A method for automated early detection of DeFi security incidents

Abstract

This invention discloses an automated method for early detection of DeFi security incidents, comprising: collecting DeFi security incident and Flashbots community dialogue data, further identifying discussions related to DeFi security incidents, and constructing and training a classification model to achieve automatic prediction of DeFi security incident-related discussions. In the modeling process, a binary classification model is constructed using a few-shot learning method, using dialogue data as input to determine whether the dialogue is related to a DeFi security incident, and further locating the content of the relevant DeFi security incident. Based on the acquired DeFi security incidents and their solutions, vulnerability warnings are pushed out through the community and notified to all users via email or SMS. This invention, by designing a DeFi incident warning method, achieves early detection and disclosure of DeFi incidents, avoiding the risk of attack due to information lag.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically to a method for automated early detection of DeFi security events. Background Technology

[0002] Decentralized Finance (DeFi), based on blockchain technology, refers to a new software ecosystem built on smart contract blockchains such as Ethereum. It utilizes technologies like smart contracts to construct software applications, thereby providing open and transparent financial services and products. As the DeFi ecosystem has grown and developed, attacks targeting it have become increasingly frequent, covering different layers such as networks, consensus mechanisms, smart contracts, and protocols. These DeFi security incidents can easily cause serious economic losses. Therefore, effectively identifying and promptly obtaining information about DeFi security incidents and their attributes is crucial for preventing their adverse effects and maintaining the healthy development of the DeFi ecosystem.

[0003] For DeFi developers and users, online communication is a crucial way to share information and dynamics within the DeFi ecosystem, including the use of communication platforms such as Twitter and Discord. Among these, Discord, with its support for voice and video communication, community and channel creation mechanisms, and real-time interaction, has gradually attracted increasing active participation from blockchain users, who engage in DeFi-related exchanges and discussions within the Discord community. These user discussions implicitly contain a wealth of information related to DeFi security incidents, including the content of the incidents, their timing, potential impact, and corresponding response strategies.

[0004] Miner Extractable Value (MEV) refers to the additional revenue a miner generates on a block by reordering transactions within that block in a way that benefits them. Due to differences in consensus, ordering, and block creation mechanisms within blockchain networks, optimizing MEV extraction strategies leads to MEV game theory. This game theory generates negative externalities, including user losses, increased network load, waste of blockchain resources and quality degradation, and the emergence of centralization effects, among other negative impacts.

[0005] To eliminate negative externalities associated with MEVs and support the healthy development of the DeFi ecosystem, third-party services are flourishing. Flashbots is one such representative MEV service provider, collaborating with over 80% of Ethereum miners. It allows traders to submit transactions without broadcasting, meaning attackers can only access transaction information after the block is published, preventing them from executing attacks and thus helping traders conduct secure transactions. The emergence of Flashbots has reduced attack rates to some extent, protecting traders' transactions and playing a significant role in promoting the development of the DeFi market and enhancing the security of the DeFi ecosystem.

[0006] As an open-source project, Flashbots has established a community on Discord to promote information exchange and synchronization, specifically for discussing DeFi-related information, including DeFi security incidents. Therefore, the user discussions in this community contain a wealth of valuable information that can be mined, and extracting DeFi security incident-related content from this is one of the important goals to achieve. However, current technology cannot locate discussions related to DeFi security incidents in Discord user exchanges, making it difficult to extract information related to DeFi security incidents from Discord. This may lead to the loss of information about DeFi security incidents and make it difficult to comprehensively collect methods for preventing and resolving DeFi attacks. Simultaneously, it also leads to delays and increased difficulty for DeFi users to obtain DeFi events. Automated extraction of DeFi security incidents and early warning can effectively protect user assets and improve the security of the DeFi market. Summary of the Invention

[0007] To address the aforementioned issues, this invention proposes an automated method for early detection of DeFi security events. Based on user discussions within the Flashbots community on Discord, an automated identification model framework is constructed to locate discussions related to DeFi security events and issue early warnings to user transactions regarding DeFi events, including SMS notifications, effectively preventing the escalation of the impact of DeFi events.

