A smart contract vulnerability detection method, system, device, medium, and terminal

Abstract

The present invention belongs to the field of blockchain security technology, and discloses a smart contract vulnerability detection method, system, device, medium, and terminal. The smart contract vulnerability detection method includes: using a large-scale smart contract vulnerability data set as a basic training data set; using new class data for incremental learning training; dividing all class test data into a support set and a test set, using the support set data to input the trained model, and obtaining the fully connected network parameters corresponding to each new vulnerability type; using the fully connected network parameters corresponding to the existing vulnerability type and the new vulnerability type as network nodes, and using a graph attention network to establish an observation bypass; using the test set to calculate and predict the calculation cross entropy loss of the result; using the cross entropy loss to update the parameters of the graph attention network in the observation bypass, and continue to train the next batch of new data sets. The present invention can train the model's continuous learning ability while training the learning vulnerability detection ability based on the old data set.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain security technology, relates to the field of smart contract security detection, and in particular to a smart contract vulnerability detection method, system, equipment, medium, and terminal. Background Art

[0002] At present, smart contracts are programs running on blockchain platforms. Like ordinary software, smart contracts also face various risks. Most smart contracts on blockchain platforms involve the transaction and processing of digital assets or cryptocurrencies. Since attacks on blockchain platforms using vulnerabilities in smart contracts can obtain huge benefits, attacks on smart contract vulnerabilities are endless. In recent years, some researchers have begun to use deep learning to perform security detection on smart contracts and have achieved good results. The current smart contract detection model based on deep learning can only detect fixed-type vulnerabilities in the data set. In actual application scenarios, newly discovered vulnerabilities will inevitably be encountered. In this case, the current deep learning detection model needs to merge the newly discovered vulnerability data set with the original existing data set for training. This training method is inefficient and is not conducive to the rapid update of deep learning models when computing resources are limited. Humans have the ability to learn continuously. When learning new knowledge, they do not need to relearn old knowledge. In the end, they can have both new and old knowledge at the same time. Inspired by this, researchers in related fields have proposed incremental learning methods, but the application of incremental learning to deep learning models will lead to catastrophic forgetting. In the incremental learning process, only new categories of data sets are used to train the deep learning model. New knowledge will interfere with old knowledge, resulting in the loss of old knowledge, which will affect the performance of the model and even completely lose the ability to classify existing categories. Therefore, a new smart contract vulnerability detection method is urgently needed to make up for the shortcomings of existing technologies and enhance the security performance of smart contracts.

[0003] Through the above analysis, the problems and defects of the prior art are as follows:

[0004] (1) The current smart contract detection model based on deep learning can only detect fixed-type vulnerabilities in the data set, which does not meet the actual application scenarios.

[0005] (2) When encountering newly discovered vulnerabilities in actual application scenarios, the current deep learning detection model needs to merge the newly discovered vulnerability dataset and the original existing dataset together for training. This training method is inefficient and is not conducive to the rapid update of the deep learning model when computing resources are limited.

[0006] (3) Applying incremental learning to deep learning models will lead to the problem of catastrophic forgetting. In the incremental learning process, only new category data sets are used to train the deep learning model. The new knowledge will interfere with the old knowledge, resulting in the loss of old knowledge, affecting the model performance, or even completely losing the ability to classify the category.

[0007] The difficulty of solving the above problems and defects is: how to overcome catastrophic forgetting. On the one hand, we hope that the model can also show the ability to integrate new knowledge from new data and refine existing knowledge. On the other hand, we must prevent new inputs from significantly interfering with existing knowledge. These two conflicting requirements are the so-called stability-plasticity dilemma. Training the model from scratch can undoubtedly solve the problem of catastrophic forgetting, but this method is very inefficient and greatly hinders the model from learning new data in real time. How to find a balance point with greater utility in the stability-plasticity dilemma under the condition of limited computing and storage resources has become the main problem. In addition, the current incremental learning requires a high level of experience from researchers. Because before the model is effective, not only a lot of training is required, but the incremental learning method is also very complex and the training cycle is also long.

[0008] The significance of solving the above problems and defects is that by using incremental learning, new data can be effectively used to train and further improve the model. In addition, the incremental learning method can better understand and imitate the learning method of the human brain from a system level, providing a technical foundation for model development and algorithm learning. Summary of the invention

[0009] In view of the problems existing in the prior art, the present invention provides a smart contract vulnerability detection method, system, device, medium, and terminal, and more particularly, relates to a smart contract vulnerability detection method, system, device, medium, and terminal based on incremental learning.

