《天生杀人狂》与DeFi掠夺：杀戮作为闪电贷攻击

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface IUniswapV2Pair {
    function swap(uint amount0Out, uint amount1Out, address to, bytes calldata data) external;
    function getReserves() external view returns (uint112 reserve0, uint112 reserve1, uint32 blockTimestampLast);
}

interface IERC20 {
    function balanceOf(address account) external view returns (uint256);
    function transfer(address recipient, uint256 amount) external returns (bool);
    function approve(address spender, uint256 amount) external returns (bool);
}

contract FlashLoanAttack {
    struct AttackPlan {
        address targetPair;
        address victimToken;
        uint256 borrowAmount;
        uint256 expectedProfit;
        uint256 deadline;
        bool executed;
    }
    
    AttackPlan public currentPlan;
    address public owner;
    uint256 public constant FLASH_LOAN_FEE = 30; // 0.3%
    
    event AttackExecuted(address indexed target, uint256 profit);
    event AttackFailed(address indexed target, string reason);
    
    modifier onlyOwner() {
        require(msg.sender == owner, "Not owner");
        _;
    }
    
    constructor() {
        owner = msg.sender;
    }
    
    function planAttack(
        address _targetPair,
        address _victimToken,
        uint256 _borrowAmount,
        uint256 _expectedProfit
    ) external onlyOwner {
        currentPlan = AttackPlan({
            targetPair: _targetPair,
            victimToken: _victimToken,
            borrowAmount: _borrowAmount,
            expectedProfit: _expectedProfit,
            deadline: block.timestamp + 1 hours,
            executed: false
        });
    }
    
    function executeAttack() external onlyOwner {
        require(!currentPlan.executed, "Already executed");
        require(block.timestamp < currentPlan.deadline, "Plan expired");
        
        IUniswapV2Pair pair = IUniswapV2Pair(currentPlan.targetPair);
        (uint112 reserve0, uint112 reserve1, ) = pair.getReserves();
        
        // 计算攻击参数
        uint256 amount0Out = currentPlan.borrowAmount;
        uint256 amount1Out = 0;
        
        bytes memory data = abi.encode(
            msg.sender,
            currentPlan.victimToken,
            currentPlan.expectedProfit
        );
        
        // 发起闪电贷（这就是"扣动扳机"）
        pair.swap(amount0Out, amount1Out, address(this), data);
    }
    
    function uniswapV2Call(
        address _sender,
        uint256 _amount0,
        uint256 _amount1,
        bytes calldata _data
    ) external {
        require(msg.sender == currentPlan.targetPair, "Unauthorized");
        require(_sender == address(this), "Not called by us");
        
        (address attacker, address victimToken, uint256 expectedProfit) = 
            abi.decode(_data, (address, address, uint256));
        
        // 攻击逻辑：操纵价格
        _manipulatePrice(victimToken, expectedProfit);
        
        // 计算需要偿还的金额
        uint256 fee = (_amount0 * FLASH_LOAN_FEE) / 10000;
        uint256 repayAmount = _amount0 + fee;
        
        // 偿还闪电贷
        IERC20 victimTokenContract = IERC20(victimToken);
        require(
            victimTokenContract.transfer(msg.sender, repayAmount),
            "Repay failed"
        );
        
        // 转移利润
        uint256 profit = victimTokenContract.balanceOf(address(this));
        if (profit > 0) {
            victimTokenContract.transfer(attacker, profit);
            currentPlan.executed = true;
            emit AttackExecuted(address(this), profit);
        }
    }
    
    function _manipulatePrice(address token, uint256 targetProfit) internal {
        // 价格操纵逻辑：大量卖出压低价格，然后低价买入
        // 或者在另一个池子中利用价格差套利
        IERC20 tokenContract = IERC20(token);
        uint256 balance = tokenContract.balanceOf(address(this));
        
