Ethereum smart contracts are programs that can be collectively executed by a network of mutually untrusted nodes. Smart contracts handle and transfer assets of values, offering strong incentives for malicious attacks. Intrusion attacks are a popular type of malicious attacks. In this article, we propose ContractGuard, the first intrusion detection system (IDS) to defend Ethereum smart contracts against such attacks. Like IDSs for conventional programs, ContractGuard detects intrusion attempts as abnormal control flow. However, existing IDS techniques/tools are inapplicable to Ethereum smart contracts due to Ethereum's decentralized nature and its highly restrictive execution environment. To address these issues, we design ContractGuard by embedding it in the contracts to profile context-tagged acyclic paths, and optimizing it under the Ethereum gas-oriented performance model. The main goal is to minimize the overheads, to which the users will be extremely sensitive since the cost needs to be paid upfront in digital concurrency. Empirical investigation using real-life contracts deployed in the Ethereum mainnet shows that on average, ContractGuard only adds to 36.14 percent of the deployment overhead and 28.27 percent of the runtime overhead. Furthermore, we conducted controlled experiments and show that ContractGuard successfully guard against attacks on all real-world vulnerabilities and 83 percent of the seeded vulnerabilities.

中文翻译：

---

ContractGuard：通过嵌入式入侵检测保护以太坊智能合约

以太坊智能合约是可以由相互不信任的节点网络共同执行的程序。智能合约处理和转移价值资产，为恶意攻击提供强大的激励。入侵攻击是一种流行的恶意攻击类型。在本文中，我们提出了 ContractGuard，这是第一个保护以太坊智能合约免受此类攻击的入侵检测系统 (IDS)。与传统程序的 IDS 一样，ContractGuard 将入侵尝试检测为异常控制流。然而，由于以太坊的去中心化性质及其高度限制的执行环境，现有的 IDS 技术/工具不适用于以太坊智能合约。为了解决这些问题，我们设计了 ContractGuard，将它嵌入到合约中来分析上下文标记的非循环路径，并在以太坊以gas为导向的性能模型下对其进行优化。主要目标是最大限度地减少开销，因为需要在数字并发中预先支付成本，因此用户将对这些开销非常敏感。使用部署在以太坊主网上的真实合约的实证调查表明，平均而言，ContractGuard 仅增加了 36.14% 的部署开销和 28.27% 的运行时开销。此外，我们进行了受控实验，结果表明 ContractGuard 成功防御了针对所有真实世界漏洞和 83% 的种子漏洞的攻击。使用部署在以太坊主网上的真实合约的实证调查表明，平均而言，ContractGuard 仅增加了 36.14% 的部署开销和 28.27% 的运行时开销。此外，我们进行了受控实验，结果表明 ContractGuard 成功防御了针对所有真实世界漏洞和 83% 的种子漏洞的攻击。使用部署在以太坊主网上的真实合约的实证调查表明，平均而言，ContractGuard 仅增加了 36.14% 的部署开销和 28.27% 的运行时开销。此外，我们进行了受控实验，结果表明 ContractGuard 成功防御了针对所有真实世界漏洞和 83% 的种子漏洞的攻击。