HOUSTON: Real-Time Anomaly Detection of Attacks against Ethereum DeFi Protocols

HOUSTON: Real-Time Anomaly Detection of Attacks against Ethereum DeFi Protocols

Speakers: Dongyu Meng

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=r6jLClYF_OI

Overview

With the DeFi ecosystem holding roughly $100 billion in total value locked and billions stolen annually through protocol hacks -- including by state-sponsored groups -- the need for real-time attack detection has never been more urgent. This talk introduces HOUSTON, an anomaly detection system that learns per-protocol behavior specifications directly from transaction traces and flags deviations in real time. Evaluated against 115 real-world Ethereum attack incidents from 2020 to 2024, HOUSTON achieved a 94.8% true positive rate with only a 16% false positive rate (approximately 0.4 false positives per protocol per day), outperforming all compared state-of-the-art systems.

The core insight is that transaction anomaly should be judged only in the context of the specific protocol being protected, not against global heuristics or predefined attack patterns. This makes HOUSTON attack-type agnostic -- it can detect novel vulnerability classes that pre-deployment auditing missed, serving as a critical second line of defense after auditing.

Background

▶ Watch: DeFi attack landscape: billions stolen annually, state-sponsored groups (0:00)

DeFi protocols are built as groups of smart contracts that work together to provide financial services on blockchains. Some contracts directly hold user assets, sometimes in enormous amounts, making them lucrative targets. The industry standard defense is pre-deployment auditing -- manual review, automated fuzzing, and increasingly LLM-assisted analysis. However, auditing has inherent limitations: time constraints, system complexity, version mismatches between audited and deployed code, and the constant emergence of new vulnerability types mean that many major hacks occur on protocols that were previously audited.

Current monitoring approaches rely on delayed or fragmented signals: social media calls (watching for attack reports on Twitter), address reputation heuristics, or vulnerability-specific patterns that only detect known attack types. These approaches are either too slow, too narrow, or both. One unique advantage of blockchain monitoring is that transactions can sometimes be observed while still pending in the mempool before execution. If a malicious transaction can be identified at this stage, it can potentially be front-run or blocked before it is included in the blockchain.

Key Findings

▶ Watch: Pending mempool transactions: detecting attacks before execution (4:00)

HOUSTON's evaluation on 115 real-world attack incidents spanning 2020-2024 demonstrated:

High Detection Rate: A 94.8% true positive rate across a wide range of vulnerability types, from reentrancy to flash loan exploits to logic bugs in reward calculations.

Low Noise: A 16% false positive rate, corresponding to approximately 0.4 false positives per protocol per day -- low enough that operators will not develop alert fatigue and ignore the system.

Real-Time Performance: All transactions completed end-to-end detection within a single block interval, making it viable for mempool-based preemptive defense.

Live Deployment: HOUSTON was deployed on live Ethereum traffic for 40 days, monitoring 20 protocols. No attacks occurred during this period (confirmed independently), and the live false positive rate was even lower than the benchmark evaluation.

Attack-Type Agnostic: Unlike pattern-based detectors tied to specific vulnerability classes, HOUSTON's behavioral specification approach detects any transaction that deviates from learned normal behavior, regardless of the attack technique used.

Technical Deep Dive

▶ Watch: Euler protocol attack: 150 calls normalized to 8 interaction steps (8:00)

HOUSTON uses two complementary models to capture control flow and data flow properties:

Interaction Model (Control Flow): A protocol-specific heuristic normalization function compresses complex call traces into compact sequences by focusing on externally initiated state-changing interactions and removing low-level noise. For example, the Euler protocol attack transaction contained over 150 function calls, but after normalization, it reduced to just 8 high-level interaction steps that aligned almost perfectly with the attack write-up. Because normalization aggressively shrinks the behavioral space, anomaly detection becomes straightforward: any new (never-before-seen) sequence is flagged as anomalous. The Euler attack produced a sequence HOUSTON had never seen, correctly triggering an alert.