[0008] This invention employs the following technical solution: a method for automated extraction and early warning of DeFi security events. After characterizing user discussions appearing in the Flashbots community on Discord, the methods are automatically classified to extract dialogues related to DeFi security events. This allows for the identification of potential DeFi events and the provision of early warnings regarding potential risks in user transactions. Specifically, user discussions are first separated through dialogue decoupling to obtain independent dialogue datasets. The communication information contained in the dialogues is then represented, encoding text content and dialogue structure into vectors. The dialogue representation results are used as input to a model to analyze whether the discussions are related to DeFi security events. Potential DeFi security events and solutions are identified from the discussions, automatically alerting users and providing protection for their transactions.

[0009] Furthermore, a method for automating the early detection of DeFi security incidents includes the following steps:

[0010] Step 1: Build a DeFi security incident dataset and a DeFi security incident discussion dataset;

[0011] Step 2: Construct a binary classification model using a few-shot learning method. The binary classification model takes the untangled dialogue of user discussion messages as input and outputs the classification result as whether the independent dialogue is related to the DeFi security event.

[0012] Step 3: Use the DeFi security incident discussion dataset obtained in Step 1 to build a training set, perform end-to-end training on the binary classification model, adjust the model parameters, optimize the model evaluation metrics, complete the tuning of the binary classification model, and obtain the DeFi security incident awareness model.

[0013] Step 4: Input the target dialogue into the DeFi security event perception model to predict whether the target dialogue is related to DeFi security events. If the dialogue is related to DeFi security events, then further find the DeFi security events contained in the DeFi security event dataset obtained in Step 1, complete the localization of DeFi security events, and complete the early perception of DeFi security events in user discussion messages.

[0014] Step 5: Based on the identified DeFi security incidents, issue vulnerability alerts and push notifications.

[0015] This invention constructs a model framework to automatically identify discussions related to DeFi security events within the Flashbots community on Discord. By periodically monitoring and analyzing community discussion content, it automatically identifies potential DeFi risk events, solving the problem of delayed vulnerability reporting caused by the lack of a unified disclosure platform for DeFi events. Furthermore, by designing a DeFi event early warning method, it achieves early detection and disclosure of DeFi events, avoiding the risk of attacks due to information lag. The method includes: collecting DeFi security event and Flashbots community dialogue data; further identifying discussions related to DeFi security events; and constructing and training a classification model to automatically predict discussions related to DeFi security events. During the modeling process, a binary classification model is constructed using a few-shot learning method. Using dialogue data as input, it determines whether the dialogue is related to a DeFi security event and further locates the content of the relevant DeFi security event. Based on the acquired DeFi security events and their solutions, vulnerability warnings are pushed out through the community and notified to all users via email or SMS. This method can automatically extract user discussions related to DeFi security incidents and notify users, providing an effective solution for early detection and warning of DeFi security incidents.

[0016] Step 1 involves constructing a DeFi security incident dataset, specifically including:

[0017] We collect relevant security incident information from various DeFi security incident auditing websites and extract the incident name, incident time, incident description, amount of loss, attack method, incident notification link, and attack target characteristic attributes of DeFi security incidents to construct a DeFi security incident dataset.

[0018] Step 1 involves constructing a DeFi security incident discussion dataset, which specifically includes:

[0019] The Flashbots community on the Discord platform was selected as the data source. User discussion messages for each channel were collected and preprocessed, bot messages were removed, and de-entanglement was performed based on the context of user discussion messages to obtain independent dialogues. Based on the event occurrence time, event name, and event description in the DeFi security event dataset, independent dialogues and tags indicating whether they are related to DeFi security events were obtained to construct a DeFi security event discussion dataset.

[0020] In step 1, based on the event occurrence time, event name, and event description in the DeFi security event dataset, independent chat tags and whether they are related to DeFi security events are obtained. Specifically, these include:

[0021] The correlation between independent conversations and various DeFi security events is judged manually, and labels related to / unrelated to DeFi security events are identified to complete the manual labeling of conversations.

[0022] In step 2, the binary classification model employs a dialogue semantics and structure encoding module, which includes, in sequence:

[0023] The input layer is used to segment sentences into basic lexical units and initialize them as uniformly distributed random vectors;

[0024] A sentence embedding layer containing the TextCNN model (a text encoding classification algorithm based on convolutional neural networks) is used to concatenate random vectors into a matrix and then embed it through the TextCNN model to obtain a sentence representation;

[0025] A dialogue embedding layer containing a BiLSTM (Bidirectional Long Short-Term Memory) model is used to encode sentence representations into bidirectional dialogue embedding vectors through the BiLSTM model.