        // 在目标DEX上大量卖出，压低价格
        // 再在另一个DEX上低价买入
        // 这个简化版本只做基本的套利
        if (balance > targetProfit) {
            tokenContract.transfer(owner, balance - targetProfit);
        }
    }
    
    function withdraw() external onlyOwner {
        uint256 balance = address(this).balance;
        if (balance > 0) {
            payable(owner).transfer(balance);
        }
    }
}

import pandas as pd
import numpy as np
from datetime import datetime, timedelta
from typing import Dict, List, Tuple
import matplotlib.pyplot as plt
from dataclasses import dataclass
from collections import defaultdict

@dataclass
class AttackTransaction:
    tx_hash: str
    block_number: int
    timestamp: datetime
    attacker: str
    target: str
    protocol: str
    amount_borrowed: float
    amount_stolen: float
    profit: float
    attack_type: str
    gas_used: int
    success: bool

class FlashLoanAttackAnalyzer:
    def __init__(self):
        self.attacks = []
        self.attack_patterns = defaultdict(list)
        self.protocol_stats = defaultdict(lambda: {
            'total_attacks': 0,
            'total_stolen': 0,
            'avg_profit': 0
        })
        
    def load_historical_attacks(self, data: List[Dict]):
        """加载历史攻击数据，就像翻阅犯罪档案"""
        for item in data:
            attack = AttackTransaction(
                tx_hash=item['tx_hash'],
                block_number=item['block_number'],
                timestamp=datetime.fromtimestamp(item['timestamp']),
                attacker=item['attacker'],
                target=item['target'],
                protocol=item['protocol'],
                amount_borrowed=item['amount_borrowed'],
                amount_stolen=item['amount_stolen'],
                profit=item['profit'],
                attack_type=item['attack_type'],
                gas_used=item['gas_used'],
                success=item['success']
            )
            self.attacks.append(attack)
            self.attack_patterns[attack.attack_type].append(attack)
            stats = self.protocol_stats[attack.protocol]
            stats['total_attacks'] += 1
            stats['total_stolen'] += attack.amount_stolen
            
    def attack_signature_analysis(self) -> Dict:
        """攻击特征分析，就像犯罪侧写"""
        signatures = {}
        
        for attack_type, attacks in self.attack_patterns.items():
            if not attacks:
                continue
                
            profits = [a.profit for a in attacks if a.success]
            gas_costs = [a.gas_used for a in attacks]
            
            signatures[attack_type] = {
                'count': len(attacks),
                'success_rate': sum(1 for a in attacks if a.success) / len(attacks),
                'avg_profit': np.mean(profits) if profits else 0,
                'max_profit': max(profits) if profits else 0,
                'avg_gas': np.mean(gas_costs),
                'total_stolen': sum(a.amount_stolen for a in attacks if a.success),
                'signature': self._generate_signature(attack_type)
            }
        
        return signatures
    
    def _generate_signature(self, attack_type: str) -> str:
        """生成攻击特征签名，就像指纹比对"""
        signatures = {
            'price_oracle_manipulation': '利用预言机价格延迟，在价格更新前完成套利',
            'liquidity_pool_drain': '通过闪电贷大幅借贷，耗尽流动性池',
            'reentrancy_attack': '利用回调函数递归调用，重复提取资金',
            'sandwich_attack': '在目标交易前后插入买卖订单，赚取价差',
            'borrow_repay_cycle': '反复借贷偿还，累积手续费漏洞'
        }
        return signatures.get(attack_type, '未知攻击类型')
    
    def temporal_analysis(self) -> pd.DataFrame:
        """时间序列分析，就像分析犯罪时间线"""
        df = pd.DataFrame([{
            'timestamp': a.timestamp,
            'profit': a.profit if a.success else 0,
            'protocol': a.protocol,
            'attack_type': a.attack_type
        } for a in self.attacks])
        
        df['date'] = df['timestamp'].dt.date
        df['week'] = df['timestamp'].dt.isocalendar().week
        
