EtherShield: Time-interval Analysis for Detection of Malicious Behavior on Ethereum

• Published in: ACM transactions on Internet technology 2024-01, Vol.21 (1), p.1-30, Article 2
• Main Authors: Pan, Bofeng, Stakhanova, Natalia, Zhu, Zhongwen
• Format: Article
• Language: English
• Subjects: Computing methodologies; Distributed systems security; Machine learning; Security and privacy
• ISSN: 1533-5399; 1557-6051
• DOI: 10.1145/3633514

Advances in blockchain technology have attracted significant attention across the world. The practical blockchain applications emerging in various domains, ranging from finance, healthcare, and entertainment, have quickly become attractive targets for adversaries. The novelty of the technology coupled with the high degree of anonymity it provides made malicious activities even less visible in the blockchain environment. This made their robust detection challenging. This article presents EtherShield, a novel approach for identifying malicious activity on the Ethereum blockchain. By combining temporal transaction information and contract code characteristics, EtherShield can detect various types of threats and provide insight into the behavior of contracts. The time-interval-based analysis used by EtherShield enables expedited detection, achieving comparable accuracy to other approaches with significantly less data. Our validation analysis, which involved over 15,000 Ethereum accounts, demonstrated that EtherShield can significantly expedite the detection of malicious activity while maintaining high accuracy levels (86.52% accuracy with 1 hour of transaction history data and 91.33% accuracy with 1 year of transaction history data).