Machine Learning Based Detection of Sandwich-Like Behavior in Decentralized Exchanges

Sammanfattning

Decentralized exchanges (DEX) and automated market makers (AMM) have become a central part of the modern blockchain ecosystem. At the same time the emergence of Maximal Extractable Value (MEV) has created new forms of strategic trading behavior where actors can exploit the transactional order in the blockchain. One of the most noticed phenomena is sandwich attacks, where a users swap is surrounded by transactions that try to affect the price movement to the attackers advantage. The problem is difficult to analyse because public blockchain data misses clear ground truth and because similar patterns also can occur in legit trading or arbitrage. The purpose of this work is to examine how sandwich-like behavior can be identified in public Uniswap V3 data through a combination of heuristic rules and machine learning. The work focuses on constructing weak labels from observed block and transaction patterns and evaluating how different models can be used to rank deviating behaviors. To implement this study swap data from Uniswap V3 was collected and processed. Features that were connected to price movement, block context, trade size, gas and sequential patterns were created. Multiple models were trained and compared, including Random Forest, XGBoost, Logistic Regression, Isolation Forest and LSTM. The results show that tree based models perform the best and can identify stable structures connected to sandwich-like behaviors even when explicit rule based features were removed. The analysis also shows that the models do not only reproduce heuristic rules but rather seem to catch more general block and sequential patterns. At the same time the results are dependent on weak labels and cannot therefore be interpreted as proof of verified attacks. The work contributes with a reproducible framework for analysing sandwich-like behaviour in public DEX-data and shows how machine learning can be used as support for anomaly detection in decentralized financial systems.