Smart contract vulnerability detection method, system, computer device and storage medium

Abstract

The present invention discloses a smart contract vulnerability detection method, system, computer equipment and storage medium, the method comprising: obtaining a smart contract data set according to the smart contract vulnerability type; converting the smart contract in the smart contract data set into an operation code sequence, and using the operation code sequence as a training sample; using the training sample to train the smart contract vulnerability detection model to obtain a trained smart contract vulnerability detection model; wherein the smart contract vulnerability detection model is a smart contract vulnerability detection model based on an average random gradient descent weighted long short-term memory network; converting the smart contract to be detected into an operation code sequence, and inputting the trained smart contract vulnerability detection model to obtain the corresponding detection result. The detection model constructed by the present invention can realize the detection of multiple vulnerability types; the method disclosed by the present invention has the advantages of being simple, efficient and highly extensible.

Description

Technical Field

[0001] The present invention relates to the technical field of smart contract vulnerability detection, and in particular to a smart contract vulnerability detection method, system, computer device and storage medium. Background Art

[0002] Blockchain technology has become one of the most popular technologies in the financial industry. After the blockchain 1.0 era represented by Bitcoin applications, it has now entered the blockchain 2.0 era marked by smart contracts. Smart contracts are adapted to the distributed and decentralized characteristics of blockchains. They have the excellent characteristics of independent operation and non-tamperability, and can be used to implement various distributed applications including financial instruments. However, smart contracts inevitably have security vulnerabilities. From the theft of 3.6 million ethers in The DAO incident in 2016, to the freezing of hundreds of millions of dollars in funds in the Parity wallet due to a multi-signature wallet contract vulnerability in 2017, to the EOS vulnerability that allows malicious contracts to penetrate virtual machines and endanger miner nodes, smart contracts have become a disaster area for blockchain security.

[0003] At present, vulnerability detection of smart contracts at home and abroad mainly relies on traditional vulnerability detection methods, such as symbolic execution, formal analysis, etc. In the process of vulnerability detection using symbolic execution technology, it is necessary to traverse all execution paths in the program and determine the path conditions, so vulnerability detection using symbolic execution technology takes a lot of time. Summary of the invention

[0004] In order to address the deficiencies of the above-mentioned prior art, the present invention provides a smart contract vulnerability detection method, system, computer device and storage medium, which can improve the vulnerability detection efficiency and realize the detection of multiple vulnerability types.

[0005] The first object of the present invention is to provide a smart contract vulnerability detection method.

[0006] The second object of the present invention is to provide a smart contract vulnerability detection system.

[0007] A third object of the present invention is to provide a computer device.

[0008] A fourth object of the present invention is to provide a storage medium.

[0009] The first object of the present invention can be achieved by adopting the following technical solutions:

[0010] A method for detecting smart contract vulnerabilities, the method comprising:

[0011] Obtain smart contract datasets based on smart contract vulnerability types;

[0012] Convert the smart contracts in the smart contract data set into operation code sequences, and use the operation code sequences as training samples;

[0013] Using the training samples to train the smart contract vulnerability detection model to obtain a trained smart contract vulnerability detection model; wherein the smart contract vulnerability detection model is a smart contract vulnerability detection model based on an average stochastic gradient descent weighted long short-term memory network;

[0014] Converting the smart contract to be tested into an operation code sequence, where the operation code sequence is the operation code sequence to be tested;

[0015] The operation code sequence to be tested is input into the trained smart contract vulnerability detection model to obtain corresponding detection results.

[0016] Furthermore, converting the smart contracts in the smart contract data set into an operation code sequence specifically includes:

[0017] According to the smart contract dataset, a smart contract dataset with vulnerability labels is obtained;

[0018] According to the smart contracts in the smart contract dataset with vulnerability labels, an operation code sequence is obtained.

[0019] Furthermore, obtaining a smart contract dataset with vulnerability labels based on the smart contract dataset specifically includes:

[0020] Cleaning the smart contract data set to obtain a processed smart contract data set;

[0021] Vulnerability classification and labeling are performed on the processed smart contract dataset to obtain a smart contract dataset with vulnerability labels.

