A smart contract vulnerability detection method, system, device and storage medium

Abstract

This invention provides a method, system, device, and storage medium for smart contract vulnerability detection, belonging to the fields of blockchain security and artificial intelligence technology. It includes extracting an abstract syntax tree, control flow graph, and data dependency graph from the original smart contract code; obtaining a composite graph object based on the abstract syntax tree, control flow graph, and data dependency graph; processing the composite graph object based on node semantics and function call relationships to obtain a hierarchical heterogeneous graph; constructing a heterogeneous graph Transformer network; using a heterogeneous graph Transformer encoder to process the hierarchical heterogeneous graph for encoding node and edge information, obtaining node representation vectors that fuse semantic and structural information; extracting multi-scale features from the node representation vectors; fusing the extracted multi-scale features using learnable weights; and processing the fused multi-scale features using a base classifier cluster to obtain vulnerability type prediction results and confidence levels. This invention achieves full-process optimization from structural modeling and semantic fusion to decision reasoning, significantly improving the accuracy and interpretability of smart contract vulnerability detection.

Description

Technical Field

[0001] This invention belongs to the field of blockchain security and artificial intelligence technology, specifically relating to a smart contract vulnerability detection method, system, device and storage medium. Background Technology

[0002] With the rapid development of blockchain technology and decentralized finance (DeFi) applications, smart contracts, as the core execution unit of blockchain systems, have been widely used in scenarios such as asset management, lending protocols, and automated trading. However, once smart contract code is deployed on the blockchain, it cannot be changed, and potential vulnerabilities can lead to serious economic losses and security risks. For example, vulnerabilities such as reentrancy attacks, integer overflows, and timestamp dependencies have all caused large-scale financial losses and have become major threats in the current blockchain security field.

[0003] Existing smart contract vulnerability detection methods mainly include: (1) Static analysis and symbolic execution methods: These methods match known vulnerability patterns by scanning the syntax structure or symbolic execution path of the source code. Typical tools such as Slither and Mythril can quickly identify and display vulnerability rules. (2) Deep learning and graph neural network methods: With the rise of code graph modeling research, some schemes represent smart contracts as abstract syntax trees (AST), control flow graphs (CFG), or data dependency graphs (DDG), and use graph convolutional networks (GCN), graph attention networks (GAT), and other models for feature extraction. For example, existing research has fused AST and CFG to capture structural features and control dependencies. (3) Transformer and convolution hybrid detection methods: In recent years, some research has combined code sequence embedding with Transformer structures to enhance the ability to capture global dependencies. However, existing technologies still have the problem of insufficient multi-scale relationship modeling, resulting in poor stability and low accuracy of detection results. Summary of the Invention

[0004] To address the shortcomings of existing technologies in detecting smart contract vulnerabilities, this invention provides a smart contract vulnerability detection method, system, device, and storage medium.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A method for detecting smart contract vulnerabilities includes the following steps: An abstract syntax tree, control flow graph, and data dependency graph are extracted from the original smart contract to obtain a set of multi-view structure graphs. The nodes and edges of different views in the set of multi-view structure graphs are encoded and fused to output a unified graph representation of the smart contract. Based on the unified graph representation of the smart contract, a hierarchical structure model is performed using the graph-of-graph mechanism to obtain a hierarchical heterogeneous graph. The nodes represent the program elements of the smart contract, and the edges represent the logical relationships between the program elements. The hierarchical heterogeneous graph is encoded with node and edge information using a heterogeneous graph Transformer encoder to obtain a node representation vector that integrates semantic and structural information. Multi-scale feature extraction is performed on the node representation vector, and the extracted multi-scale features are fused using learnable weights. The fused multi-scale features are then processed using a base classifier cluster to obtain the vulnerability type detection result.