[0010] The present invention is implemented as follows: a smart contract vulnerability detection method, the smart contract vulnerability detection method comprising:

[0011] A two-stage model is established. In the first stage, a feature extraction model is established using a graph neural network, the smart contract is converted into multiple graphs, and the graph neural network is used to complete the feature extraction of the smart contract. In the second stage, a classification model is established using a convolutional neural network, and the feature vectors extracted in the first stage are input into the classification model to classify the smart contract.

[0012] Furthermore, the smart contract vulnerability detection method includes the following steps:

[0013] Step 1: Use the large-scale smart contract vulnerability dataset as the basic training dataset, called base class data; call the newly discovered vulnerability dataset new class data; so as to use the base class data to train the network parameters of the first-stage graph neural network and the second-stage convolutional neural network;

[0014] Step 2: After the training is completed, use the new class data for incremental learning training. During the training process, the parameters of the first-stage graph neural network are fixed. The graph neural network only provides feature extraction functions and outputs smart contract feature vectors. The purpose is to use this feature vector as the input vector of the downstream neural network for classification training.

[0015] Step 3: Divide all the test data of all classes into two parts, called support set and test set. Use the support set data to input the trained model to obtain the fully connected network parameters corresponding to each new vulnerability type. This is done to facilitate the testing of the classification effect. Use another set of training samples as the test set to perform trial classification to evaluate the convergence of its cost function.

[0016] Step 4: Use the fully connected network parameters corresponding to the existing vulnerability types and the new vulnerability types as network nodes, use the graph attention network to establish an observation bypass, and perform node updates to optimize the expression accuracy of the input data through dynamic adjustments;

[0017] Step 5: Update the new network parameters to the classification model, use the test set to calculate, and predict the cross entropy loss of the results, because the effect of the model can be easily measured by derivative calculation;

[0018] In step 6, the cross entropy loss obtained in step 5 is used to update the parameters of the graph attention network in the observation bypass, and the next batch of new data sets are trained to stabilize the learning results.

[0019] Further, in step 1, the training includes incremental learning model base class data training and incremental learning model new class data training; wherein the incremental learning model base class data training includes:

[0020] (1) Feature extraction: Use base class data to convert smart contracts into multiple graphs, and use graph neural networks to extract features from smart contracts.

[0021] (2) Classification training: The extracted feature vector is input into the classification model for classification training.

[0022] Furthermore, the incremental learning model new type data training includes:

[0023] (1) Feature extraction: Use new class data to convert smart contracts into multiple graphs, and use graph neural networks to extract features from smart contracts without updating network parameters.

[0024] (2) Classification training: The extracted feature vector is input into the classification model for classification training.

[0025] Furthermore, the smart contract vulnerability detection method further includes incremental learning model classification parameter fusion, and the incremental learning model classification parameter fusion includes:

[0026] After the features of the base class data of the incremental learning model and the new class data of the incremental learning model are extracted, the class vector node information is aggregated respectively, and the bypass graph attention network is observed to perform class training on the base class data of the incremental learning model and the new class data of the incremental learning model respectively.

[0027] Another object of the present invention is to provide a smart contract vulnerability detection system using the smart contract vulnerability detection method, wherein the smart contract vulnerability detection comprises:

[0028] The dataset acquisition module is used to use large-scale smart contract vulnerability datasets as basic training datasets, called base class data; and the newly discovered vulnerability datasets are called new class data;

[0029] A data training module is used to train the network parameters of the first-stage graph neural network and the second-stage convolutional neural network using base class data;

[0030] Incremental learning training module: After training is completed, it is used to perform incremental learning training using new types of data. During the training process, the parameters of the first-stage graph neural network are fixed. The graph neural network only provides feature extraction functions and outputs smart contract feature vectors.

[0031] The network parameter acquisition module is used to divide all class test data into two parts, namely the support set and the test set; the support set data is used to input the trained model to obtain the fully connected network parameters corresponding to each new vulnerability type;

[0032] The observation bypass construction module is used to use the fully connected network parameters corresponding to the existing vulnerability types and the new vulnerability types as network nodes, use the graph attention network to establish an observation bypass, and perform node updates;

[0033] The test set calculation module is used to update the new network parameters into the classification model, calculate the cross entropy loss using the test set, and predict the results;

[0034] The parameter updating module is used to update the parameters of the graph attention network in the observation bypass using the obtained cross entropy loss and continue training the next batch of new data sets.

