPT bot you can say let's say I want to create let's say and instructions are there um so you can create various kind of prompts and eventually here there is a knowledge section this is where you can upload files this is where actually once you label the data the one I've created that those kind of labeling data uh which I've shown on my uh previous slide you can upload those data here and uh once it has those intelligence you can actually create uh create your own uh bot there so this is one part and uh once this has been done you can actually keep uploading the data later on as well but this can actually give you a very simple chatbot which can create and which can analyze the city contract and everything and then you can create API around that and all this stuff um last but not the least uh there is also a kind of uh GPT B yes so this is the most recent report has been published uh on February 20th just 5 days back which actually is a very good reference if you are trying to build your own automated AI based let's say audit bot what essentially they have evaluated kind of lot of uh lot of kind of model and with this there are primarily three parameters which you look into vulnerability dediction code pursing capability and then POC writing ability because the other challenge in in in kind of uh smart contract audit is not only detecting the vulnerability but eventually we have to create a POC especially if you're a bounty hunter if you're doing bug bounties and all this stuff you need to create a proof of co uh kind of POC code which will able to exploit that and show you that this is exploitable so how do you kind of not only find vulnerability but create an audit so essentially with this you can create uh various kind of model and uh this is a very good reference uh where so uh we managed to to create a kind of a smart contract a good chat GPD prompt which helps you to create a create a smart bot uh which will give you a more efficient result so uh so in a nutshell uh thanks to JP there a lot of things which is much easier but then if you have to do it in a in the basic fundamental way you have to start from the beginning of connecting the data labeling cleaning the data and then creating lot of models on your own um if you want want something you have access to chat GPT or chat G Pro you can create your own bot like this and that can also help you to uh do a much faster uh uh analysis now this analysis was able to create and identify lot of good vulnerabilities uh and it can it is much scalable obviously because they can do audit much faster so uh I think in this research they have they able to audit like I think 34,000 uh smart contracts in in in quite a faster time I don't remember exactly but they published the data report here so uh with interest of time I'll stop here but uh this is a very good uh reference of how you can create a much efficient uh a l model uh for audit so yeah I think that's pretty much what I have uh yeah thank you so much if you want to uh connect or stay talk happy to happy to get connected uh yeah later after the talk thank you