Blockchain Papers

Chiara Braghin, Giuseppe Del Castillo, Elvinia Riccobene, Simone Valentini

No abstract is available for this record.

Morena Barboni, Guglielmo De Angelis, Andrea Morichetta, Andrea Polini

Blockchain technology is increasingly adopted in scenarios requiring trust and data integrity. On the Ethereum blockchain, the proxy pattern has become increasingly popular because it allows smart contract code to evolve while preserving stored data. However, a key challenge remains ensuring that such upgrades do not introduce breaking changes or cause disruptions to other contracts and off-chain systems. In this article, we introduce Catana , a framework that leverages historical transactions for Capture-Replay testing of proxy-based Upgradeable Smart Contracts (USCs). Catana assesses the potential impact of an upgrade by comparing the outcomes of replayed transactions with those from the previous version deployed on the main network. Additionally, it extracts and decodes contract state variables, providing deeper insights into how code changes affect the contract state, and helping developers mitigate issues before deployment. Experiments demonstrate that analyzing storage data accounts for the majority (about 86.5%) of detected disruptive upgrades. We also evaluate different policies for building replay test suites from historical transactions. Results identify a strategy that maximizes effectiveness while requiring a small number of replay test executions. Even a test suite containing just one transaction per each invoked method achieved good effectiveness (about 60%) in detecting disruptive upgrades.

Stephan Rabanser, Ali Shahin Shamsabadi, Olive Franzese, Xiao Wang · 6 authors

Cautious predictions -- where a machine learning model abstains when uncertain -- are crucial for limiting harmful errors in safety-critical applications. In this work, we identify a novel threat: a dishonest institution can exploit these mechanisms to discriminate or unjustly deny services under the guise of uncertainty. We demonstrate the practicality of this threat by introducing an uncertainty-inducing attack called Mirage, which deliberately reduces confidence in targeted input regions, thereby covertly disadvantaging specific individuals. At the same time, Mirage maintains high predictive performance across all data points. To counter this threat, we propose Confidential Guardian, a framework that analyzes calibration metrics on a reference dataset to detect artificially suppressed confidence. Additionally, it employs zero-knowledge proofs of verified inference to ensure that reported confidence scores genuinely originate from the deployed model. This prevents the provider from fabricating arbitrary model confidence values while protecting the model's proprietary details. Our results confirm that Confidential Guardian effectively prevents the misuse of cautious predictions, providing verifiable assurances that abstention reflects genuine model uncertainty rather than malicious intent.

Jadyn Kimber, Enrico Branca, Andrei Natadze, Natalia Stakhanova

The increasing number of Ethereum scams is causing significant concern within the blockchain community, costing users millions of dollars annually. Yet, our understanding of how these scams operate remains limited. In this study, we present the first end-to-end analysis of crypto scams using a large set of malicious Ethereum accounts as a case study. We examine the tactics these scams employ on social media platforms to deceive users and convince them to transfer funds to malicious accounts. Our analysis explores the full life cycle of these scams, considering both their distribution through social media and their activity on the Ethereum blockchain. We identify several unique aspects of Ethereum phishing scams that have not been documented in prior literature and find that these scams generally persist significantly longer and result in greater financial losses compared to traditional phishing scams studied in earlier research.

Brian Seong, Paul Gebheim

Modern blockchain applications are often constrained by a trade-off between user experience and trust. Chainless Apps present a new paradigm of application architecture that separates execution, trust, bridging, and settlement into distinct compostable layers. This enables app-specific sequencing, verifiable off-chain computation, chain-agnostic asset and message routing via Agglayer, and finality on Ethereum - resulting in fast Web2-like UX with Web3-grade verifiability. Although consensus mechanisms have historically underpinned verifiable computation, the advent of zkVMs and decentralized validation services opens up new trust models for developers. Chainless Apps leverage this evolution to offer modular, scalable applications that maintain interoperability with the broader blockchain ecosystem while allowing domain-specific trade-offs.