[0006] Preferably, the hierarchical heterogeneous graph is encoded using a heterogeneous graph Transformer encoder to obtain node representation vectors that fuse semantic and structural information, specifically: Independent query matrices, key matrices, and value matrices are introduced for nodes and edges in hierarchical heterogeneous graphs; To incorporate edge attribute and relative position encoding into the attention mechanism, a multilayer perceptron is used to map edge attribute vectors to attention bias terms. The relative position encoding is calculated based on path length, function call depth, and topological distance in the hierarchical heterogeneous graph. The attention weights between node i and its neighbor node j are calculated as follows: ; in, Queries and key matrices for different node types; Edge type bias; This is an edge attribute mapping function used to encode statistical information; Encoding relative positions based on path length or call depth; The node embedding is updated by weighted summation of the features of neighboring nodes using attention weights, generating a node representation vector that integrates semantic and structural information.

[0007] Preferably, multi-scale feature extraction is performed on the node representation vector, and the extracted multi-scale features are fused using learnable weights, specifically: Multi-scale features are extracted from the node representation vector using local branches, frequency domain branches, and state space branches respectively. Specifically, the node representation vector is subjected to multi-kernel depthwise separable convolution in the local branch; the node representation vector features are decomposed using the Laplacian operator in the frequency domain branch; and the long-distance dependency across functions is captured using the state space modeling structure in the local branch. The multi-scale features extracted from different branches are fused using learnable weights to obtain the fused multi-scale features.

[0008] Preferably, the step of encoding and fusing the nodes and edges of different views in the multi-view structure graph set to output a unified graph representation of the smart contract specifically involves: using static analysis tools to parse the smart contract source code into an AST; generating a control flow graph based on the control dependencies between statements, with edges representing the source code execution path; and generating a data dependency graph through data flow analysis to describe the read-write transmission relationships between variables. The pre-trained code language model is invoked to convert the code fragments corresponding to each AST node into semantic vectors, which are then concatenated with grammatical type features and structural statistical features to form a composite node representation. Attribute vectors are calculated for each edge, and the output is a unified graph representation of the smart contract.

[0009] Preferably, hierarchical structure modeling is performed based on the unified graph representation of smart contracts using a graph-of-graph mechanism to obtain a hierarchical heterogeneous graph, specifically including the following steps: The statement-level nodes in the unified graph representation of the smart contract are used as basic nodes, and their semantic-structure vectors are preserved. Each function is treated as a supernode, recording the number of calls, the number of shared variables, and the semantic embedding; function call edges and cross-function variable sharing edges are added to the supernodes to form a multi-relationship network; Establish mapping edges between base nodes and their supernodes to achieve hierarchical associations from statement level to function level, resulting in a hierarchical heterogeneous graph.

[0010] Preferably, the base classifier cluster includes multiple classifiers, and the prediction variance of the classifier output is calculated using Monte Carlo Dropout or multi-model ensemble as a confidence measure; when the prediction variance exceeds a preset threshold, a gating mechanism is triggered for manual review to prevent incorrect judgment.

[0011] This invention also provides a smart contract vulnerability detection system, specifically including: The data analysis module is used to extract the abstract syntax tree, control flow graph, and data dependency graph from the original smart contract to obtain a multi-view structure graph set; it encodes and fuses the nodes and edges of different views in the multi-view structure graph set to output a unified graph representation of the smart contract; based on the unified graph representation of the smart contract, it uses the graph-of-graph mechanism to perform hierarchical structure modeling to obtain a hierarchical heterogeneous graph; the nodes represent the program elements of the smart contract, and the edges represent the logical relationships between the program elements; The vulnerability detection module is used to encode the node and edge information of the hierarchical heterogeneous graph using a heterogeneous graph Transformer encoder to obtain a node representation vector that integrates semantic and structural information; to extract multi-scale features from the node representation vector, and to fuse the extracted multi-scale features using learnable weights; and to process the fused multi-scale features using a base classifier cluster to obtain the vulnerability type detection result.

[0012] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps described in the smart contract vulnerability detection method.

[0013] The present invention also provides a computer-readable storage medium storing a computer program, which, when loaded by a processor, is capable of executing the steps described in the smart contract vulnerability detection method.

