An access control server may receive state information of an autonomous program protocol that is recorded on a blockchain. The access control server may generate a trace log associated with one or more transactions executed by the autonomous program protocol, the trace log comprising machine events executed by the blockchain, the machine actions associated with the one or more transactions. The access control server may extract a set of features from the trace log, wherein a feature in the set comprises a summary of a machine event executed by the blockchain. The access control server may input the set of features to a machine learning model to determine a threat nature associated with the transactions of the autonomous program protocol. The access control server may perform a responsive action to address the threat nature.