Francesco Salzano, Cosmo Kevin Antenucci, Simone Scalabrino, Giovanni Rosa · 6 authors

Abstract The rapid adoption of blockchain technology highlighted the importance of ensuring the security of smart contracts due to their critical role in automated business logic execution on blockchain platforms. This paper provides an empirical evaluation of automated vulnerability analysis tools specifically designed for Solidity smart contracts. Leveraging the extensive SmartBugs 2.0 framework, which includes 20 analysis tools, we conducted a comprehensive assessment using an annotated dataset of 2,182 instances, manually labeled at the line level with vulnerability labels. Our evaluation highlights the detection effectiveness of these tools in detecting various types of vulnerabilities, as categorized by the DASP TOP 10 taxonomy. We evaluated the efficacy of a Large Language Model-based detection method on two popular datasets. In this case, we obtained inconsistent results with the two datasets, showing unreliable detection when analyzing real-world smart contracts. Our study identifies significant variations in the accuracy and reliability of different tools and demonstrates the advantages of combining multiple detection methods to improve vulnerability identification. We identified a set of 3 tools that, combined, achieve up to 76.78% found vulnerabilities, taking less than one minute to run, on average. This study contributes to the field by releasing the largest dataset of manually analyzed smart contracts with line-level vulnerability annotations and by conducting the largest empirical evaluation of tools to date.

Zhiyuan Wei, Jing Sun, Zijian Zhang, Zhé Hóu · 5 authors

Large Language Models (LLMs) have shown great promise in code analysis and auditing; however, they still struggle with hallucinations and limited context-aware reasoning. We introduce SmartAuditFlow, a novel Plan-Execute framework that enhances smart contract security analysis through dynamic audit planning and structured execution. Unlike conventional LLM-based auditing approaches that follow fixed workflows and predefined steps, SmartAuditFlow dynamically generates and refines audit plans based on the unique characteristics of each smart contract. It continuously adjusts its auditing strategy in response to intermediate LLM outputs and newly detected vulnerabilities, ensuring a more adaptive and precise security assessment. The framework then executes these plans step by step, applying a structured reasoning process to enhance vulnerability detection accuracy while minimizing hallucinations and false positives. To further improve audit precision, SmartAuditFlow integrates iterative prompt optimization and external knowledge sources, such as static analysis tools and Retrieval-Augmented Generation (RAG). This ensures audit decisions are contextually informed and backed by real-world security knowledge, producing comprehensive security reports. Extensive evaluations across multiple benchmarks demonstrate that SmartAuditFlow outperforms existing methods, achieving 100 percent accuracy on common and critical vulnerabilities, 41.2 percent accuracy for comprehensive coverage of known smart contract weaknesses in real-world projects, and successfully identifying all 13 tested CVEs. These results highlight SmartAuditFlow's scalability, cost-effectiveness, and superior adaptability over traditional static analysis tools and contemporary LLM-based approaches, establishing it as a robust solution for automated smart contract auditing.

S. M. Dilip Kumar, Namrta Tanwar, Namrta Tanwar, Aakarsh Chandna · 5 authors

The blockchain technology has disrupted the earlyage digital banking through concepts like bitcoin and ether [1,3].In this study, some major elements of the blockchain technology are examined-decentralized networks, smart contracts, cryptographic techniques, and consensus mechanisms of Proof of Work and Proof of Stake usage-and understanding how they contribute to safe, peer-to-peer transactions without intermediaries [2,5].Bitcoin can do no more than about seven transactions a second (TPS) is a very paltry competition of an impressive 30 to 40 TPS of Ethereum.This depicts the ongoing scalability challenges that need to be tackled by initiatives linked with Ethereum 2.0 and the Lightning Network [4,9].While most industries, apart from banking, have effectively made their blockchain applications and transparency useful-Supply Chain Management, Healthcare, and DeFi-currently poses challenges of transaction speed limitations, the vagueness of regulations, and energy consumption by mining [8].Emerging trends include Non-Fungible Tokens (NFTs), Central Bank Digital Currencies (CBDCs), and privacy enhanced through zero-knowledge proofs.There is hope for excellent feedback on the future of the blockchain from these and other initiatives yet to come into reality.