[0035] Another object of the present invention is to provide a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor performs the following steps:

[0036] A two-stage model is established. In the first stage, a feature extraction model is established using a graph neural network, the smart contract is converted into multiple graphs, and the graph neural network is used to complete the feature extraction of the smart contract. In the second stage, a classification model is established using a convolutional neural network, and the feature vectors extracted in the first stage are input into the classification model to classify the smart contract.

[0037] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the following steps:

[0038] A two-stage model is established. In the first stage, a feature extraction model is established using a graph neural network, the smart contract is converted into multiple graphs, and the graph neural network is used to complete the feature extraction of the smart contract. In the second stage, a classification model is established using a convolutional neural network, and the feature vectors extracted in the first stage are input into the classification model to classify the smart contract.

[0039] Another object of the present invention is to provide an information data processing terminal, which is used to implement the smart contract vulnerability detection system.

[0040] Another object of the present invention is to provide an application of the smart contract vulnerability detection system in the smart contract vulnerability detection of a blockchain platform.

[0041] Combining all the above technical solutions, the advantages and positive effects of the present invention are as follows: the smart contract vulnerability detection method provided by the present invention designs a two-stage smart contract vulnerability detection model, which can train the model's continuous learning ability while training and learning vulnerability detection capabilities based on old data sets. When the model is trained using a new data set alone, the ability to recognize existing vulnerability types can be retained as much as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 It is a flow chart of the smart contract vulnerability detection method provided by an embodiment of the present invention.

[0044] Figure 2 It is a structural block diagram of a smart contract vulnerability detection system provided by an embodiment of the present invention;

[0045] In the figure: 1. Data set acquisition module; 2. Data training module; 3. Incremental learning training module; 4. Network parameter acquisition module; 5. Observation bypass construction module; 6. Test set calculation module; 7. Parameter update module.

[0046] Figure 3 It is a flowchart of base class data training of the incremental learning model provided by an embodiment of the present invention.

[0047] Figure 4 It is a flowchart of base class data training of the incremental learning model provided by an embodiment of the present invention.

[0048] Figure 5 It is a flow chart of classification parameter fusion of the incremental learning model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0050] In view of the problems existing in the prior art, the present invention provides a smart contract vulnerability detection method, system, device, medium, and terminal. The present invention is described in detail below with reference to the accompanying drawings.

[0051] like Figure 1 As shown, the smart contract vulnerability detection method provided by the embodiment of the present invention includes the following steps:

[0052] S101, using a large-scale smart contract vulnerability dataset as the basic training dataset, called base class data; calling the newly discovered vulnerability dataset new class data; using the base class data to train the network parameters of the first-stage graph neural network and the second-stage convolutional neural network;

[0053] S102: After the training is completed, new class data is used for incremental learning training. During the training process, the parameters of the first-stage graph neural network are fixed, and the graph neural network only provides feature extraction function and outputs the smart contract feature vector.

[0054] S103, dividing all the class test data into two parts, namely a support set and a test set; using the support set data to input the trained model to obtain the fully connected network parameters corresponding to each new vulnerability type;

[0055] S104, using the fully connected network parameters corresponding to the existing vulnerability types and the new vulnerability types as network nodes, using the graph attention network to establish an observation bypass, and perform node updates;

[0056] S105, updating the new network parameters into the classification model, using the test set to calculate, and predicting the calculated cross entropy loss of the results;

[0057] S106, use the cross entropy loss obtained in S105 to update the parameters of the graph attention network in the observation bypass, and continue training the next batch of new data sets.

[0058] like Figure 2 As shown, the smart contract vulnerability detection system provided by the embodiment of the present invention includes:

[0059] Dataset acquisition module 1 is used to use large-scale smart contract vulnerability datasets as basic training datasets, called base class data; and to use newly discovered vulnerability datasets as new class data;

[0060] Data training module 2, used to train the network parameters of the first-stage graph neural network and the second-stage convolutional neural network using base class data;

[0061] Incremental learning training module 3, after training is completed, is used to perform incremental learning training using new class data; during the training process, the parameters of the first-stage graph neural network are fixed, and the graph neural network only provides feature extraction functions and outputs smart contract feature vectors;

[0062] The network parameter acquisition module 4 is used to divide all the class test data into two parts, namely the support set and the test set; the support set data is used to input the trained model to obtain the fully connected network parameters corresponding to each new vulnerability type;

[0063] An observation bypass construction module 5 is used to use the fully connected network parameters corresponding to the existing vulnerability types and the new vulnerability types as network nodes, use the graph attention network to establish an observation bypass, and perform node updates;

[0064] The test set calculation module 6 is used to update the new network parameters into the classification model, calculate using the test set, and calculate the cross entropy loss of the prediction result;

[0065] The parameter updating module 7 is used to update the parameters of the graph attention network in the observation bypass using the obtained cross entropy loss, and continue training the next batch of new data sets.