[0026] The output layer is used to concatenate the bidirectional dialogue embedding vectors and output the dialogue embedding vector.

[0027] In step 4, if the conversation relates to a DeFi security incident, then further identify the DeFi security incidents contained in the DeFi security incident dataset obtained in step 1, thus completing the localization of the DeFi security incident. Specifically, this includes:

[0028] If the dialogue is related to a DeFi security event, the similarity between the dialogue embedding vector output by the DeFi security event awareness model and the event description of the DeFi security event in the DeFi security event dataset obtained in step 1 is calculated. If the similarity is higher than the threshold, the DeFi security event is located.

[0029] Specifically, the method includes the following steps:

[0030] Step 1: Construction of the DeFi Security Incident Discussion Dataset. This invention first collects relevant security incident information from various DeFi security incident auditing websites, extracting event names, occurrence times, descriptions, loss amounts, attack methods, event notification links, and attack target characteristics to construct a DeFi security incident dataset. This invention then constructs a DeFi security dialogue dataset for model training. The Flashbots community on the Discord platform is selected as the data source. User discussion messages from each channel are collected and preprocessed, removing bot messages and other interfering information. Decoupling is performed based on message context to obtain independent dialogues. Based on DeFi security incident data, including time and content attributes, it is determined whether the dialogue is related to a DeFi security incident, thus constructing the DeFi security incident discussion dataset.

[0031] Step 2: DeFi-Related Dialogue Model Training and Prediction. First, a binary classification model is constructed using few-shot learning. This model takes de-entangled dialogues from real-time monitored community discussions as input and outputs a classification result indicating whether the dialogue is related to a DeFi security event. For model training, the DeFi security event discussion dataset obtained in Step 1 is used to construct a training set. The model is trained end-to-end, and its parameters are adjusted to optimize evaluation metrics, completing the tuning of the automated classification model. After model tuning, the trained model is used to predict whether a given dialogue is related to a DeFi security event. If the dialogue is related to a DeFi security event, the model further determines the DeFi security event content it contains, thus locating the DeFi security event.

[0032] Step 3: Automated DeFi Incident Warnings and Disclosure. When a potential risk is detected in a project, such as smart contract vulnerabilities or developers withdrawing liquidity, the system will automatically trigger an warning mechanism to inform users and the community, preventing potential attacks. Incident notifications are sent via community-published vulnerability alerts and to users via email or SMS, promptly instructing them to stop trading on affected DeFi projects. Furthermore, this method is highly automated, reducing the need for manual intervention and improving the applicability and response speed of automated DeFi security incident warnings, enabling timely notification and protection for users regarding DeFi security incidents.

[0033] Compared with the prior art, the present invention has the following advantages:

[0034] (1) Rich and diverse datasets: This invention collects data from multiple DeFi security incident auditing websites, and performs deduplication and aggregation processing to obtain a rich and complete set of DeFi security incidents; in addition, this invention also collects user discussion data from multiple channels in the Flashbots community of Discord, which can cover a rich variety of dialogue content.

[0035] (2) Reducing the workload of data labeling by using few-shot learning: This invention uses few-shot learning, which can overcome the problem of limited training data scale in manual labeling. By setting sample pairs, based on limited labeled data, the feature representation of new sample classification is effectively learned and accurate classification is achieved, thereby reducing the burden of data labeling.

[0036] (3) Automatic Detection of User Discussions Related to DeFi Security Events: This invention establishes a model framework for automatically identifying discussions related to DeFi security events, achieving efficient localization of DeFi security event discussions among a large number of user discussion messages. Independent dialogue datasets are obtained by decomposing user communication statements, and user discussion behavior regarding DeFi security events is extracted from the dialogue hierarchy. The security event discussion identification model implemented in this invention achieved an accuracy of 84.72% on the test set.

[0037] (4) Automatic early warning of potential DeFi security incidents and provision of protection: This invention provides a method for locating and warning of DeFi security incidents. By regularly monitoring and analyzing community discussions, it automatically identifies potential risk events, solving the problem of delayed vulnerability reporting caused by the lack of a unified disclosure platform for DeFi incidents. By designing a DeFi incident response system, it realizes the function of early perception and disclosure of DeFi incidents, avoiding the expansion of the impact of DeFi incidents due to information lag. Attached Figure Description

[0038] Figure 1 This illustrates the overall process of data acquisition and construction, model training, and prediction in this invention;

[0039] Figure 2 This invention illustrates the process of annotating discussions related to DeFi security incidents.

