Teams ship detection rules constantly, but few can answer whether an alert will fire before funds leave the system. This talk breaks down a simulation framework built to test candidate detection rules against a dataset of 46 historical exploit events using archive-node state-forking.
The session explores:
Rebuilding incidents block-by-block to evaluate detector precision and recall.
Establishing empirical detection deadlines based on observed exfiltration curves instead of arbitrary SLAs.
Managing false-positive budgets when automated remediation requires irreversible protocol pauses.
Addressing detection blind spots caused by zero-visibility private mempools.
While tested on blockchain datasets where ground truth is public, the simulation methodology, metric frameworks, and open-source harness apply directly to any real-time threat detection, telemetry, and automated alerting system.
About the Presenter: Aleksander Kryukov
Aleksander Kryukov is a Web3 Security Engineer with experience auditing and formally verifying smart contract systems for projects including Maker (Sky), Coinbase, and Balancer. His work focuses on real-time threat detection, transaction replay mechanics, and system simulation on archive-node data. He has contributed to core modules of OpenZeppelin's Solidity library and works on building open-source detection and testing tooling to bridge offline security evaluation with automated incident response.
