This paper presents a dynamic, real-time approach to detecting anomalous blockchain transactions. The proposed tool, BlockGPT, generates tracing representations of blockchain activity and trains from scratch a large language model to act as a real-time Intrusion Detection System. Unlike traditional methods, BlockGPT is designed to offer an unrestricted search space and does not rely on predefined rules or patterns, enabling it to detect a broader range of anomalies. We demonstrate the effectiveness of BlockGPT through its use as an anomaly detection tool for Ethereum transactions. In our experiments, it effectively identifies abnormal transactions among a dataset of 68M transactions and has a batched throughput of 2284 transactions per second on average. Our results show that, BlockGPT identifies abnormal transactions by ranking 49 out of 124 attacks among the top-3 most abnormal transactions interacting with their victim contracts. This work makes contributions to the field of blockchain transaction analysis by introducing a custom data encoding compatible with the transformer architecture, a domain-specific tokenization technique, and a tree encoding method specifically crafted for the Ethereum Virtual Machine (EVM) trace representation.

翻译：本文提出了一种动态、实时的异常区块链交易检测方法。所提出的工具 BlockGPT 可生成区块链活动的追踪表示，并从头训练一个大语言模型，使其充当实时入侵检测系统。与传统方法不同，BlockGPT 旨在提供无限制的搜索空间，且不依赖预定义的规则或模式，从而能够检测更广泛的异常。我们通过将 BlockGPT 作为以太坊交易的异常检测工具来证明其有效性。在实验中，它在包含 6800 万笔交易的数据集中有效识别出异常交易，平均批量处理吞吐量达每秒 2284 笔交易。我们的结果表明，在与其受害者合约交互的 124 次攻击中，BlockGPT 将其中的 49 次攻击排在异常程度最高的前三位，从而识别出异常交易。本工作通过引入一种与 Transformer 架构兼容的自定义数据编码、一种面向特定领域的分词技术，以及一种专为以太坊虚拟机（EVM）追踪表示设计的树编码方法，为区块链交易分析领域做出了贡献。