Sheng Zhang, Tan Kia Quang, Shen Wang, Shengchen Duan · 6 authors

Scam contracts on Ethereum have rapidly evolved alongside the rise of DeFi and NFT ecosystems, utilizing increasingly complex code obfuscation techniques to avoid early detection. This paper systematically investigates how obfuscation amplifies the financial risks of fraudulent contracts and undermines existing auditing tools. We propose a transfer-centric obfuscation taxonomy, distilling seven key features, and introduce ObfProbe, a framework that performs bytecode-level smart contract analysis to uncover obfuscation techniques and quantify obfuscation complexity via Z-score ranking. In a large-scale study of 1.03 million Ethereum contracts, we isolate over 3 000 highly obfuscated contracts and identify two scam archetypes, three high-risk contract categories, and MEV bots that employ a variety of obfuscation maneuvers such as inline assembly, dead code insertion, and deep function splitting. We further show that obfuscation substantially increases both the scale of financial damage and the time until detection. Finally, we evaluate SourceP, a state-of-the-art Ponzi detection tool, on obfuscated versus non-obfuscated samples and observe its accuracy drop from approximately 80 percent to approximately 12 percent in real-world scenarios. These findings highlight the urgent need for enhanced anti-obfuscation analysis techniques and broader community collaboration to stem the proliferation of scam contracts in the expanding DeFi ecosystem.

Marco A. C. da Silva, Luis Hideo Vasconcelos Nakamura, Geraldo P. Rocha Filho, Luís Veiga · 5 authors

With the advancement of technologies for data registration in distributed networks, the concern of users and developers of computerized solutions with the privacy of sensitive data has increased. Thus, this work addresses a conceptual solution for an ontology-based framework so that any entity willing to provide a service using Distributed Ledger Technology (DLT) networks can model the set of privacy attributes of its system according to the business rules of its service. The solution proposed in this work encompasses the development of an architecture aimed at providing computational support for the privacy design of the actors involved in the offering and consumption of services implemented in DLTs. The architecture also includes a framework called ONSPRIDE, which uses previously stored domain ontologies to translate business rules into requirements and privacy. We conducted a proof of context by comparing the performance of two Hyperledger Fabric networks. For this purpose, we conducted a controlled experiment in which both networks operate a smart contract that manages attendance records for outdoor events. The main difference between the networks is that one uses a Certificate Authority (CA) to issue access certificates, while the other issues certificates manually. We compared the results obtained through the reports generated by the Hyperledger Caliper tool. In addition, the performance of the initialization and connection of agents in a Self-Sovereign Identity system was measured. The results of this study provide valuable insight that can help developers choose the most suitable ledger type for their Hyperledger projects and support decision-making regarding adopting a Self-Sovereign Identity system.

Rami Almatarneh, Mohammad Aljaidi, Ayoub Alsarhan, Sami Aziz Alshammari · 6 authors

The rapid evolution of Web 4.0, characterized by decentralized systems, real-time data processing, and AI-driven interfaces, presents serious security threats such as SQL injection (SQLi) attacks, adversarial model poisoning, and IoT device spoofing. This paper presents a unified AI-blockchain framework designed to address these vulnerabilities, incorporating bidirectional LSTM networks for SQLi detection, Trimmed Mean aggregation with a reputation system for model poisoning defense, and CNN-based IoT authentication anchored to a decentralized blockchain. Evaluated on the Bitcoin OTC trust network, the framework clearly shows outstanding performance, with SQLi detection achieving 96.2% accuracy (94.8% precision and 92.5% recall), far outperforming traditional rule-based systems such as Snort (82.1% accuracy). The success rate of model poisoning attacks is reduced from 78% (in the absence of defense) to just 12% through the application of Trimmed Mean aggregation and dynamic reputation scoring, while IoT spoofing detection attains a 91.3% F1-score through cosine similarity-based matching of network traffic embeddings. The blockchain layer, which uses Delegated Proof-of-Stake (DPoS) consensus, achieves 1,450 transactions per second (TPS) with a validation latency of only 220 milliseconds, ensuring efficient real-time auditability. Furthermore, user trust scores increased by 48% after implementation (4.3/5 vs. 2.9/5 before implementation), confirming the framework's practical impact. Nevertheless, some limitations still persist, such as the 15% latency overhead due to federated learning and the use of synthetic IoT data, which may limit or reduce the framework's real-world applicability. The proposed combination of AI-based adaptive threat detection and blockchain-based tamper-proof transparency will pave the way for secure, user-focused architectures in Web 4.0, providing a scalable framework to address the evolving cyber threats in decentralized environments.