        # 按周统计攻击频率和金额
        weekly_stats = df.groupby('week').agg({
            'profit': ['sum', 'mean', 'count'],
            'protocol': lambda x: x.mode().iloc[0] if not x.mode().empty else 'N/A'
        }).reset_index()
        
        return weekly_stats
    
    def attacker_profiling(self) -> Dict:
        """攻击者侧写，就像犯罪心理画像"""
        attacker_stats = defaultdict(lambda: {
            'attack_count': 0,
            'total_profit': 0,
            'avg_profit': 0,
            'preferred_protocols': [],
            'preferred_attack_types': [],
            'first_seen': None,
            'last_seen': None,
            'pattern_consistency': 0
        })
        
        for attack in self.attacks:
            stats = attacker_stats[attack.attacker]
            stats['attack_count'] += 1
            stats['total_profit'] += attack.profit if attack.success else 0
            stats['preferred_protocols'].append(attack.protocol)
            stats['preferred_attack_types'].append(attack.attack_type)
            
            if stats['first_seen'] is None or attack.timestamp < stats['first_seen']:
                stats['first_seen'] = attack.timestamp
            if stats['last_seen'] is None or attack.timestamp > stats['last_seen']:
                stats['last_seen'] = attack.timestamp
        
        # 计算平均利润和偏好
        for addr, stats in attacker_stats.items():
            stats['avg_profit'] = stats['total_profit'] / stats['attack_count']
            stats['preferred_protocols'] = list(set(stats['preferred_protocols']))
            stats['preferred_attack_types'] = list(set(stats['preferred_attack_types']))
            
            # 计算手法一致性
            if stats['attack_count'] > 1:
                stats['pattern_consistency'] = len(stats['preferred_attack_types']) / stats['attack_count']
        
        return dict(attacker_stats)
    
    def vulnerability_correlation(self) -> pd.DataFrame:
        """漏洞相关性分析，就像分析犯罪手法与作案工具的关系"""
        vulnerability_map = {
            'price_oracle_manipulation': ['预言机价格延迟', '单源预言机', '价格更新频率低'],
            'liquidity_pool_drain': ['低流动性池', '高滑点设置', '无常损失保护不足'],
            'reentrancy_attack': ['未遵循CEI模式', '无重入锁', '回调函数信任'],
            'sandwich_attack': ['公开交易池', 'MEV保护不足', '滑点设置过高'],
            'borrow_repay_cycle': ['借贷利率计算漏洞', '清算机制缺陷', '抵押品定价错误']
        }
        
        correlations = []
        for attack_type, vulnerabilities in vulnerability_map.items():
            attacks = self.attack_patterns.get(attack_type, [])
            if attacks:
                correlations.append({
                    'attack_type': attack_type,
                    'attack_count': len(attacks),
                    'total_stolen': sum(a.amount_stolen for a in attacks if a.success),
                    'common_vulnerabilities': vulnerabilities,
                    'risk_score': len(attacks) * 10 + sum(a.amount_stolen for a in attacks if a.success) / 1000
                })
        
        return pd.DataFrame(correlations).sort_values('risk_score', ascending=False)
    
    def simulate_attack_scenario(
        self, 
        pool_liquidity: float, 
        attacker_capital: float,
        price_impact: float
    ) -> Dict:
        """模拟攻击场景，就像犯罪预演"""
        # 闪电贷可借金额（通常为池子流动性的50-80%）
        max_borrow = pool_liquidity * 0.8
        
        # 实际借入金额
        actual_borrow = min(max_borrow, attacker_capital * 100)
        
        # 价格影响
        price_impact_cost = actual_borrow * price_impact
        
        # 交易手续费
        fee = actual_borrow * 0.003
        
        # 套利空间
        arbitrage_opportunity = actual_borrow * 0.02  # 假设2%的价差
        
        # 净利润
        net_profit = arbitrage_opportunity - price_impact_cost - fee
        
        return {
            'pool_liquidity': pool_liquidity,
            'borrow_amount': actual_borrow,
            'price_impact': price_impact,
            'price_impact_cost': price_impact_cost,
            'fee': fee,
            'arbitrage_opportunity': arbitrage_opportunity,
            'net_profit': net_profit,
            'roi': (net_profit / attacker_capital) * 100 if attacker_capital > 0 else 0,
            'profitable': net_profit > 0
        }
    
    def visualize_attack_patterns(self):
        """可视化攻击模式，就像犯罪地图"""
        fig, axes = plt.subplots(2, 2, figsize=(14, 12))
        