[0014] The smart contract vulnerability detection method provided by this invention has the following beneficial effects: This invention employs a graph-of-graph structure and semantic embedding for joint representation, achieving unified modeling of instruction-level and function-level dependencies. Based on the hierarchical heterogeneous graph obtained through modeling, and combined with semantic vectors generated by the heterogeneous graph Transformer encoder, unified semantic and structural modeling from the statement level to the function level is achieved, enhancing the expressive power for complex code logic and cross-function vulnerabilities. Simultaneously, the heterogeneous graph Transformer encodes node types, edge types, edge attributes, and relative positions, effectively capturing long-range dependencies and heterogeneous information in multi-relationship graphs, thereby improving the identification accuracy of deep vulnerabilities such as reentrancy attacks and cross-function variable abuse. Explanatory information can be generated based on the vulnerability type detection results, tracing back to the key nodes and paths leading to vulnerability determination. This invention achieves end-to-end optimization of smart contract vulnerability detection from structural modeling, semantic fusion, relation encoding to decision reasoning, significantly improving detection accuracy, stability, and security controllability. Attached Figure Description

[0015] To more clearly illustrate the embodiments and design schemes of the present invention, the accompanying drawings required for this embodiment will be briefly described below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of a smart contract vulnerability detection method according to an embodiment of the present invention.

[0017] Figure 2This is a flowchart of constructing a hierarchical graph-of-graph heterogeneous graph in an embodiment of the present invention.

[0018] Figure 3 This is a diagram of the Graph-of-Graph (GoG) structure in an embodiment of the present invention.

[0019] Figure 4 This is a heterogeneous graph Transformer encoding diagram in an embodiment of the present invention.

[0020] Figure 5 This is a flowchart illustrating the multi-scale feature abstraction process in an embodiment of the present invention.

[0021] Figure 6 This is a flowchart of the adaptive integrated decision-making process in an embodiment of the present invention.

[0022] Figure 7 This is an architecture diagram of a smart contract vulnerability detection system according to an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand and implement the technical solutions of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention.

[0024] Example This invention provides a method for detecting smart contract vulnerabilities, such as... Figure 1 As shown, the specific steps include: Step 1: Static Analysis of Smart Contracts. The smart contract undergoes syntax parsing and structural analysis, extracting the Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Data Dependency Graph (DDG) structural information to obtain a set of multi-view structure graphs. .

[0025] S2: Node Semantic Generation and Feature Construction. Based on the AST / CFG / DDG multi-view structure graph obtained in Step 1, nodes and edges from different views are fused and uniformly encoded to construct a combined heterogeneous graph, i.e., a unified graph representation of smart contracts. Feature / attribute vectors are then calculated for nodes and edges to obtain the output combined graph object G=(V,E,X). v ,X e ), where X v Let X be the node feature matrix. e The flowchart is as follows: (The flowchart is shown below) Figure 2 As shown.

[0026] S21, Syntax Parsing Unit: Calls static analysis tools (such as Slither or Solidity AST Parser) to parse the smart contract source code into an AST; AST nodes contain node types and parent-child relationships, and record source code location range information.

[0027] S22, Control Flow Extraction Unit: Generates a control flow graph (CFG) based on the control dependencies between statements. The edges of the CFG represent possible execution paths of the program.

[0028] S23, Data Dependency Extraction Unit: Performs data flow analysis on program read and write operations to generate a data dependency graph (DDG), which is used to describe the value transfer relationships between variables.

[0029] S24. Node Semantic Embedding Unit: A pre-trained code language model (such as CodeBERT, CodeT5, or GraphCodeBERT) is used to generate semantic vectors for the code fragments of each AST node. Simultaneously, based on the AST, CFG, and DDG multi-view structure graphs obtained in steps S21 to S23, structural statistical features of each node are extracted. These features include one or more of the following: node's level depth in the abstract syntax tree, number of child nodes, in-degree and out-degree in the control flow graph and data dependency graph, and number of associated edges. The syntax type features and structural statistical features are then concatenated or fused with the semantic vectors to obtain the semantic-structural vector representation of each node. The semantic-structural vectors of all nodes constitute the node feature matrix.

