AIT-301AdvancedAI48h · 6 weeks (self-paced)

AI-Powered On-Chain Threat Intelligence

Build, train, and deploy machine-learning models that detect threats on-chain before they become incidents. Covers rug-pull prediction, wash-trading detection, phishing-contract classification, and MEV-bot identification. Extends the forensics track (ACF) with automated, real-time tooling.

01 · Outcomes

What you will be able to do.

01Extract and engineer features from raw on-chain data for ML models
02Train classifiers that flag rug pulls, phishing contracts, and wash trading
03Deploy a model behind a real-time alerting pipeline (Dune + webhook)
04Evaluate model performance with precision/recall trade-offs tuned for security
05Integrate AI-driven threat feeds into an existing SOC or compliance workflow

02 · Syllabus

What you will cover.

Week 1

On-Chain Data for ML

→Sourcing and indexing transactions, events, and traces at scale
→Feature engineering: contract age, holder distribution, liquidity patterns
→Building labelled datasets from known exploits and verified contracts

Week 2

Rug-Pull & Scam Detection

→Supervised classifiers for honeypot and rug-pull contracts
→Token-launch signals: liquidity lock, ownership renounce, hidden mints
→Temporal features and deployer-reputation scoring

Week 3

Wash Trading & Market Manipulation

→Graph-based detection of circular trading patterns
→Volume anomaly models and statistical tests
→NFT wash-trading heuristics and marketplace-specific signals

Week 4

Phishing & Address Poisoning

→Classifying approval-phishing contracts by bytecode similarity
→Address-poisoning detection via dust-transaction patterns
→NLP models for scam-URL and social-media lure detection

Week 5

Real-Time Deployment

→Streaming pipeline: mempool listener → model → alert
→Webhook and Telegram/Slack integrations for ops teams
→Model drift monitoring and retraining triggers

Week 6

Integration & Capstone

→Plugging model output into Chainalysis, Arkham, or internal dashboards
→Precision/recall tuning for security: cost of false negatives vs false positives
→Capstone: deploy a working detector on a testnet data feed

03 · Lessons