[0022] Furthermore, obtaining an operation code sequence according to the smart contract in the smart contract data set with vulnerability labels specifically includes:

[0023] Select key operation codes based on the smart contract vulnerability type;

[0024] Obtaining a smart contract operation code sequence according to the smart contract in the smart contract data set;

[0025] Simplifying the smart contract operation code sequence to obtain a simplified operation code sequence;

[0026] The simplified operation code sequence is extracted using the key operation code to obtain an operation code sequence.

[0027] Furthermore, obtaining a smart contract operation code sequence according to the smart contract in the smart contract data set specifically includes:

[0028] The source code of the smart contract in the smart contract data is compiled by a compiler to obtain the corresponding bytecode;

[0029] Then, a disassembler is used to convert the bytecode into a smart contract operation code sequence including operands;

[0030] The simplification of the smart contract operation code sequence to obtain a simplified operation code sequence specifically includes:

[0031] According to the operation code rules of the Ethereum virtual machine, multiple identical operation codes in the smart contract operation code sequence are unified into one operation code, and all operands in the smart contract operation code sequence are removed to obtain a simplified operation code sequence;

[0032] The extracting the simplified operation code sequence by using the key operation code to obtain the operation code sequence specifically includes:

[0033] For each key operation code appearing in the simplified operation code sequence, a plurality of operation codes before and after the key operation code are selected to form a context sequence of the key operation code;

[0034] The context sequences of all key operation codes in the simplified operation code sequence are extracted and reorganized into an operation code sequence in the original order. If the context sequences of two adjacent key operation codes have overlapping parts, they are only retained once.

[0035] Furthermore, the smart contract vulnerability detection model includes a language model and a vulnerability classification model, wherein:

[0036] The language model is used to predict the next opcode of an opcode in an opcode sequence;

[0037] The language model includes an input layer, an Embedding layer, a plurality of averaged stochastic gradient descent weighted long short-term memory network layers and a Softmax layer;

[0038] The vulnerability classification model is used to classify vulnerabilities using word vectors trained by the language model;

[0039] The vulnerability classification model includes an Embedding layer, multiple average random gradient descent weight long short-term memory network layers, a fully connected layer and a classifier layer.

[0040] Furthermore, the input layer is used to receive an operation code sequence;

[0041] The Embedding layer is used to convert each opcode in the opcode sequence into a word vector, so as to map the opcode sequence into a multi-dimensional space;

[0042] The average stochastic gradient descent weighted long short-term memory network layer is used to learn the contextual relationship of the word vectors in the opcode sequence, obtain the opcode sequence feature vector, and use DropConnect and ASGD to prevent overfitting and filter redundant information;

[0043] Softmax layer, used to adjust the language model parameters and use the softmax function for back propagation;

[0044] The fully connected layer is used to reduce the dimension of the opcode sequence feature vector to improve the accuracy of the smart contract vulnerability detection model;

[0045] The classifier layer is used to implement a multi-classification task according to multiple vulnerability labels, and uses a softmax function to implement multi-classification.

[0046] The second object of the present invention can be achieved by adopting the following technical solutions:

[0047] A smart contract vulnerability detection system, the system comprising:

[0048] Smart contract data set acquisition module, used to obtain smart contract data sets according to the smart contract vulnerability type;

[0049] A first data processing module, configured to convert the smart contracts in the smart contract data set into operation code sequences, and use the operation code sequences as training samples;

[0050] A smart contract vulnerability detection model training module, used to train the smart contract vulnerability detection model using the training samples to obtain a trained smart contract vulnerability detection model; wherein the smart contract vulnerability detection model is a smart contract vulnerability detection model based on an average stochastic gradient descent weighted long short-term memory network;

[0051] A second data processing module is used to convert the smart contract to be tested into an operation code sequence, where the operation code sequence is the operation code sequence to be tested;

[0052] The smart contract vulnerability detection module is used to input the operation code sequence to be tested into the trained smart contract vulnerability detection model to obtain corresponding detection results.

