Adaptive Detection of DeFi SLID Scams: A Data-Driven and Industry-Oriented Framework for Large-Scale DeFi Security

Abstract

Slow Liquidity Drain (SLID) scams have recently emerged as a subtle and persistent threat within the decentralized finance (DeFi) environment. While prior studies have introduced heuristic and machine learning techniques for identifying SLID behaviors, deploying these methods in real-world industrial systems reveals substantial challenges. In particular, updated large-scale datasets collected from operational DeFi platforms show that SLID behaviors and their effective detection time-range evolve over time, rendering previously reported fixed thresholds unreliable for production use. This work presents a data-driven reassessment of SLID detection under contemporary DeFi conditions and demonstrates that the observation window required for reliable detection shifts as new data and new scam behaviors emerge. Building on these findings, we introduce an industry-oriented detection framework that decouples machine learning models from time-range selection and supports adaptive operation without retraining or feature redesign. Rather than proposing a single deployment strategy, we outline two practical operating modes: a slow-adaptive mode that prioritizes stability and auditability through periodic window updates, and a fast-adaptive mode that enables flexible sensitivity and tiered alerts for security-driven environments. Together, these designs translate empirical insights into concrete system architectures suitable for large-scale DeFi monitoring, bridging the gap between academic SLID detection research and production deployment requirements.