        # 1. 攻击类型分布
        ax1 = axes[0, 0]
        attack_types = list(self.attack_patterns.keys())
        counts = [len(v) for v in self.attack_patterns.values()]
        ax1.bar(attack_types, counts, color='crimson', alpha=0.7)
        ax1.set_title('攻击类型分布')
        ax1.set_xticklabels(attack_types, rotation=45, ha='right')
        ax1.set_ylabel('攻击次数')
        
        # 2. 时间序列
        ax2 = axes[0, 1]
        timestamps = [a.timestamp for a in self.attacks]
        profits = [a.profit if a.success else 0 for a in self.attacks]
        ax2.scatter(timestamps, profits, alpha=0.6, color='darkred', s=20)
        ax2.set_title('攻击时间线与利润')
        ax2.set_xlabel('时间')
        ax2.set_ylabel('利润 (ETH)')
        
        # 3. 协议脆弱性
        ax3 = axes[1, 0]
        protocols = []
        stolen_amounts = []
        for protocol, stats in self.protocol_stats.items():
            protocols.append(protocol)
            stolen_amounts.append(stats['total_stolen'])
        ax3.barh(protocols, stolen_amounts, color='orange', alpha=0.7)
        ax3.set_title('各协议被盗金额')
        ax3.set_xlabel('被盗金额 (ETH)')
        
        # 4. 攻击者活跃度
        ax4 = axes[1, 1]
        attacker_data = self.attacker_profiling()
        attacker_counts = [stats['attack_count'] for stats in attacker_data.values()]
        attacker_profits = [stats['total_profit'] for stats in attacker_data.values()]
        ax4.scatter(attacker_counts, attacker_profits, 
                   alpha=0.6, color='purple', s=50)
        ax4.set_title('攻击者活跃度分析')
        ax4.set_xlabel('攻击次数')
        ax4.set_ylabel('总利润 (ETH)')
        
        plt.tight_layout()
        return plt
    
    def generate_threat_report(self) -> str:
        """生成威胁报告，就像案件总结"""
        total_attacks = len(self.attacks)
        total_stolen = sum(a.amount_stolen for a in self.attacks if a.success)
        total_profit = sum(a.profit for a in self.attacks if a.success)
        success_rate = sum(1 for a in self.attacks if a.success) / total_attacks if total_attacks > 0 else 0
        
        most_common_attack = max(self.attack_patterns.keys(), 
                                key=lambda k: len(self.attack_patterns[k]))
        
        report = f"""
=== 闪电贷攻击威胁报告 ===

总攻击次数: {total_attacks}
成功攻击次数: {sum(1 for a in self.attacks if a.success)}
成功率: {success_rate:.1%}
总被盗金额: {total_stolen:.2f} ETH
攻击者总利润: {total_profit:.2f} ETH

最常见攻击类型: {most_common_attack}
最易受攻击协议: {max(self.protocol_stats.keys(), 
                    key=lambda p: self.protocol_stats[p]['total_stolen'])}

安全建议:
1. 使用去中心化预言机网络（如Chainlink）而非单源预言机
2. 实施CEI（检查-效果-交互）模式防范重入攻击
3. 设置合理的滑点保护机制
4. 对流动性池进行定期压力测试
5. 部署实时监控和警报系统
"""
        return report


# 使用示例
if __name__ == "__main__":
    analyzer = FlashLoanAttackAnalyzer()
    
    # 模拟历史攻击数据
    sample_attacks = [
        {
            'tx_hash': '0xabc...',
            'block_number': 15000000,
            'timestamp': (datetime.now() - timedelta(days=30)).timestamp(),
            'attacker': '0xattacker1',
            'target': '0xtarget1',
            'protocol': 'UniswapV3',
            'amount_borrowed': 10000,
            'amount_stolen': 5000,
            'profit': 4500,
            'attack_type': 'price_oracle_manipulation',
            'gas_used': 500000,
            'success': True
        },
        # 更多攻击数据...
    ]
    
    analyzer.load_historical_attacks(sample_attacks)
    