[0053] Furthermore, the first data processing module includes a data preprocessing unit and an operation code processing unit, wherein:

[0054] The data preprocessing unit is used to clean the smart contract data set and classify and mark the vulnerabilities to obtain a smart contract data set with vulnerability labels;

[0055] The opcode processing unit is used to convert the smart contracts in the smart contract data set into a smart contract opcode sequence, simplify the smart contract opcode sequence according to the opcode rules of Ethereum, extract the key opcodes related to the corresponding vulnerabilities, and integrate all the key opcodes and their contexts to obtain the opcode sequence;

[0056] The smart contract vulnerability detection model includes a language model and a vulnerability classification model, where:

[0057] A language model to predict the next opcode of an opcode in an opcode sequence;

[0058] The vulnerability classification model is used to classify vulnerabilities using word vectors trained by the language model.

[0059] The third object of the present invention can be achieved by adopting the following technical solutions:

[0060] A computer device includes a processor and a memory for storing a program executable by the processor. When the processor executes the program stored in the memory, the above-mentioned smart contract vulnerability detection method is implemented.

[0061] The fourth object of the present invention can be achieved by adopting the following technical solutions:

[0062] A storage medium stores a program, which, when executed by a processor, implements the above-mentioned smart contract vulnerability detection method.

[0063] The present invention has the following beneficial effects compared with the prior art:

[0064] 1. The present invention reduces the influence of redundant operation codes on the detection results by simplifying the operation code sequence.

[0065] 2. The present invention extracts context information based on the key opcodes extracted according to the corresponding vulnerability types, so the final integrated opcode sequence reflects the vulnerability information more specifically, and compared with directly using the opcode sequence, the length of the sequence is greatly reduced, which not only shortens the model training time, but also solves the problems of model gradient disappearance and model instability caused by too long a sequence.

[0066] 3. The smart contract vulnerability detection model constructed by the present invention uses an average random gradient descent weighted long short-term memory network model. The model includes a language model and a vulnerability classification model. The language model is used to train the feature vector of the opcode sequence; the vulnerability classification model is used to classify smart contracts with different vulnerability types to achieve detection of multiple vulnerability types.

[0067] 4. Compared with the prior art methods, which can only detect one or several specific vulnerabilities or detect multiple vulnerability types through multiple binary classifier models, the present invention has the advantages of simplicity, high efficiency and high scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0069] Figure 1 This is a flow chart of a smart contract vulnerability detection method according to Embodiment 1 of the present invention.

[0070] Figure 2 This is a structural diagram of the smart contract vulnerability detection model of Example 1 of the present invention.

[0071] Figure 3 This is a structural block diagram of the smart contract vulnerability detection system of Example 2 of the present invention.

[0072] Figure 4 This is a structural block diagram of a computer device according to Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. It should be understood that the specific embodiments described are only used to explain the present application and are not used to limit the present application.

[0074] Embodiment 1:

[0075] like Figure 1 As shown, this embodiment provides a smart contract vulnerability detection method, which is divided into four stages, namely data preprocessing, operation code processing, vulnerability smart contract vulnerability detection model construction and smart contract vulnerability detection, wherein:

[0076] Data preprocessing: Vulnerability classification and vulnerability labeling are performed on the smart contract data set. Vulnerability classification can adopt the existing more mature traditional vulnerability detection methods.

[0077] Opcode processing: Convert the smart contract into a smart contract opcode sequence (opcode sequence X), simplify the opcode sequence X according to Ethereum’s opcode rules, extract the key opcodes related to the corresponding vulnerability, and finally integrate all the key opcodes and their contexts to obtain the first opcode sequence (i.e., the final opcode sequence Y).

[0078] Model training: A smart contract vulnerability detection model (i.e., a multivariate classification model) based on the average stochastic gradient descent weighted long short-term memory network is established. The operation code sequence Y of the smart contract dataset is used in combination with the vulnerability labels marked by the data preprocessing module to generate training samples that are input into the smart contract vulnerability detection model for model training to obtain a smart contract vulnerability detection model.

[0079] Smart contract vulnerability detection: The smart contract to be detected is processed into an operation code sequence Y, which is input into the smart contract vulnerability detection model to detect multiple vulnerabilities.

[0080] Based on the above four stages, the smart contract vulnerability detection method provided in this embodiment specifically includes the following steps:

[0081] S101. Obtain a smart contract dataset according to the smart contract vulnerability type; wherein the smart contract dataset includes the smart contract source code.