[0040] Figure 3 This is a flowchart illustrating the method for automating the early detection of DeFi security events according to the present invention. Detailed Implementation

[0041] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments described are for illustration and explanation only and should not be used to limit the scope of the present invention.

[0042] This invention proposes a method for automated extraction and early warning of DeFi security events. The method uses DeFi events and user discussion messages from the Flashbots community on the Discord platform as datasets, and manually constructs a dialogue dataset related to DeFi events. Based on this data, this invention employs a few-shot learning method to build a classification model capable of automatically locating dialogues related to DeFi events. Through this method, this invention can effectively extract DeFi security events from discussions in the Flashbots community and accurately locate related dialogue content.

[0043] like Figure 1 and Figure 3 As shown, the method of the present invention includes the following steps:

[0044] Step 1: Building the DeFi Security Incident Discussion Dataset

[0045] Step 1.1: Building the DeFi security incident dataset.

[0046] This invention collects data from three DeFi security incident disclosure websites (Rekt News, Slowmist, and Cryptosec), gathering information on DeFi security incidents occurring on Ethereum and BSC from June 4, 2018, to June 4, 2024. This includes information such as attack targets, attack events, and event disclosure links. After completing the data collection, this invention organizes and summarizes the DeFi security incident data collected from different data sources, including the following steps: Data deduplication: The same DeFi event may be recorded by different data sources simultaneously. Since DeFi security events do not have unique identifiers and different DeFi security events are expressed differently in different data sources, manual methods are needed to determine if duplicate data exists. This invention determines whether it belongs to the same security event by comparing the impact of security events on DeFi project names and the attack occurrence time between data sources. Data verification: DeFi security incident disclosure websites complete the aggregation by extracting relevant information from security incident disclosure links. Different websites provide different data fields, and data extraction errors exist. To ensure the quality of the dataset, this invention verifies the collected DeFi security incident data. The verification process includes: (1) determining whether the event is a DeFi security event; (2) verifying the accuracy of event-related attributes (such as event occurrence time, attack target, and losses); and (3) completing any missing data. For data with inconsistent verification results, a final result will be reached through negotiation among the annotators.

[0047] For each DeFi security incident, this patent collects the following characteristics: (1) Attack target, the target of the attack in the security incident; (2) Attack time, the specific time when the security incident occurred; (3) Attack event identifier, consisting of the attack target and the attack event; (4) Event description, the specific content of the security incident; (5) Event loss, the direct monetary loss caused by the attack (this invention collects the total monetary loss reported by the above data sources, and the victims may be users, liquidity providers, speculators or protocol operators); (6) Attack methods, how malicious attackers exploit the design flaws of DeFi projects to achieve their attack objectives, such as contract vulnerabilities; (7) Data source: for each security incident, this invention collects the disclosed data sources, including web page links, to provide verification of the accuracy of the data.

[0048] Step 1.2: Building the Flashbots community dialogue dataset for Discord.

[0049] To ensure the validity and analyzability of communication messages, this invention filters the collected message statements, removing statements generated by robots and statements containing only images. Furthermore, this invention replaces emoticons in user messages with spaces to filter non-textual information.

[0050] Discord supports real-time communication between many-to-many and one-to-many pairs, which leads to the intertwining of messages from different conversations. Therefore, de-entanglement is necessary to obtain independent conversation datasets for subsequent analysis. This invention applies a decision tree-based supervised model to segment user discussions on the Discord platform, resulting in a large-scale independent conversation dataset containing 19,477 conversations from the past three years after de-entanglement. This model considers not only the time frame between message pairs but also user similarity, cue words, similar word usage, and technical expressions to improve the accuracy of conversation separation.

[0051] Step 1.3: Construction of the DeFi security incident discussion dataset.

[0052] To determine whether a conversation is relevant to a DeFi event, this invention performs manual annotation on the large-scale independent conversation dataset obtained in step 1.2. Considering time and cost factors, the original dataset is too large and requires processing. Therefore, this invention employs a random sampling method, extracting a certain number of conversations as research samples of the entire conversation group's characteristics. Through this sampling method, this invention can effectively and representatively annotate the dataset, thus completing the annotation work while controlling time and cost. During the sampling process, this invention also excludes conversations with non-English descriptions, numerous syntactic errors, or excessive code snippets to ensure the selected conversations are of high quality and reliability.