    # 攻击特征分析
    signatures = analyzer.attack_signature_analysis()
    print("攻击特征分析:")
    for attack_type, sig in signatures.items():
        print(f"  {attack_type}: {sig['signature']}")
    
    # 攻击者侧写
    profiles = analyzer.attacker_profiling()
    print(f"\n攻击者数量: {len(profiles)}")
    
    # 模拟攻击场景
    scenario = analyzer.simulate_attack_scenario(
        pool_liquidity=1000000,
        attacker_capital=100,
        price_impact=0.01
    )
    print(f"\n攻击模拟:")
    print(f"  借入金额: {scenario['borrow_amount']:.2f} ETH")
    print(f"  净利润: {scenario['net_profit']:.2f} ETH")
    print(f"  ROI: {scenario['roi']:.1f}%")
    
    # 威胁报告
    report = analyzer.generate_threat_report()
    print(report)

// 闪电贷攻击实时监控系统
const Web3 = require('web3');
const axios = require('axios');

class FlashLoanMonitor {
    constructor(providerUrl, alertWebhook) {
        this.web3 = new Web3(providerUrl);
        this.alertWebhook = alertWebhook;
        this.knownAttackers = new Map();
        this.suspiciousTransactions = [];
        this.attackPatterns = {
            flashLoan: new RegExp('flashLoan|flash_loan|闪电贷', 'i'),
            priceManipulation: new RegExp('manipulate|price|oracle|预言机', 'i'),
            reentrancy: new RegExp('reentrancy|callback|重入|回调', 'i'),
            sandwich: new RegExp('sandwich|frontrun|三明治|抢先', 'i')
        };
        this.alertThresholds = {
            maxGasPrice: 500, // gwei
            minValue: 100, // ETH
            suspiciousPatterns: 3
        };
    }
    
    // 启动监控
    async startMonitoring() {
        console.log('[监控] 启动闪电贷攻击监控系统...');
        
        // 订阅待处理交易
        const subscription = this.web3.eth.subscribe('pendingTransactions');
        
        subscription.on('data', async (txHash) => {
            try {
                const tx = await this.web3.eth.getTransaction(txHash);
                if (tx && this.isSuspicious(tx)) {
                    await this.analyzeTransaction(tx);
                }
            } catch (error) {
                // 静默处理
            }
        });
        
        // 定期检查已知攻击者
        setInterval(() => this.checkKnownAttackers(), 60000);
        
        return subscription;
    }
    
    // 判断交易是否可疑
    isSuspicious(tx) {
        if (!tx.input || tx.input === '0x') return false;
        
        const input = tx.input.toLowerCase();
        let suspiciousScore = 0;
        
        // 检查Gas价格异常
        if (tx.gasPrice && 
            this.web3.utils.fromWei(tx.gasPrice, 'gwei') > this.alertThresholds.maxGasPrice) {
            suspiciousScore += 2;
        }
        
        // 检查交易金额异常
        if (tx.value && 
            parseFloat(this.web3.utils.fromWei(tx.value, 'ether')) > this.alertThresholds.minValue) {
            suspiciousScore += 1;
        }
        
        // 检查函数签名
        for (const [pattern, regex] of Object.entries(this.attackPatterns)) {
            if (regex.test(input)) {
                suspiciousScore += 2;
                this.logPattern(pattern, tx.hash);
            }
        }
        
        // 检查是否是合约交互
        if (tx.to && tx.to.length === 42) {
            suspiciousScore += 1;
        }
        
        return suspiciousScore >= this.alertThresholds.suspiciousPatterns;
    }
    
    logPattern(pattern, txHash) {
        console.log(`[模式] 检测到 ${pattern} 模式: ${txHash}`);
    }
    