[0030] S25, Edge Attribute Calculation Unit: Calculates an attribute vector for each edge in the graph. The attribute vector includes at least the edge type, frequency of occurrence, path length, and call depth. The edge type characterizes the relation category to which the edge belongs, specifically an abstract syntax tree edge, a control flow graph edge, or a data dependency graph edge, and is numerically represented using category numbering or one-hot encoding. The frequency of occurrence characterizes the number of times the corresponding relation pattern of the edge appears in the current smart contract composite graph, or the normalized number of occurrences. The path length characterizes the connection distance between the source node and the target node in the corresponding graph structure. Specifically, for abstract syntax tree edges, it is the hierarchical distance between nodes; for control flow graph edges, it is the statement jump distance or basic block jump distance; for data dependency graph edges, it is the data propagation distance or shortest connection distance between the variable definition node and the user node. Call depth is used to characterize the function call level or nesting level of the statement or function containing the edge relative to the smart contract entry function. For edges that do not involve cross-function calls, the call depth is taken as the current level of the function containing the edge or a preset initial value. The edge type, occurrence frequency, path length and call depth are then numerically encoded and combined to obtain the edge feature vector. All edge feature vectors constitute the edge feature matrix Xe.

[0031] Composite graph object G=(V,E,X) v ,X e As the initial input for the Graph-of-Graph hierarchical modeling in step three, V is the set of statement-level nodes, E is the set of statement-level relation edges, Xv is the node feature matrix, and Xe is the edge feature matrix. Based on this, the original nodes, edges, and their feature representations are retained, and the composite graph object is hierarchically extended by introducing function-level supernodes, function call relation edges, variable sharing relation edges, and hierarchical mapping edges to form a hierarchical heterogeneous graph for the heterogeneous graph Transformer encoding in step four, thereby realizing continuous modeling from the composite heterogeneous graph to the hierarchical relation graph.

[0032] S3: Construct a hierarchical Graph-of-Graph. Based on the composite graph object G=(V,E,Xv,Xe) output from Step 2, hierarchical structure modeling is performed using the Graph-of-Graph mechanism. The purpose of this step is to further introduce function-level global relation representations while preserving the control flow relationships, data dependencies, and syntactic structure relationships between statement-level nodes. This allows for the simultaneous depiction of cross-level associations such as dependencies between statements within a function and calls and shared variables between functions, providing information representations that combine local structural information with global semantic dependencies for subsequent heterogeneous graph encoding. The Graph-of-Graph structure diagram is as follows: Figure 3 As shown, GoG consists of two types of nodes: BasicNodes, which correspond to contract statements, variables, or operators; and HyperNodes, which correspond to functions or contract-level semantic units. Edges in GoG are categorized as follows: Abstract Syntax Edges (ASTEdge), used to describe syntactic hierarchical relationships; Control Flow Edges (CFGEdge), used to reflect execution paths; Data Dependency Edges (DDGEdge), used to model read-write dependencies; Function Call Edges (CALLEdge), representing inter-function call relationships; and Shared Variable Edges (SHAREEdge), representing cross-function variable dependencies.

[0033] S31. Basic Node Construction Unit: The smart contract statement node is used as the basic node, and the node features are represented by the semantic-structure vector generated in step S24.

[0034] S32, Hyper Node Generation Unit: Treat each function as a hyper node and record its call count, variable sharing count, and semantic embedding vector.

[0035] S33, Edge Type Extension Unit: Establish CALL edges through function call relationships and SHARE edges through cross-function variable dependencies, thereby forming a multi-relationship network at the contract level.

[0036] S34, Hierarchical Connection Unit: Establishes mapping edges between nodes within a function and their supernodes to achieve hierarchical connections from the statement level to the function level.