[0053] This invention revolves around manual annotation of sampled dialogues (e.g.) Figure 2 This involves manually determining whether a conversation is relevant to a specific DeFi event to obtain a DeFi security event discussion dataset, which serves as a real-world dataset for method definition and performance evaluation. In labeling conversations for DeFi event relevance, a coding manual was first developed to guide the entire labeling process. This manual is divided into three main parts. In the initial phase, two labelers annotate the same conversations and record them in their respective codebooks. Subsequently, a merging phase is conducted by the same labeler who merges the two codebooks, limiting the search scope to the conversation level to avoid overly coarse or overly fine labeling. As part of the manual's iterative updates, labelers developed a series of guidelines for judging conversation content as relevant / irrelevant to DeFi events. These guidelines may include using speculative language or providing reasons to justify the correctness of statements. Finally, a detailed coding manual was written to ensure consistency and accuracy in the labeling process. Based on the completed coding manual, this invention conducts multiple rounds of labeling and discussion around the classification of conversations as relevant to DeFi events to eliminate disagreements and reach consensus.

[0054] Step 2: Training and prediction of DeFi-related dialogue recognition models

[0055] Step 2.1: Model Building. To build an automated classification model to determine whether a conversation is related to a DeFi event, this invention first constructs a semantic and structural encoding module, and then implements conversation classification through a classification network.

[0056] (1) Dialogue semantics and structure encoding module: This module adopts a hierarchical structure, which can capture the contextual information and structural features of each sentence in the dialogue. It consists of four layers: input layer, sentence embedding layer, dialogue embedding layer and output layer.

[0057] Input Layer: The input layer segments sentences into basic lexical units. To achieve better performance, this invention utilizes a pre-trained 50-dimensional GloVe model (with word embeddings and global vectors) as the initial vectors for the corresponding words, and adds part-of-speech tagging information to the word representation to enhance its characteristics. Specifically, each type of part-of-speech tag is initialized as a uniformly distributed random vector and optimized during training.

[0058] Embedding Layer: The embedding layer encodes semantics and structure at both the sentence and dialogue levels. For sentence-level embedding, this invention converts the original sentence into a matrix of stacked word embeddings and POS tag embeddings, and then inputs the embedding matrix into TextCNN to obtain the sentence representation. For dialogue-level embedding, this invention uses each embedded sentence as a tag when it is input into the BiLSTM encoder according to its sequence in the dialog box. After encoding with BiLSTM, the bidirectional contextual information of the dialogue is learned.

[0059] Output layer: In the output layer, the present invention combines the two directional representations generated by BiLSTM encoding into the output vector of the dialog box.

[0060] (2) Siamese Dialogue Classification Network (Siamese Neural Network): To address the problem of limited dataset size in manually labeled data, this invention combines few-shot learning methods to construct the Siamese Dialogue Classification Network. This network can enhance the dataset by transforming the traditional text classification task of mapping a single dialogue to its class into the task of determining whether two dialogues belong to the same class or different classes.

[0061] Step 2.2: Model Training. This invention employs the following two steps to train the Siamese dialogue classification network:

[0062] (1) Dataset partitioning: First, the present invention randomly partitions the DeFi security event discussion dataset obtained by manual annotation in step 1.3 into a training dataset and a test dataset. The original dataset contains dialogue items labeled "related to DeFi events" or "unrelated to DeFi events".

[0063] (2) Data Augmentation: Typically, the number of labeled dialogues may be insufficient to train an effective supervised learning model. To address this issue, this invention extracts two dialogues from the original data, combines them, and assigns "same" or "different" labels to this combination based on whether their original labels are identical, forming a dialogue pair dataset to achieve natural data balance. Assuming there are m dialogues "related to DeFi events" and n dialogues "unrelated to DeFi events" in the dialogue pair dataset, this invention can increase the size of the source dataset to (m... 2 )+(n 2 To expand the dataset, we can use )+m*n.

