mempool-intrusion-detection-system

name	Mempool Intrusion Detection System
category	Web3 Data Intelligence
subcategory	Security Analysis
description	Real-time blockchain intrusion detection system that monitors mempool for exploit attempts and automatically executes defensive responses using ML classification and gas-optimized front-running
tags	["ids","intrusion-detection","mempool-monitoring","exploit-detection","machine-learning","automated-defense","front-running","security","real-time","websocket"]
difficulty	advanced
status	production
version	1.0.0
activation_triggers	["monitor mempool","detect blockchain exploits","intrusion detection","automated smart contract defense","front-run attacker","pause contract on threat","real-time threat detection"]
parameters	{"config":{"description":"IDS configuration with network endpoints, monitored contracts, and thresholds","required":true,"example":"IDSConfig(websocket_url='wss://...', monitored_contracts=[...])"},"operational_mode":{"description":"IDS mode (monitor_only, alert_only, active_defense)","required":true,"example":"IDSMode.ACTIVE_DEFENSE"},"classification_threshold":{"description":"Minimum confidence score for threat classification","required":false,"default":0.7},"threat_level_threshold":{"description":"Minimum threat level for automated defense","required":false,"default":"ThreatLevel.HIGH"}}
requirements	{"python":">=3.8","packages":["web3>=6.0.0","scikit-learn>=1.3.0","numpy>=1.24.0","aiohttp>=3.9.0","eth-account>=0.9.0"],"external":["Ethereum WebSocket endpoint","Ethereum RPC access (archive node recommended)","Defender account with pause permissions"]}

Mempool Intrusion Detection System

##Overview

Real-time blockchain intrusion detection system that monitors the Ethereum mempool for exploit attempts, analyzes transaction payloads using machine learning, and automatically executes defensive responses by front-running attackers with gas-optimized pause transactions.

Analysis Type: Real-Time Intrusion Detection + Automated Response
Approach: Signature-Based + ML Classification + Active Defense
Target: Ethereum & EVM-Compatible Chains
Status: Production Ready

Key Capabilities

1. Mempool Monitoring (mempool_monitor.py)

• ✅ WebSocket-based real-time transaction monitoring
• ✅ Automatic reconnection with exponential backoff
• ✅ Contract address filtering
• ✅ Transaction decoding and function identification
• ✅ Event-driven callback architecture
• ✅ Connection health monitoring

2. Payload Analysis (payload_analyzer.py)

• ✅ 22-dimensional feature extraction
• ✅ Function selector entropy calculation
• ✅ Parameter pattern detection (zero addresses, max values)
• ✅ Gas price anomaly detection
• ✅ Reentrancy pattern matching
• ✅ Flash loan signature detection
• ✅ Price manipulation pattern identification

3. ML Classification (exploit_classifier.py)

• ✅ Random Forest and Gradient Boosting models
• ✅ Confidence scoring and threat level classification
• ✅ Feature importance analysis
• ✅ Explainable predictions
• ✅ Threshold tuning for false positive control
• ✅ Synthetic training data generation

4. Automated Defense (defense_executor.py)

• ✅ Gas-optimized front-running strategy
• ✅ Automated pause contract transactions
• ✅ Dynamic gas price calculation (EIP-1559)
• ✅ Transaction confirmation monitoring
• ✅ Retry logic with escalating gas prices
• ✅ Multi-strategy defense support

5. IDS Engine (ids_engine.py)

• ✅ Real-time orchestration of all components
• ✅ Configurable operational modes (monitor/alert/active defense)
• ✅ Alert system with webhooks
• ✅ Comprehensive logging and statistics
• ✅ Detection export and reporting

Components