Event Logs of Ethereum-Based Applications

Abstract

Process mining has become an established set of tools and methods for analyzing process data, while blockchain is emerging as a platform for decentralized applications and inter-organizational processes. Approaches and tools have been developed for analyzing blockchain data with process mining methods, including the tools created by us: BlockXES, ELF, and BLF. Recently, we have shown that process mining on blockchain data is valuable, among others for understanding user behavior and for security audits. With this resources paper, we make four diferent data sets available in XES format, stemming from four diferent blockchain applications: Augur, Forsage, CryptoKitties, and ChickenHunt. We describe the method of extraction, data sets, and conduct preliminary analyses to demonstrate feasibility. This publication aims to help researchers and practitioners to understand the application domain, and enables future process mining research on the data sets.

Keywords

• eol>Ethereum Logging Framework
• Event logs
• Process Mining
• Blockchain

1. Introduction

Process mining [ 1 ] has established as a set of tools and methods for analyzing process data. Blockchain [ 2 ] is emerging as a platform for decentralized applications and inter-organizational processes. Approaches and tools have been developed for analyzing blockchain data with process mining methods, including the tools created by us: BlockXES [ 3 ], ELF [ 4 ], and BLF [ 5 ].Although challenging [ 6 ], we recently showed that process mining on blockchain data is valuable, among others to understand user behavior and for security audits [ 7 ].

With this resource paper, we publish a collection of event logs from blockchain-based decentralized applications (DApps). The event logs are available in XES format and currently cover four DApps: 1. Augur, a prediction and betting marketplace; 2. Forsage, an investment application, which turns out to be a Ponzi scheme; 3. CryptoKitties, a game where virtual cats can be bred and traded as assets; 4. ChickenHunt, a game for collecting chickens and upgrading the avatar.

All four applications and their data are available on the public Ethereum blockchain. Still, extracting the data is non-trivial [ 6 ], and with this publication, we also release the artifacts for the data extraction. In particular, we use the open-source Ethereum Logging Framework (ELF) [ 4 ], which takes a manifest as input. Manifests define which on-chain data to extract, and how to transform and format it, e.g., as CSV or XES files. They can hence be used for various purposes. For example, users can query log entry data from a given smart contract address over a range of blocks. For each of the four DApps, a manifest was crafted and used with ELF to extract data from a full Ethereum archival node. The collection of event logs is made available via a website1. For each data set it includes the ELF manifest, the XES event log, links to the DApp source code and website, a description of the XES log content, and preliminary analysis results.

In the following, we describe the data sets and conduct preliminary analyses to demonstrate feasibility. This publication aims to help researchers and practitioners to understand the application domain, and enables future process mining research on the data sets, e.g., for analysis and evaluation purposes.

2. Description of the data sets

All data sets are made available as event logs in XES format. The events we extracted from the DApps were encoded in the blocks of the public Ethereum blockchain. Data extraction for each DApp started with the first block after its deployment and ends with block 12,243,999 (one block before the Berlin Hard Fork)2. Note that we extracted data from Augur at an earlier point for our case study in [ 7 ]. Hence, the respective log only covers data until block 10,336,628. While the logs have a varying number of attributes depending on the events generated by the corresponding DApp, each log has a common set of attributes, namely Case ID, Activity, Complete Timestamp, and lifecycle:transition. The additional attributes are described on the website accompanying this paper (see Footnote 1). The timestamps of the events correspond to the timestamps of the block they were extracted from. Additionally, the logs contain DApp or Ethereum-specific attributes, e.g., gasPaid or receivingContract in Augur. Table 1 presents key ifgures of the data sets.

3. Preliminary analysis

For the preliminary analysis, we focus on the event log of ChickenHunt. For Augur, an extensive case study has been published recently [ 7 ]. Preliminary analyses of Forsage and CryptoKitties 1https://ingo-weber.github.io/dapp-data/ 2https://blog.ethereum.org/2021/03/08/ethereum-berlin-upgrade-announcement/ can be found on the accompanying website (see Footnote 1).

