This paper presents a dynamic, real-time approach to detecting anomalous blockchain transactions. The proposed tool, TXRANK, generates tracing representations of blockchain activity and trains from scratch a large language model to act as a real-time Intrusion Detection System. Unlike traditional methods, TXRANK is designed to offer an unrestricted search space and does not rely on predefined rules or patterns, enabling it to detect a broader range of anomalies. We demonstrate the effectiveness of TXRANK through its use as an anomaly detection tool for Ethereum transactions. In our experiments, it effectively identifies abnormal transactions among a dataset of 68M transactions and has a batched throughput of 2284 transactions per second on average. Our results show that, TXRANK identifies abnormal transactions by ranking 49 out of 124 attacks among the top-3 most abnormal transactions interacting with their victim contracts. This work makes contributions to the field of blockchain transaction analysis by introducing a custom data encoding compatible with the transformer architecture, a domain-specific tokenization technique, and a tree encoding method specifically crafted for the Ethereum Virtual Machine (EVM) trace representation.

翻译：本文提出了一种动态、实时的异常区块链交易检测方法。所提出的工具TXRANK生成区块链活动的追踪表示，并从头训练一个大型语言模型作为实时入侵检测系统。与传统方法不同，TXRANK旨在提供无限制的搜索空间，不依赖预定义规则或模式，从而能够检测更广泛的异常行为。我们通过将TXRANK作为以太坊交易的异常检测工具来展示其有效性。在实验中，它能在6800万条交易数据集中有效识别异常交易，平均批处理吞吐量达每秒2284笔交易。结果表明，TXRANK通过将124起攻击中的49起排名为与其受害者合约交互的前三名最异常交易，有效识别异常交易。本工作通过引入与Transformer架构兼容的自定义数据编码、领域特定的分词技术以及专为以太坊虚拟机（EVM）追踪表示设计的树编码方法，为区块链交易分析领域做出了贡献。