    // 分析可疑交易
    async analyzeTransaction(tx) {
        console.log(`[分析] 分析可疑交易: ${tx.hash}`);
        
        const analysis = {
            hash: tx.hash,
            from: tx.from,
            to: tx.to,
            value: this.web3.utils.fromWei(tx.value || '0', 'ether'),
            gasPrice: tx.gasPrice ? this.web3.utils.fromWei(tx.gasPrice, 'gwei') : 0,
            blockNumber: tx.blockNumber,
            timestamp: Date.now(),
            riskScore: await this.calculateRiskScore(tx),
            detectedPatterns: this.detectPatterns(tx.input),
            simulated: false
        };
        
        this.suspiciousTransactions.push(analysis);
        
        // 如果风险评分高，触发警报
        if (analysis.riskScore > 70) {
            await this.triggerAlert(analysis);
        }
        
        // 模拟交易验证
        if (analysis.riskScore > 50) {
            await this.simulateTransaction(tx);
        }
        
        return analysis;
    }
    
    // 计算风险评分
    async calculateRiskScore(tx) {
        let score = 0;
        
        // 1. 交易金额权重 (最高30分)
        const valueInEth = parseFloat(this.web3.utils.fromWei(tx.value || '0', 'ether'));
        if (valueInEth > 1000) score += 30;
        else if (valueInEth > 100) score += 20;
        else if (valueInEth > 10) score += 10;
        
        // 2. Gas价格权重 (最高20分)
        const gasPriceInGwei = parseFloat(
            this.web3.utils.fromWei(tx.gasPrice || '0', 'gwei')
        );
        if (gasPriceInGwei > 1000) score += 20;
        else if (gasPriceInGwei > 500) score += 15;
        else if (gasPriceInGwei > 200) score += 10;
        
        // 3. 函数调用复杂度 (最高20分)
        const inputLength = tx.input ? tx.input.length : 0;
        if (inputLength > 10000) score += 20;
        else if (inputLength > 5000) score += 15;
        else if (inputLength > 1000) score += 10;
        
        // 4. 已知攻击者关联 (最高30分)
        if (this.knownAttackers.has(tx.from?.toLowerCase())) {
            score += 30;
        }
        
        // 5. 合约交互评分 (最高10分)
        if (tx.to) {
            const code = await this.web3.eth.getCode(tx.to).catch(() => '0x');
            if (code !== '0x' && code.length > 100) {
                score += 10;
            }
        }
        
        return Math.min(100, score);
    }
    
    // 检测攻击模式
    detectPatterns(input) {
        const patterns = [];
        const inputLower = input.toLowerCase();
        
        const patternChecks = {
            '闪电贷': /flashloan|闪电贷|flash_loan/i,
            '价格操纵': /manipulateprice|priceoracle|价格操纵/i,
            '重入攻击': /reentrancy|callback|重入|回调/i,
            '三明治攻击': /sandwich|frontrun|三明治|抢先交易/i,
            '借贷套利': /borrow|repay|闪电贷套利|借贷/i,
            '预言机攻击': /oracle|预言机|价格预言/i
        };
        
        for (const [name, regex] of Object.entries(patternChecks)) {
            if (regex.test(inputLower)) {
                patterns.push(name);
            }
        }
        
        return patterns;
    }
    
    // 模拟交易
    async simulateTransaction(tx) {
        try {
            console.log(`[模拟] 模拟交易: ${tx.hash}`);
            
            const result = await this.web3.eth.call({
                from: tx.from,
                to: tx.to,
                value: tx.value,
                gas: tx.gas,
                gasPrice: tx.gasPrice,
                data: tx.input
            });
            
            // 分析模拟结果
            const simulation = {
                txHash: tx.hash,
                success: result !== '0x',
                returnData: result,
                profit: this.estimateProfit(result)
            };
            
