一句话：提出 GenDetect，将已观测 DeFi 攻击快速抽象为可泛化检测规则，遏制模仿式攻击级联。
论文关注 DeFi 中的“模仿式攻击级联”：首个攻击成功后，攻击者快速复用其逻辑并发起变体交易，现有反应式检测依赖人工验证告警，难以迅速生成规则。作者将问题拆为函数签名语义抽象与噪声/规避轨迹中的交易逻辑匹配，利用 DeFi 开源代码对函数签名进行高保真语义分类，并借助合约标签过滤无关调用、判定攻击意图。系统 GenDetect 能仅凭单个已观测攻击实例生成可泛化检测规则。评估达到 ACC 98%、FPR 1%、FNR 3%，并在过去三年发现 56 个此前未知攻击。
As blockchain ecosystems grow, financially motivated attackers increasingly exploit decentralized finance (DeFi) protocols, causing frequent and severe losses. Unlike conventional cyberattacks, DeFi exploits propagate rapidly due to the transparent and composable nature of smart contracts. We identify a critical pattern, Imitative Attack Cascade: an initial successful exploit is quickly followed by mimicking transactions that reuse attack logic with minor modifications or parameter changes. Our empirical analysis shows that over 69% of DeFi attacks exhibit strong behavioral similarity to earlier incidents, often within hours or days of the initial attack. This exposes a fundamental limitation in current reactive detection. Initial attacks are typically flagged via heuristic alerts (Tornado Cash traces, anomalous nonce usage, exploiter labels), but turning these signals into detection rules requires manual validation and handcrafted trace analysis -- a labor-intensive, slow process that leaves follow-up attacks to spread. Our goal is to ensure that once an attack has been observed, even a single instance, it can be rapidly abstracted into an actionable, generalizable detection rule. We decompose the problem into two challenges: (I) abstracting the semantics of diverse, obscure function signatures, and (II) matching transaction logic in noisy, evasive traces. We leverage two insights: (i) the open-source nature of most DeFi protocols enables high-fidelity semantic classification of function signatures; (ii) contract labels isolate essential logic by filtering irrelevant calls and classifying attack intent. Building on these, we develop GenDetect, which achieves ACC 98%, FPR 1%, FNR 3% and discovers 56 previously unrevealed attacks from the past three years. Source code and dataset: https://github.com/NobodyIsAnonymous/GenDetect_ICSE2026
@inproceedings{paperbot11919,
title = {GenDetect: Generalizing Reactive Detection for Resilience Against Imitative DeFi Attack Cascade},
author = {Bowen Cai and Weiheng Bai and Youshui Lu and Haoran Xu and Yuannan Yang and Yajin Zhou and Kangjie Lu},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3787799}
}