[0037] Through hierarchical structure modeling in step three, based on the statement-level composite graph formed in step two, a hierarchical heterogeneous graph is further generated that simultaneously contains statement-level nodes, function-level supernodes, and multiple types of relation edges. Hierarchical Heterogeneity Figure 1 On the one hand, the node feature matrix Xv and edge feature matrix Xe from step two are retained; on the other hand, function call relationships, variable sharing relationships and hierarchical mapping relationships are added, so as to serve as the input for the heterogeneous graph Transformer encoding in step four.

[0038] S4: Heterogeneous graph Transformer encoding. This method uses multi-scale feature abstraction to perform hierarchical fusion of embedded features. A heterogeneous graph Transformer encoding diagram is shown below. Figure 4 As shown, it is used for the fusion encoding of structural and semantic information on heterogeneous graphs.

[0039] S41, Node Type Embedding Layer: Assign independent query (Q), key (K), and value (V) matrices to different types of nodes, enabling the attention mechanism to distinguish syntactic categories.

[0040] S42, Edge Attribute Mapping Layer: Uses a multilayer perceptron (MLP) to map edge attribute vectors to attention bias terms, representing the importance and directional features of the edges.

[0041] S43. Relative position encoding layer: Calculate the relative position encoding PE(i,j) based on the path length, function call depth, and node topological distance.

[0042] S44, Edge-enhanced attention calculation unit: For each node i, its attention weight is determined by the following formula: in, This is the edge attribute bias function.

[0043] In each Transformer computation, the attention weights between node i and its neighbor node j are calculated as follows: ; in: Queries and key matrices for different node types; Edge type bias; This is an edge attribute mapping function used to encode statistical information; Encoding of relative positions based on path length or call depth.

[0044] S45, Structural Information Aggregation Layer: The attention weights are used to perform a weighted summation of the features of neighboring nodes to form an updated node embedding.

[0045] S46, Global Graph Representation Layer: Global embedding vectors are obtained through graph-level pooling (such as Mean, Attention Pooling, or Set2Set), representing the overall structure and semantic features of the contract. The output node representation matrix H' is output.

[0046] S5: Multi-scale feature abstraction extracts features from different levels and frequency ranges to enhance the model's expressive power, such as... Figure 5 As shown.

[0047] Local Conv: Performs multi-kernel depthwise separable convolution on the node feature matrix H', with kernel size {1,3,5,7,9}, to capture local structural patterns.

[0048] Spectral branch: Utilizing the eigenvalues ​​of the Laplace operator L, spectral filtering is performed on the graph signal. ; Where U is the eigenvector matrix. This is the filtering function (which can be approximated using Chebyshev polynomials).

[0049] State-Space Branching: Use state-space modeling structures (such as Mamba or S4 Block) to process node sequences to capture long-distance dependencies across functions.

[0050] Fusion layer: The output features z1, z2, and z3 from the three branches are linearly weighted and fused. ; Where α1, α2, and α3 are the learnable fusion weights of the output features z1, z2, and z3 of the corresponding local branch, frequency domain branch, and state space branch, which are used to generate the fused multi-scale feature vector z.

[0051] S6: Adaptive ensemble decision-making using a meta-learning mechanism is employed for vulnerability type detection to improve the dynamic adaptability and confidence control of classification. The meta-ensemble classification process is as follows: Figure 6 As shown.

[0052] Based on the confidence level output and the explanatory path, automated vulnerability detection and review can be achieved.

[0053] Base classifier cluster: contains various types of classifiers, such as logistic regression (LR), Naive Bayes (NB), gradient boosting tree (GBDT), and lightweight multilayer perceptron (MLP).

[0054] Meta-network prediction unit: It takes the fused multi-scale feature vector z output from step five as input and outputs the dynamic decision weight vector β=(β1,β2,…,βM) corresponding to each base classifier. The dynamic decision weights satisfy Σβm=1 after normalization.