Rathin Chandra Shit, Sharmila Subudhi

Autonomous Vehicles (AV) proliferation brings important and pressing security and reliability issues that must be dealt with to guarantee public safety and help their widespread adoption. The contribution of the proposed research is towards achieving more secure, reliable, and trustworthy autonomous transportation system by providing more capabilities for anomaly detection, data provenance, and real-time response in safety critical AV deployments. In this research, we develop a new framework that combines the power of Artificial Intelligence (AI) for real-time anomaly detection with blockchain technology to detect and prevent any malicious activity including sensor failures in AVs. Through Long Short-Term Memory (LSTM) networks, our approach continually monitors associated multi-sensor data streams to detect anomalous patterns that may represent cyberattacks as well as hardware malfunctions. Further, this framework employs a decentralized platform for securely storing sensor data and anomaly alerts in a blockchain ledger for data incorruptibility and authenticity, while offering transparent forensic features. Moreover, immediate automated response mechanisms are deployed using smart contracts when anomalies are found. This makes the AV system more resilient to attacks from both cyberspace and hardware component failure. Besides, we identify potential challenges of scalability in handling high frequency sensor data, computational constraint in resource constrained environment, and of distributed data storage in terms of privacy.

Iuon‐Chang Lin, Jyun-Yan Ruan, Ching-Chun Chang, Chin‐Chen Chang · 7 authors

In response to the Cybersecurity Law, organizations face numerous management and technical requirements. Detection techniques such as vulnerability scanning and penetration testing are employed to identify risks. Addressing these vulnerabilities demands substantial manpower, time, and financial resources. Security concerns also arise during digital file transmission and remediation efforts. This study proposes a security detection platform with step-by-step implementation guidelines, enabling resource-limited units to replicate the setup and address security gaps. It compares detection results between open-source and commercial tools, highlighting key differences and offering remediation strategies. Numerous digital files (e.g., test reports) are generated during testing. To ensure secure storage and sharing, the system integrates IOTA’s distributed ledger and IPFS, generating HASH values and uploading files on-chain to preserve integrity and authenticity. The objective is to deliver a scalable, cost-effective security detection framework that enhances system resilience while minimizing resource consumption.

Punam Bedi, Vinita Jindal, Ningyao Ningshen, Pushkar Gole

Smart contracts represent a predefined set of rules invoked when specific conditions are met within blockchain networks, eliminating the need for centralized authority to validate transactions. The absence of central authority can potentially expose smart contracts to fraudulent behavior. Moreover, implementation flaws in smart contracts can be exploited to cause unintended behavior, resulting in security or financial risks. Traditionally, the identification of vulnerabilities in smart contracts has relied on methods such as pattern matching, data flow analysis, and input testing. While these techniques are foundational, they are constrained by human limitations and may not comprehensively address the full spectrum of potential issues. This necessitates more advanced approaches to ensure robust security and reliability. Therefore, in the literature, numerous researchers have leveraged different Machine Learning (ML) and Deep Learning (DL) techniques to classify normal and malicious smart contracts. However, existing literature either grapples with class imbalance issues or relies on conventional methods. Moreover, existing research often falls short of locating the exact location of malicious code within the smart contracts. Therefore, to address these gaps, this paper proposes a novel model called the Dual-Branch Encoder Siamese Network (DBESN) for detecting malicious smart contracts. Furthermore, this model is extended to precisely identify the region of the vulnerable code fragment within the smart contract using the Local Interpretable Model-Agnostic Explanations (LIME) algorithm. Experimental results demonstrated a performance Accuracy of 98.62% and 99.30% F1-Score with an inference time of 0.296 seconds. Given the high performance coupled with the low inference time of the proposed DBESN model, it is suitable for deployment within blockchain networks to detect and identify malicious smart contracts effectively and efficiently.

Komal Kajla

1. Abstract The abstract introduces the growing issue of counterfeit products affecting global supply chains and consumer safety. It states that traditional methods—like barcodes, holograms, and watermarks—are increasingly ineffective due to technological advancements in forgery. To address this, the paper proposes a hybrid authentication framework combining the security of blockchain with the convenience and accessibility of QR codes (smart codes). It summarizes the methodology, highlights real-world examples, and touches on the system’s benefits, including enhanced traceability, consumer trust, and tamper-resistance. The abstract concludes by noting the paper’s focus on methodology, performance evaluation, future scope, and supporting case studies.

