Scalable Blockchain Anomaly Detection with Sketches

The growing popularity of Blockchain networks attracts also malicious and hacking users. Effectively detecting inappropriate and malicious activity should thus be a top priority for safeguarding blockchain networks and services. Blockchain behavior analysis can be used to detect unusual account activities or time periods with network-wide irregular properties. Thus, optimized anomaly detection based on historical data is an essential task for securing transactions and services. However, processing the complete blockchain history can be slow and costly due to its large size and rapid growth. In this paper we suggest addressing this challenge by analyzing summarized blocks data structures, called sketches, rather than the entire blockchain. Sketches are common data structures used in computer systems and blockchain networks, to allow compact data representation while supporting efficient executions of particular queries. We study how sketches can be used to detect suspicious accounts or time periods without the need to maintain or go through the entire blockchain data. We design solutions for the major known attacks and conduct experiments to evaluate them based on real Ethereum data. We compare the accuracy, run-time and memory usage of our algorithms with traditional detection algorithms relying on the complete blockchain data. Our results indicate that sketch-based anomaly detection methods can provide a practical scalable solution for detecting anomalies in blockchain networks.