[0055] Classification fusion unit: Each base classifier outputs predicted probabilities p1, p2, ..., pM based on the fused multi-scale feature vector z, and then weights and fuses these predicted probabilities according to the dynamic decision weight vector β to obtain the final vulnerability type prediction result. ; Where βm represents the dynamic decision weights corresponding to the m-th base classifier, and Pm represents the predicted probability vector output by the m-th base classifier. Let represent the weighted and fused comprehensive prediction probability vector, and let the dynamic decision weights satisfy: ; Uncertainty estimation and gating unit: The prediction variance Var(p) is calculated using Monte Carlo Dropout or multi-model ensemble methods as a confidence measure. When Var(p) exceeds a preset threshold, the gating mechanism is triggered to output a "manual review required" flag to prevent incorrect judgment.

[0056] The classification strategy is automatically adjusted based on sample characteristics to achieve both adaptability and security in model prediction. An adaptive ensemble decision mechanism is employed to generate vulnerability type prediction results.

[0057] This invention also provides a smart contract vulnerability detection system, such as... Figure 7 As shown, this can be implemented on a general-purpose server or blockchain security auditing platform, specifically including: The input layer reads Solidity source files as input or as intermediate AST representations. In the model analysis layer, steps S2-S3 are executed to generate the GoG graph structure; the heterogeneous graph Transformer and multi-scale abstract network are loaded.

[0058] The decision-making level performs Meta-Ensemble classification and confidence gating, and outputs vulnerability types and explanations. The output layer outputs the detection results, along with the corresponding key functions, paths, and nodes, in JSON format.

[0059] The system can be integrated into local IDE plugins, automated auditing tools, or cloud-based vulnerability detection platforms to achieve efficient contract security detection.

[0060] The modules in the aforementioned smart contract vulnerability detection system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0061] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps in an embodiment of a smart contract vulnerability detection method. Specific implementation methods can be found in the method embodiments, and will not be repeated here.

[0062] Furthermore, the present invention also provides a non-transitory computer-readable storage medium containing instructions on which a computer program is stored. For example, a memory containing instructions that can be executed by a processor of a computer device to perform the aforementioned method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc. When the computer program is executed by the processor, it can implement the steps in an embodiment of a smart contract vulnerability detection method. Specific implementation methods can be found in the method embodiments, which will not be repeated here.

[0063] Those skilled in the art will understand that embodiments of the present invention can provide methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0064] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0065] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0066] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0067] It should be noted that the specific embodiments described above enable those skilled in the art to more fully understand the present invention, but do not limit the present invention in any way. Therefore, although the present invention has been described in detail in this specification and embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the present invention; and all technical solutions and improvements that do not depart from the spirit and scope of the present invention are covered within the protection scope of the present invention patent. No reference numerals in the claims should be construed as limiting the scope of the claims. Any simple variations or equivalent substitutions of technical solutions that can be readily obtained by those skilled in the art within the scope of the technology disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for detecting smart contract vulnerabilities, characterized in that, Includes the following steps: An abstract syntax tree, control flow graph, and data dependency graph are extracted from the original smart contract to obtain a set of multi-view structure graphs. The nodes and edges of different views in the set of multi-view structure graphs are encoded and fused to output a unified graph representation of the smart contract. Based on the unified graph representation of the smart contract, a hierarchical structure model is performed using the graph-of-graph mechanism to obtain a hierarchical heterogeneous graph. The nodes represent the program elements of the smart contract, and the edges represent the logical relationships between the program elements. The hierarchical heterogeneous graph is encoded with node and edge information using a heterogeneous graph Transformer encoder to obtain a node representation vector that integrates semantic and structural information. Multi-scale feature extraction is performed on the node representation vector, and the extracted multi-scale features are fused using learnable weights. The fused multi-scale features are then processed using a base classifier cluster to obtain the vulnerability type detection result.