[0066] The technical solution of the present invention is further described below in conjunction with specific embodiments.

[0067] Example 1

[0068] 1) The development environment uses TensorFlow-2.1.0.

[0069] 2) Import the configuration file, change the scale and parameters of the fully connected neural network into dynamic configuration, and use python3 to read it. The fully connected neural network model consists of an input layer, a hidden layer, and an output layer. The three parameters input_nodes, output_nodes, and hidden_layer_size in the configuration file respectively define the number of input nodes (features), the number of output vectors (fitting results or judgment classification), the number of hidden layers, and the number of neurons in each hidden layer. By changing these parameters, neural networks of different scales can be defined.

[0070] 3) Perform base class distribution statistics. We try to use one or more samples to estimate the overall data distribution of the category.

[0071] 4) Transform the dataset distribution. In order to make the feature distribution of each class in the dataset more like a Gaussian distribution, we first use Tukey step transformation to transform the features of the support set and query set in the target task. After feature calibration, new classes can be sampled.

[0072] 5) Dataset distribution migration. Based on the assumption that the base class has enough data to obtain accurate data distribution, we transfer the statistical information of the base class to the new class.

[0073] 6) Train the classifier to detect unlabeled smart contracts and achieve classification tasks.

[0074] The purpose of the present invention is to propose a smart contract vulnerability detection method based on incremental learning. The method designs a two-stage smart contract vulnerability detection model. While training and learning vulnerability detection capabilities based on old data sets, it can also train the model's continuous learning ability. When the model is trained using a new data set alone, the ability to recognize existing vulnerability types can be retained as much as possible.

[0075] The smart contract vulnerability detection method provided by the embodiment of the present invention comprises the following steps:

[0076] A two-stage model is established. In the first stage, a feature extraction model is established using a graph neural network to convert the smart contract into multiple graphs. The graph neural network is used to complete the feature extraction of the smart contract. In the second stage, a classification model is established using a convolutional neural network. The feature vector extracted in the first stage is input into the classification model to classify the smart contract.

[0077] The specific deployment is as follows:

[0078] In the first step, the present invention uses the existing large-scale smart contract vulnerability dataset as the basic training dataset, called base class data, and the newly discovered vulnerability dataset as new class data. The base class data is used to train the network parameters of the first-stage graph neural network and the second-stage convolutional neural network.

[0079] In the second step, after the first step of training is completed, new class data is used for incremental learning training. During the training process, the parameters of the first stage graph neural network are fixed. The graph neural network only provides feature extraction function and outputs the smart contract feature vector.

[0080] The third step is to divide all class test data into two parts, called support set and test set, use the support set data to input the trained model, and then obtain the fully connected network parameters corresponding to each new vulnerability type.

[0081] In the fourth step, the fully connected network parameters corresponding to the existing vulnerability types and the new vulnerability types are used as network nodes, and an observation bypass is established using the graph attention network, and then the nodes are updated.

[0082] The fifth step is to update the new network parameters to the classification model, use the test set to calculate, and predict the cross entropy loss of the results.

[0083] In the sixth step, the cross entropy loss obtained in the fifth step is used to update the parameters of the graph attention network in the observation bypass.

[0084] Step 7: Continue training the next batch of new data sets.

[0085] The incremental learning model base class data training flow chart provided by the embodiment of the present invention is as follows Figure 3 As shown, the incremental learning model base class data training flow chart provided by the embodiment of the present invention is as follows Figure 4 As shown, the incremental learning model classification parameter fusion flow chart provided by the embodiment of the present invention is as follows Figure 5 shown.

[0086] The technical effects of the present invention are described in detail below in conjunction with experiments.

[0087] The learning models of the present invention, 5way1shot and 5way5shot, are respectively selected and tested with the latest Simpleshot and YangICLR2021 models. From the data performance, the model of the present invention is superior to the comparison models in both 5way1shot and 5way5shot.