Invariant Model (Data Flow): This model captures likely invariants -- relationships between variables that consistently hold across all observed executions. These are dynamically inferred from transaction values, not manually written rules. For example, HOUSTON might observe that a state variable x has never been smaller than a function argument y at the exit of function f. An incremental invariant miner updates these relationships as new transactions arrive. When a transaction violates an established invariant, an alert is triggered.

The Cover protocol incident illustrates this: HOUSTON had mined an invariant for the mint function where the amount parameter was always less than the totalSupply state variable at function entry. The attack exploited a logic bug in reward calculation to mint an absurd number of tokens, violating this invariant and correctly triggering an alert.

HOUSTON's behavioral specification continuously evolves: benign transactions reinforce the specification, confirmed false positives refine it, and the models adapt as the protocol's usage patterns change over time.

Demo / Proof of Concept

▶ Watch: Invariant model: detecting Cover protocol mint exploit (10:00)

The researchers demonstrated HOUSTON's detection capabilities against two notable real-world DeFi incidents:

Euler Protocol Attack: A complex transaction with over 150 function calls was normalized to 8 high-level interaction steps. The normalized sequence had never appeared in Euler's behavioral history, immediately flagging the transaction. The 8 steps aligned with the publicly documented attack methodology.

Cover Protocol Attack: HOUSTON's invariant miner had established that the amount parameter in the mint function was always less than totalSupply. When the attack exploited a reward calculation bug to mint far more tokens than the total supply, this invariant was violated and the attack was correctly detected.

The live 40-day deployment on 20 Ethereum protocols further validated the system's practicality, showing stable performance and low false positive rates in production conditions.

Defensive Implications

▶ Watch: Q&A: Private mempool attacks and Flashbots integration (16:00)

HOUSTON represents a paradigm shift from reactive, pattern-based DeFi monitoring to proactive, behavioral anomaly detection. For DeFi protocol teams, the implications are significant:

Second Line of Defense: HOUSTON explicitly fills the gap left by pre-deployment auditing. Given that many major hacks occur on audited protocols, having a runtime behavioral monitor that can detect unknown vulnerability exploitation is essential.

Mempool-Based Preemption: When malicious transactions are visible in the public mempool, HOUSTON's real-time detection enables front-running or protocol pausing before the attack executes. However, as noted in the Q&A, private mempool transactions (sent through services like Flashbots) bypass this capability. The researchers noted they are in discussions with batching service providers about integrating HOUSTON's detection capabilities.

Operational Viability: The 0.4 false positives per protocol per day rate makes HOUSTON practical for production deployment without overwhelming security teams. This contrasts sharply with systems that generate dozens of alerts daily, leading to alert fatigue.

Limitations: HOUSTON cannot detect attacks where stolen credentials allow an attacker to perform actions that are behaviorally identical to legitimate administrator operations. The system detects behavioral anomalies, not authorization anomalies. Protocol teams should pair HOUSTON with key management best practices and multi-sig requirements.

Key Takeaways

• HOUSTON achieves 94.8% true positive rate and 0.4 false positives per protocol per day on 115 real-world Ethereum attack incidents spanning 2020-2024
• Per-protocol behavioral specification learned from transaction traces enables attack-type agnostic detection without predefined vulnerability patterns
• Heuristic normalization compresses complex call traces (150+ function calls) to compact sequences (8 steps), making control flow anomaly detection straightforward
• Likely invariant mining on data flow properties catches logic bugs like the Cover protocol's reward calculation exploit
• Real-time detection within a single block interval enables mempool-based preemptive defense through front-running or protocol pausing
• 40-day live deployment on 20 Ethereum protocols confirmed practical viability with low overhead and stable false positive rates

About the Speaker(s)

Dongyu Meng (presenting as Tong) is a researcher from the UCSB SecLab (UC Santa Barbara Security Lab). The team specializes in blockchain security and smart contract analysis, with this work representing a production-oriented approach to DeFi protocol protection that bridges academic anomaly detection research with real-world deployment requirements.