[0064] (3) Category Inference: Since each pair of dialogues is labeled as either "same" or "different," a 2-dimensional output vector is obtained through the Siamese dialogue classification network, representing the scores of the two categories respectively. Finally, this invention performs Softmax processing on this output vector to obtain the final similarity classification result. However, this invention requires an indication of the probability of whether a dialogue is related to a DeFi security event. Therefore, we need to infer the label of the dialogue based on the probability and the actual label of another dialogue in the dialogue pair instance. For example, we sample a pair of dialogues <dialogue 1, dialogue 2>, where dialogue 1 is sampled from the training dataset with the label "unrelated to DeFi events," and dialogue 2 is the unknown dialogue to be predicted. We input this pair of dialogues into the Siamese dialogue classification network and then predict whether the two dialogues are the same or different. If the prediction result is different, then we can infer that the category of dialogue 2 is "related to DeFi events." If the actual label of dialogue 2 is "related to DeFi events," it indicates that the prediction made by our model is a true positive prediction. Otherwise, we will get a false positive prediction result. To obtain more reliable prediction results, we use a voting strategy when predicting dialogues. For each unknown dialogue, we construct k paired instances by extracting k distinct sample dialogues. After feeding these paired instances into the model, based on the model's prediction results and the labels of the paired dialogues, we obtain p instances representing the unknown dialogue as a feature dialogue and kp instances representing the unknown dialogue as a non-feature dialogue. If p is greater than... We will then assign the predicted conversations the tag "Related to DeFi Events".

[0065] Through the above sub-steps, the present invention can effectively utilize the information in the dataset and expand the dataset through data augmentation methods to solve the problem of insufficient labeled data, thereby improving the performance and generalization ability of model prediction.

[0066] Step 2.3: Model Prediction. After completing the classification model training, this project monitors the model's performance and uses it for subsequent prediction steps.

[0067] Based on the classification model obtained in steps 2.1 and 2.2, for real-time monitored community discussion dialogues, this invention de-entangles the dialogues and then uses the classification model to predict whether they are "related to DeFi events." This invention constructs a test set to test the performance of the classification model in real-world scenarios. The test set contains 12 discussions related to DeFi events and 60 discussions unrelated to DeFi events. The discussions related to DeFi events include various attack types, such as contract vulnerabilities and flash loan attacks, to verify the model's effectiveness in facing different types of DeFi events. After balancing the samples, the test set contains 72 discussion samples related to DeFi and 72 discussion samples unrelated to DeFi. In the test set, this model successfully detected 62 discussions related to DeFi events (TP, positive samples predicted by the model as positive). For discussions unrelated to DeFi events, this model successfully identified 63 discussions as unrelated to DeFi events (TN, negative samples predicted by the model as negative). In the test set, this model incorrectly identified 10 discussions related to DeFi events as unrelated to DeFi events (FP, negative samples predicted by the model as positive). In the discussions unrelated to DeFi events, 9 discussions were identified as related to DeFi events (FN, negative samples predicted by the model as negative). The model's accuracy represents the proportion of correctly identified data (TP+TN) out of the total data, calculated as (TP+TN) / (TP+TN+FP+FN). This model achieved an accuracy of 86.81% on the test set. The model's precision represents the proportion of true positives (TP) out of all positive examples (TP+FP) identified by the model, calculated as TP / (TP+FP). This model achieved a precision of 87.32% on the test set. The model's recall represents the proportion of correctly identified positive examples (TP+FN) out of all positive examples in the dataset, calculated as TP / (TP+FN). This model achieved a recall of 86.11% on the test set, meeting the expected classification performance and demonstrating high accuracy and robustness in identifying DeFi-related discussions.

[0068] If a conversation is determined to be "related to a DeFi event," this invention further predicts the specific DeFi event discussed, using this prediction to determine if the event is a known DeFi event. For new events, the most similar event is matched among known events. By calculating the similarity between the target conversation embedding vector and the event description embedding vectors of various types in the DeFi security event dataset, the most relevant DeFi event is located as the prediction result. After location, it is determined whether the event discussed in the conversation is an existing event. If it is determined to be an existing event, no further response is taken; if it is determined to be a discussion related to a newly occurring DeFi event, a response is taken to the DeFi event to achieve early detection and disclosure of security events.

[0069] Step 3: Automated Early Warning and Disclosure of DeFi Events

[0070] Step 3.1: Identification of Event Attack Methods

[0071] In step 2.3, this patent achieves the task of locating the most relevant DeFi events within a known DeFi event database for the DeFi events under discussion. During the data collection process, the attack methods of existing DeFi events have been manually labeled and confirmed. This step will acquire the attack methods of the most relevant DeFi events and use them to guide subsequent event disclosure work.