Flavio Bertini, Alessandro Benetton, Danilo Montesi

Information disorder has become a major societal challenge, impacting public discourse and democracy. This phenomenon has been exacerbated by the spread of social media platforms, affecting various areas, ranging from national elections to public health. Addressing fake news through a manual approach (e.g., human fact-checking) is unfeasible due to the rapid production of textual content. At the same time, applying automatic tools is equally challenging, primarily due to the ambiguity of natural language. In this paper, we addressed online information disorder from a different perspective by proposing a platform that supports trustworthy and reputable news producers and enhances awareness among readers across various social media. Specifically, the proposed platform enables news producers to automatically embed a unique watermark in the text they create, ensuring that the news cannot be manipulated or misattributed. The watermarking is embedded in a fine-grained way, allowing even small extracts of the news to be shared while preserving traceability. Additionally, the association between the watermark and the news item is recorded in a distributed ledger, preventing further manipulation that could arise from centralised management. The aim is to enable readers to make more informed decisions about the content they encounter, even when engaging with excerpts of the original document, minimising reliance on external fact-checking organisations.

Dileep Kumar Murala, Samia Loucif, Kanishka Rao, Habib Hamam

Smart contracts are changing many business areas with blockchain technology, but they still have vulnerabilities that can cause major financial losses. Because deployed smart contracts (SCs) are irreversible once deployed, fixing these vulnerabilities before deployment is critical. This research introduces a new method that combines code embedding with Generative Adversarial Networks (GANs) to find integer overflow vulnerabilities in smart contracts. Using Abstract Syntax Trees, we can vectorize the source code of smart contracts while keeping all of the important contract characteristics and going beyond what can be achieved with conventional textual or structural analysis. Synthesizing contract vector data using GANs alleviates data scarcity and facilitates source code acquisition for training our detection system. The proposed method is very good at finding vulnerabilities because it uses both GAN discriminator feedback and vector similarity measures based on cosine and correlation coefficients. Experimental results show that our GAN-based proactive analysis method achieves up to 18.1% improvement in accuracy over baseline tools such as Oyente and sFuzz.

Luca Ruschioni, Robert Shuttleworth, Rumyana Neykova, Barbara Re · 5 authors

Solidity is the predominant programming language for blockchain-based smart contracts, and its characteristics pose significant challenges for code analysis and maintenance. Traditional software analysis approaches, while effective for conventional programming languages, often fail to address Solidity-specific features such as gas optimization and security constraints. This paper introduces micro-patterns - recurring, small-scale design structures that capture key behavioral and structural peculiarities specific to a language - for Solidity language and demonstrates their value in understanding smart contract development practices. We identified 18 distinct micro-patterns organized in five categories (Security, Functional, Optimization, Interaction, and Feedback), detailing their characteristics to enable automated detection. To validate this proposal, we analyzed a dataset of 23258 smart contracts from five popular blockchains (Ethereum, Polygon, Arbitrum, Fantom and Optimism). Our analysis reveals widespread adoption of micro-patterns, with 99% of contracts implementing at least one pattern and an average of 2.76 patterns per contract. The Storage Saver pattern showed the highest adoption (84.62% mean coverage), while security patterns demonstrated platform-specific adoption rates. Statistical analysis revealed significant platform-specific differences in pattern adoption, particularly in Borrower, Implementer, and Storage Optimization patterns.

Verena Lengston

Blockchain technology, with its inherent security, transparency, and immutability, presents a novel approach to addressing critical challenges in public health. This paper explores the potential of blockchain to revolutionize data management, enhance disease surveillance, and empower communities in public health initiatives. We examine how blockchain can secure sensitive health data, facilitate interoperability among disparate systems, and enable decentralized data sharing for research and interventions. Furthermore, we discuss the applications of blockchain in supply chain management for pharmaceuticals, vaccine distribution, and the creation of secure digital identities for individuals. By leveraging blockchain's distributed ledger technology, we can foster trust, improve data integrity, and promote community engagement in public health, ultimately leading to more effective and equitable health outcomes.

Farida Eleshin, Qi Sun, Mengzhe Ye, Sauvik Das · 5 authors

No abstract is available for this record.

Ahod Alghuried, Ali Alkinoon, Abdulaziz Alghamdi, Soohyeon Choi · 6 authors

This paper explores the vulnerability of machine learning models to simple single-feature adversarial attacks in the context of Ethereum fraudulent transaction detection. Through comprehensive experimentation, we investigate the impact of various adversarial attack strategies on model performance metrics. Our findings, highlighting how prone those techniques are to simple attacks, are alarming, and the inconsistency in the attacks' effect on different algorithms promises ways for attack mitigation. We examine the effectiveness of different mitigation strategies, including adversarial training and enhanced feature selection, in enhancing model robustness and show their effectiveness.