2. The smart contract vulnerability detection method according to claim 1, characterized in that, The hierarchical heterogeneous graph is encoded using a heterogeneous graph Transformer encoder to obtain node representation vectors that fuse semantic and structural information. Specifically: Independent query matrices, key matrices, and value matrices are introduced for nodes and edges in hierarchical heterogeneous graphs; To incorporate edge attribute and relative position encoding into the attention mechanism, a multilayer perceptron is used to map edge attribute vectors to attention bias terms. The relative position encoding is calculated based on path length, function call depth, and topological distance in the hierarchical heterogeneous graph. The attention weights between node i and its neighbor node j are calculated as follows: ； in, Queries and key matrices for different node types; Edge type bias; This is an edge attribute mapping function used to encode statistical information; Encoding relative positions based on path length or call depth; The node embedding is updated by weighted summation of the features of neighboring nodes using attention weights, generating a node representation vector that integrates semantic and structural information.

3. The smart contract vulnerability detection method according to claim 1, characterized in that, Multi-scale feature extraction is performed on the node representation vector, and the extracted multi-scale features are fused using learnable weights. Specifically: Multi-scale features are extracted from the node representation vector using local branches, frequency domain branches, and state space branches respectively. Specifically, the node representation vector is subjected to multi-kernel depthwise separable convolution in the local branch; the node representation vector features are decomposed using the Laplacian operator in the frequency domain branch; and the long-distance dependency across functions is captured using the state space modeling structure in the local branch. The multi-scale features extracted from different branches are fused using learnable weights to obtain the fused multi-scale features.

4. The smart contract vulnerability detection method according to claim 1, characterized in that, The process of encoding and fusing nodes and edges of different views in the multi-view structure graph set to output a unified graph representation of smart contracts specifically involves: using static analysis tools to parse the smart contract source code into an AST; generating a control flow graph based on the control dependencies between statements, with edges representing the source code execution path; and generating a data dependency graph through data flow analysis to describe the read-write transmission relationships between variables. The pre-trained code language model is invoked to convert the code fragments corresponding to each AST node into semantic vectors, which are then concatenated with grammatical type features and structural statistical features to form a composite node representation. Attribute vectors are calculated for each edge, and the output is a unified graph representation of the smart contract.

5. The smart contract vulnerability detection method according to claim 1, characterized in that, Based on the unified graph representation of smart contracts, a hierarchical structure model is performed using the graph-of-graph mechanism to obtain a hierarchical heterogeneous graph, specifically including the following steps: The statement-level nodes in the unified graph representation of the smart contract are used as basic nodes, and their semantic-structure vectors are preserved. Each function is treated as a supernode, recording the number of calls, the number of shared variables, and the semantic embedding; function call edges and cross-function variable sharing edges are added to the supernodes to form a multi-relationship network; Establish mapping edges between base nodes and their supernodes to achieve hierarchical associations from statement level to function level, resulting in a hierarchical heterogeneous graph.

6. The smart contract vulnerability detection method according to claim 1, characterized in that, The base classifier cluster includes multiple classifiers. The prediction variance of the classifier output is calculated using Monte Carlo Dropout or multi-model ensemble methods as a confidence measure. When the prediction variance exceeds a preset threshold, a gating mechanism is triggered to require manual review to prevent incorrect judgments.

7. A smart contract vulnerability detection system, characterized in that, include: The data analysis module is used to extract the abstract syntax tree, control flow graph, and data dependency graph from the original smart contract to obtain a set of multi-view structure graphs; The nodes and edges of different views in the multi-view structure graph set are encoded and fused to output a unified graph representation of smart contracts; based on the unified graph representation object of smart contracts, a hierarchical structure model is performed using the graph-of-graph mechanism to obtain a hierarchical heterogeneous graph; the nodes represent program elements of smart contracts, and the edges represent the logical relationships between program elements; The vulnerability detection module is used to encode the node and edge information of the hierarchical heterogeneous graph using a heterogeneous graph Transformer encoder to obtain a node representation vector that integrates semantic and structural information; to extract multi-scale features from the node representation vector, and to fuse the extracted multi-scale features using learnable weights; and to process the fused multi-scale features using a base classifier cluster to obtain the vulnerability type detection result.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is loaded by the processor, it is able to perform the steps of the method according to any one of claims 1 to 6.

Images