BridgeShield: Risk-Aware Graph Modeling for Cross-Chain Bridge Attack Detection

Cross-chain bridges enable asset and state transfers across heterogeneous blockchains, but their complex cross-domain interactions introduce new attack surfaces that are difficult to monitor using traditional single-chain analysis methods. Existing approaches often focus on isolated on-chain behaviors and fail to capture the multi-stage execution semantics of cross-chain transactions. This paper presents BridgeShield, a graph-based framework for detecting cross-chain bridge attacks through risk-aware modeling of cross-chain execution behaviors. BridgeShield reconstructs cross-chain behavior graphs from execution traces and event logs, capturing interactions across the source chain, off-chain relay components, and the destination chain. To highlight attack-relevant structures, the framework employs differential meta-path selection to identify execution patterns that exhibit structural deviations between normal and attack transactions, and hierarchical risk propagation to aggregate distributed risk signals across interaction stages. Experiments on real-world bridge incidents show that BridgeShield achieves an F1-score of 92.6% in cross-chain attack detection and consistently outperforms existing rule-based and graph-based baselines. In addition, the model remains effective in detecting previously unseen attack incidents, indicating that BridgeShield captures structural risk patterns rather than memorizing historical attack templates.