Gerardo Iuliano, Luigi Allocca, Matteo Cicalese, Dario Di Nucci

The security of smart contracts is critical in blockchain systems, where even minor vulnerabilities can lead to substantial financial losses. Researchers proposed several vulnerability detection tools evaluated using existing benchmarks. However, most benchmarks are outdated and focus on a narrow set of vulnerabilities. This work evaluates whether mutation seeding can effectively inject vulnerabilities into Solidity-based smart contracts and whether state-of-the-art static analysis tools can detect the injected flaws. We aim to automatically inject vulnerabilities into smart contracts to generate large and wide benchmarks. We propose MuSe, a tool to generate vulnerable smart contracts by leveraging pattern-based mutation operators to inject six vulnerability types into real-world smart contracts. We analyzed these vulnerable smart contracts using Slither, a static analysis tool, to determine its capacity to identify them and assess their validity. The results show that each vulnerability has a different injection rate. Not all smart contracts can exhibit some vulnerabilities because they lack the prerequisites for injection. Furthermore, static analysis tools fail to detect all vulnerabilities injected using pattern-based mutations, underscoring the need for enhancements in static analyzers and demonstrating that benchmarks generated by mutation seeding tools can improve the evaluation of detection tools.

Jianwei Huang, Sridatta Raghavendra Chintapalli, Mengxiao Wang, Guofei Gu

In recent years, the Ethereum Name Service (ENS) has garnered significant attention within the community for enabling the use of Unicode in domain names, thereby facilitating the inclusion of a wide array of character sets such as Greek, Cyrillic, Arabic, and Chinese. While this feature enhances the versatility and global accessibility of domain names, it concurrently introduces a substantial security vulnerability due to the presence of homoglyphs-characters that are visually similar to others across Unicode and ASCII sets. These similarities can be exploited in homoglyph attacks, posing a distinct threat to domain name integrity. Despite community efforts to counteract this issue through a normalization process prior to domain resolution, our analysis uncovers significant discrepancies in how the normalization processes are applied across various applications. This inconsistency could result in the same domain name being resolved to different addresses in different applications, underscoring a critical vulnerability. We also discovered the new attack scenario in ENS which may cause legitimate domains resolved into malicious addresses even when they are verified by authorities. To systematically evaluate this inconsistency, we designed a tool for detecting application-level discrepancies in domain normalization process without requiring access to the application's source code. Our evaluation on hundreds of real-world Web3 applications identifies widespread deviations from established homoglyph mitigation practices, with more than 60% digital wallets and 80% dApps (decentralized applications) not able to produce consistent ENS resolving results, potentially impacting millions of users. This analysis underscores the urgent need for a standardized implementation of normalization processes to safeguard the integrity and security of ENS domains.

Xinyao Xu, Ziyu Mao, Jianzhong Su, Xingwei Lin · 7 authors

The rapid growth of decentralized applications, while revolutionizing financial transactions, has created an attractive target for malicious attacks.Existing approaches to detecting attacks often rely on predefined rules or simplistic and overly-specialized models, which lack the flexibility to handle the wide spectrum of diverse and dynamically changing attack types.To address this challenge, we present a general and extensible framework, MoE (Monitoring Ethereum), that leverages runtime verification to detect a wide range of attacks on Ethereum.MoE features an expressive attack modeling language, based on Metric First-order Temporal Logic (MFOTL), that can formalize a wide range of attacks.We integrate a novel semantic lifting approach that extracts system behaviors relevant for various attacks, which can be analyzed using the monitoring tool MonPoly.Furthermore, we also equip MoE with quantitative capabilities to evaluate the similarity between a transaction and an attack formula to enhance its performance in identifying attacks, including near-miss attacks.We carry out extensive experiments with MoE on a labeled benchmark and a large-scale dataset containing over one million transactions.On the labeled benchmark, MoE successfully detects 92.0% attacks and achieves a 45.0% higher recall rate than competing state-of-the-art tool.MoE finds 3,319 attacks with 95.4% precision on the large dataset.Furthermore, MoE uses quantitative analysis to uncover 8% additional attacks.Finally, the average time for * Xinyao Xu and Ziyu Mao contributed equally.