[0072] Step 3.2: DeFi Event Notification

[0073] When a DeFi project's transactions are detected to have potential risks, such as smart contract vulnerabilities or developers withdrawing liquidity, the system will automatically trigger an early warning mechanism. The specific notification process is as follows: Warning Trigger: When the system detects a potential risk, it immediately triggers the early warning mechanism. Community Announcement: A vulnerability warning is pushed out through the community, detailing the detected risk and its potential impact. User Notification: All users are promptly informed of the relevant security threat via email or SMS. Feedback Collection: User feedback and questions are collected to further improve the risk assessment and notification mechanism.

Claims

1. A method for automated early detection of DeFi security events, characterized in that, Includes the following steps: Step 1: Build a DeFi security incident dataset and a DeFi security incident discussion dataset; Step 2: Construct a binary classification model using a few-shot learning method. The binary classification model takes the untangled dialogue of user discussion messages as input and outputs the classification result as whether the independent dialogue is related to the DeFi security event. Step 3: Use the DeFi security incident discussion dataset obtained in Step 1 to build a training set, perform end-to-end training on the binary classification model, adjust the model parameters, optimize the model evaluation metrics, complete the tuning of the binary classification model, and obtain the DeFi security incident awareness model. Step 4: Input the target dialogue into the DeFi security event perception model to predict whether the target dialogue is related to DeFi security events. If the dialogue is related to DeFi security events, then further find the DeFi security events contained in the DeFi security event dataset obtained in Step 1, complete the localization of DeFi security events, and complete the early perception of DeFi security events in user discussion messages. Step 5: Based on the identified DeFi security incidents, issue vulnerability alerts and push notifications.

2. The method for automated early detection of DeFi security events according to claim 1, characterized in that, Step 1 involves constructing a DeFi security incident dataset, specifically including: We collect relevant security incident information from various DeFi security incident auditing websites and extract the incident name, incident time, incident description, amount of loss, attack method, incident notification link, and attack target characteristic attributes of DeFi security incidents to construct a DeFi security incident dataset.

3. The method for automated early detection of DeFi security events according to claim 1, characterized in that, Step 1 involves constructing a DeFi security incident discussion dataset, which specifically includes: The Flashbots community on the Discord platform was selected as the data source. User discussion messages for each channel were collected and preprocessed, bot messages were removed, and de-entanglement was performed based on the context of user discussion messages to obtain independent dialogues. Based on the event occurrence time, event name, and event description in the DeFi security event dataset, independent dialogues and tags indicating whether they are related to DeFi security events were obtained to construct a DeFi security event discussion dataset.

4. The method for automated early detection of DeFi security events according to claim 3, characterized in that, In step 1, based on the event occurrence time, event name, and event description in the DeFi security event dataset, independent chat tags and whether they are related to DeFi security events are obtained. Specifically, these include: The correlation between independent conversations and various DeFi security events is judged manually, and labels related to / unrelated to DeFi security events are identified to complete the manual labeling of conversations.

5. The method for automated early detection of DeFi security events according to claim 1, characterized in that, In step 2, the binary classification model employs a dialogue semantics and structure encoding module, which includes, in sequence: The input layer is used to segment sentences into basic lexical units and initialize them as uniformly distributed random vectors; A sentence embedding layer containing a TextCNN model is used to concatenate random vectors into a matrix and then embed it through the TextCNN model to obtain a sentence representation; A dialogue embedding layer containing a BiLSTM model is used to encode sentence representations into bidirectional dialogue embedding vectors using the BiLSTM model. The output layer is used to concatenate the bidirectional dialogue embedding vectors and output the dialogue embedding vector.

6. The method for automated early detection of DeFi security events according to claim 1, characterized in that, In step 4, if the conversation relates to a DeFi security incident, then further identify the DeFi security incidents contained in the DeFi security incident dataset obtained in step 1, thus completing the localization of the DeFi security incident. Specifically, this includes: If the dialogue is related to a DeFi security event, the similarity between the dialogue embedding vector output by the DeFi security event awareness model and the event description of the DeFi security event in the DeFi security event dataset obtained in step 1 is calculated. If the similarity is higher than the threshold, the DeFi security event is located.

Images