[0088]

[0089] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When the use is implemented in whole or in part in the form of a computer program product, the computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL) or wireless (e.g., infrared, wireless, microwave, etc.) mode) to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk SolidState Disk (SSD)), etc.

[0090] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A smart contract vulnerability detection method, characterized in that: The smart contract vulnerability detection method includes: establishing a two-stage model, in which a graph neural network is used to establish a feature extraction model in the first stage, the smart contract is converted into multiple graphs, and the graph neural network is used to complete the smart contract feature extraction; in the second stage, a convolutional neural network is used to establish a classification model, and the feature vector extracted in the first stage is input into the classification model to classify the smart contract; The smart contract vulnerability detection method comprises the following steps: Step 1: Use the large-scale smart contract vulnerability dataset as the basic training dataset, called base class data; call the newly discovered vulnerability dataset new class data; use the base class data to train the network parameters of the first-stage graph neural network and the second-stage convolutional neural network; Step 2: After the training is completed, use the new class data for incremental learning training. During the training process, the parameters of the first-stage graph neural network are fixed. The graph neural network only provides feature extraction functions and outputs smart contract feature vectors. Step 3: Divide all the test data into two parts, called support set and test set. Use the support set data to input the trained model to obtain the fully connected network parameters corresponding to each new vulnerability type. Step 4: Use the fully connected network parameters corresponding to the existing vulnerability types and the new vulnerability types as network nodes, use the graph attention network to establish an observation bypass, and update the nodes; Step 5: Update the new network parameters to the classification model, use the test set to calculate, and calculate the cross entropy loss of the prediction results; Step 6: Use the cross entropy loss obtained in step 5 to update the parameters of the graph attention network in the observation bypass, and continue training the next batch of new data sets; In step 1, the training includes incremental learning model base class data training and incremental learning model new class data training; wherein the incremental learning model base class data training includes: (1) Feature extraction: Use base class data to convert smart contracts into multiple graphs, and use graph neural networks to extract features from smart contracts. (2) Classification training: The extracted feature vector is input into the classification model for classification training.

2. The smart contract vulnerability detection method according to claim 1, characterized in that: The incremental learning model new type data training includes: (1) Feature extraction: Use new class data to convert smart contracts into multiple graphs, and use graph neural networks to extract features from smart contracts without updating network parameters. (2) Classification training: The extracted feature vector is input into the classification model for classification training.

3. The smart contract vulnerability detection method according to claim 1, characterized in that: The smart contract vulnerability detection method further includes incremental learning model classification parameter fusion, and the incremental learning model classification parameter fusion includes: After the features of the base class data of the incremental learning model and the new class data of the incremental learning model are extracted, the class vector node information is aggregated respectively, and the bypass graph attention network is observed to perform class training on the base class data of the incremental learning model and the new class data of the incremental learning model respectively.

4. A smart contract vulnerability detection system implementing the smart contract vulnerability detection method according to any one of claims 1 to 3, characterized in that: The smart contract vulnerability detection includes: The dataset acquisition module is used to use large-scale smart contract vulnerability datasets as basic training datasets, called base class data; and the newly discovered vulnerability datasets are called new class data; A data training module is used to train the network parameters of the first-stage graph neural network and the second-stage convolutional neural network using base class data; Incremental learning training module: After training is completed, it is used to perform incremental learning training using new types of data. During the training process, the parameters of the first-stage graph neural network are fixed. The graph neural network only provides feature extraction functions and outputs smart contract feature vectors. The network parameter acquisition module is used to divide all class test data into two parts, namely the support set and the test set; the support set data is used to input the trained model to obtain the fully connected network parameters corresponding to each new vulnerability type; The observation bypass construction module is used to use the fully connected network parameters corresponding to the existing vulnerability types and the new vulnerability types as network nodes, use the graph attention network to establish an observation bypass, and update the nodes; The test set calculation module is used to update the new network parameters into the classification model, calculate the cross entropy loss using the test set, and predict the results; The parameter updating module is used to update the parameters of the graph attention network in the observation bypass using the obtained cross entropy loss and continue training the next batch of new data sets.

5. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the smart contract vulnerability detection method according to any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the smart contract vulnerability detection method according to any one of claims 1 to 3.

7. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the smart contract vulnerability detection system as described in claim 4.

8. An application of the smart contract vulnerability detection system as described in claim 4 in smart contract vulnerability detection on a blockchain platform.

Images