            // 更新交易分析
            const txAnalysis = this.suspiciousTransactions.find(
                t => t.hash === tx.hash
            );
            if (txAnalysis) {
                txAnalysis.simulated = true;
                txAnalysis.simulation = simulation;
            }
            
            return simulation;
        } catch (error) {
            console.log(`[模拟] 交易模拟失败: ${error.message}`);
            return null;
        }
    }
    
    estimateProfit(result) {
        // 简化的利润估算
        // 在实际应用中，需要解析返回数据
        if (result && result.length > 66) {
            try {
                const profitHex = '0x' + result.slice(result.length - 64);
                const profit = this.web3.utils.fromWei(profitHex, 'ether');
                return parseFloat(profit);
            } catch {
                return 0;
            }
        }
        return 0;
    }
    
    // 触发警报
    async triggerAlert(analysis) {
        const alert = {
            type: 'FLASH_LOAN_ATTACK',
            severity: analysis.riskScore > 85 ? 'CRITICAL' : 'HIGH',
            timestamp: new Date().toISOString(),
            transaction: analysis.hash,
            from: analysis.from,
            to: analysis.to,
            value: analysis.value,
            riskScore: analysis.riskScore,
            patterns: analysis.detectedPatterns
        };
        
        console.log(`[警报] ${alert.severity}: 检测到可能的闪电贷攻击!`);
        console.log(`  交易: ${alert.transaction}`);
        console.log(`  风险评分: ${alert.riskScore}`);
        console.log(`  检测模式: ${alert.patterns.join(', ')}`);
        
        // 发送webhook警报
        if (this.alertWebhook) {
            try {
                await axios.post(this.alertWebhook, alert);
            } catch (error) {
                console.error('[警报] Webhook发送失败:', error.message);
            }
        }
        
        // 记录攻击者
        if (analysis.from) {
            const attacker = analysis.from.toLowerCase();
            if (!this.knownAttackers.has(attacker)) {
                this.knownAttackers.set(attacker, {
                    firstSeen: Date.now(),
                    attackCount: 1,
                    totalValue: parseFloat(analysis.value),
                    alerts: [alert]
                });
            } else {
                const info = this.knownAttackers.get(attacker);
                info.attackCount++;
                info.totalValue += parseFloat(analysis.value);
                info.alerts.push(alert);
            }
        }
    }
    
    // 检查已知攻击者
    async checkKnownAttackers() {
        console.log('[监控] 检查已知攻击者活动...');
        
        for (const [address, info] of this.knownAttackers) {
            const balance = await this.web3.eth.getBalance(address).catch(() => '0');
            const balanceEth = this.web3.utils.fromWei(balance, 'ether');
            
            if (parseFloat(balanceEth) > 10) {
                console.log(`[警告] 已知攻击者 ${address} 仍有余额: ${balanceEth} ETH`);
            }
        }
    }
    
    // 生成攻击报告
    generateReport() {
        const totalAlerts = this.suspiciousTransactions.filter(
            t => t.riskScore > 70
        ).length;
        
        const totalValue = this.suspiciousTransactions.reduce(
            (sum, t) => sum + parseFloat(t.value || 0), 0
        );
        
        const patternStats = new Map();
        this.suspiciousTransactions.forEach(t => {
            t.detectedPatterns.forEach(p => {
                patternStats.set(p, (patternStats.get(p) || 0) + 1);
            });
        });
        
        return {
            monitoringPeriod: {
                start: this.suspiciousTransactions[0]?.timestamp,
                end: Date.now()
            },
            totalTransactions: this.suspiciousTransactions.length,
            highRiskAlerts: totalAlerts,
            totalValueInvolved: totalValue,
            knownAttackers: this.knownAttackers.size,
            patternDistribution: Object.fromEntries(patternStats),
            recentAlerts: this.suspiciousTransactions
                .filter(t => t.riskScore > 70)
                .slice(-10)
        };
    }
}

// 使用示例
const monitor = new FlashLoanMonitor(
    'https://mainnet.infura.io/v3/YOUR_PROJECT_ID',
    'https://hooks.slack.com/services/YOUR_WEBHOOK'
);

monitor.startMonitoring().then(() => {
    console.log('闪电贷攻击监控系统已启动');
    
    // 每小时生成报告
    setInterval(() => {
        const report = monitor.generateReport();
        console.log('监控报告:', JSON.stringify(report, null, 2));
    }, 3600000);
});