ChickenHunt is an incremental game that is deployed as a DApp on Ethereum. The game’s goal is to collect chickens through farming and attacking other players. Players also have the option to upgrade the attack (“Upgrade Hunter”), defense (“Upgrade Depot”), and collection capabilities (“Upgrade Pet”) of their avatars. The player pays the gas costs for the Ethereum transactions. The game concept includes two types of incentives for playing. Shareholder: through certain transactions, players can become shareholders of the game; and financial reward: players can sacrifice collected chickens for Ether.

We loaded the event log into several process mining tools to analyze the players’ behavior, (a) Most common traces in ChickenHunt (b) DFG with only upgrade activities but here we focus on results obtained with ProM. In Fig. 1a, the most common behavior of players is shown: 107 players out of the 715 cases join chicken hunt and never did anything else. Several frequent traces show players joining, and then being attacked (one or more times) without doing anything else. Some players follow a similar pattern, but first they succeed with bringing chickens to the altar. These insights could help understand why players stop early, and be used by the developers when working on improvements to promote the user base to grow.

Players who actively play the game have highly varied individual traces: 402 distinct traces exist for the 715 cases. In Fig. 1b, we analyzed the order and frequency of the diferent types of upgrades. Upgrading the hunter avatar is the most popular choice, and by far the most frequent ifrst and last upgrade. In other words, active players may also upgrade their pet and their depot, but they typically come back to upgrade their hunter further. These insights, too, appear to be of value for the providers of such a game.

Next, we direct our attention to attack behavior. The dotted chart in Fig. 2 shows only the events from joining, attacking, and sufering from an attack. It can be observed that only a few players attack others, but a large number of players are sufering from attacks. Additionally, the attacks appear to happen in synchronized waves, as indicated by the vertical patterns in the dotted chart. The reasons behind those waves may well be connected to the gas prices (and accordingly the fees) per transaction on Ethereum3: from a visual comparison of the timelines, higher gas prices on Ethereum may well correlate with periods without attacks on ChickenHunt. Presumably, the attackers stole chickens from ordinary users, brought them to the altar, and received Ether in return, all of which entailing transactions with associated fees. If the returns in Ether are not high enough, the fees may well render this operation a financial loss.

4. Conclusion

With this paper, we provide a collection of four event logs extracted from blockchain applications, with detailed descriptions and preliminary analyses. The collection is publicly available (see Footnote 1). Currently, it comprises a set of four event logs that were extracted with the tool ELF from DApps deployed and executed on the public Ethereum blockchain. In the paper, we included an analysis based on the ChickenHunt event log, which serves as evidence that insights can be discovered from these logs with standard process mining techniques. For the other logs, analyses are available via the website. The data can be analyzed in much more detail by applying additional process mining methods, and presumably holds blockchain-specific and independent insights which we invite the community to explore.

We plan to amend the collection with additional data sets. In addition, we invite other researchers to contribute their data sets via the openly accessible GitHub repository4.

References

[1] W. M. P. van der Aalst , Process mining: Data science in action, Springer-Verlag, Berlin, 2016 .

[2] X. Xu , I. Weber , M. Staples , Architecture for Blockchain Applications , Springer, 2019 .

[3] C. Klinkmüller , A. Ponomarev , A. B. Tran , I. Weber , W. M. P. van der Aalst , Mining blockchain processes: Extracting process mining data from blockchain applications , in: BPM (Blockchain Forum) , 2019 , pp. 71 - 86 .

[4] C. Klinkmüller , I. Weber , A. Ponomarev , A. B. Tran , W. Aalst, Eficient Logging for Blockchain Applications , Computing Research Repository (CoRR) in arXiv abs/ 2001 .10281 ( 2020 ). URL: https://arxiv.org/abs/ 2001 .10281.

[5] P. Beck , H. Bockrath , T. Knoche , M. Digtiar , T. Petrich , D. Romanchenko , R. Hobeck , L. Pufahl , C. Klinkmüller , I. Weber , A blockchain logging framework for mining blockchain data , in: BPM (Demos & Resources Forum) , 2021 .

[6] C. Di Ciccio , et al., Blockchain-based traceability of inter-organisational business processes , in: BMSD , 2018 .

[7] R. Hobeck , C. Klinkmüller , H. M. N. D. Bandara , I. Weber , W. van der Aalst, Process mining on blockchain data: A case study of augur , in: BPM, 2021 .