[0082] This embodiment selects three vulnerability types for classification using a smart contract vulnerability detection model. According to the three vulnerability types, smart contract source code data is downloaded from Google Bigquery as a smart contract data set.

[0083] S102. Obtain a smart contract dataset with vulnerability labels based on the smart contract dataset.

[0084] Further, step S102 includes:

[0085] (1) Clean the smart contract dataset to obtain the processed smart contract dataset.

[0086] Conduct targeted analysis on the smart contract source code in the smart contract dataset and clean the smart contract dataset: delete redundant data, duplicate data, and missing data in the smart contract dataset.

[0087] (2) Vulnerability classification and labeling are performed on the processed smart contract dataset to obtain a smart contract dataset with vulnerability labels.

[0088] This step uses one-hot encoding to classify and label the samples (smart contract source code) in the processed smart contract dataset. Specifically, it uses traditional vulnerability detection tools or manual analysis to perform vulnerability detection analysis on the samples in the processed smart contract dataset, and labels each sample according to the vulnerability type. The label is the vulnerability type of the smart contract; there are three types of vulnerabilities, that is, the sample data corresponds to three types of labels.

[0089] After processing from step (1) to step (2) above, the original smart contract dataset is converted into a smart contract dataset with vulnerability labels, and each sample in the processed smart contract dataset corresponds to a label.

[0090] S103. Convert the smart contracts in the smart contract dataset with vulnerability labels into operation code sequences, and use the operation code sequences as training samples.

[0091] Further, step S103 includes:

[0092] (1) Select key operation codes based on the type of smart contract vulnerability.

[0093] In this embodiment, the key operation code is the operation code related to the generation of the vulnerability selected after analyzing the principles of different smart contract vulnerability types.

[0094] By fully analyzing the behavior patterns and generation principles of various vulnerability types, we select CALL, CALLCODE and DELEGATECALL related to exception processing vulnerabilities, DELEGATECALL, GAS, GASPRICE and GASLIMIT related to reentrancy vulnerabilities, and TIMESTAMP related to timestamp dependency vulnerabilities as key operation codes for the three vulnerability types of exception processing vulnerabilities, reentrancy vulnerabilities and timestamp dependency vulnerabilities.

[0095] (2) Based on the smart contracts in the smart contract dataset with vulnerability labels, the smart contract operation code sequence is obtained.

[0096] The smart contract source code data in the smart contract dataset with vulnerability labels is compiled by a compiler to obtain the corresponding bytecode, and then the bytecode is converted into a smart contract opcode sequence containing operands using a disassembler, which is recorded as opcode sequence X to distinguish it from the optimized opcode sequence.

[0097] Since the number of samples of different vulnerability types varies greatly, it is necessary to perform class imbalance processing on the smart contract opcode sequence, specifically: clean up different samples with the same opcode combination and keep one sample. Thus, the cleaned smart contract opcode sequence is obtained.

[0098] (3) Simplify the cleaned smart contract operation code sequence to obtain a simplified operation code sequence.

[0099] The smart contract opcode sequence is simplified according to the opcode rules of the Ethereum virtual machine. Specifically, multiple opcodes with the same essential principles are unified into one opcode. For example, PUSH1, PUSH2, PUSH3, etc. can all be converted into PUSH; at the same time, all operands are removed.

[0100] (4) Using key operation codes to extract the simplified operation code sequence, the operation code sequence is obtained as a training sample.

[0101] After analyzing the principle of vulnerability generation, the corresponding key operation codes are obtained, but these key operation codes are not sufficient conditions for the generation of vulnerabilities. In addition to being related to these key operation codes, the generation of vulnerabilities also depends on the context environment in the sequence. Therefore, it is necessary to intercept the context sequence of the key operation codes and integrate them into the first operation code sequence.

[0102] According to the key operation code selected in the above step (1), the key operation code is extracted from the simplified operation code sequence. The specific process is as follows:

[0103] If the operation code in the simplified operation code sequence is any of the key operation codes selected in step (1), the operation codes related to the n bits before and after the operation code (i.e., the first n bits and the last n bits of the key operation code) are selected to form a context sequence of the key operation code. According to this process, the context sequences of all the key operation codes in the operation code sequence are extracted, and then reorganized into the first operation code sequence according to the order of the operation codes in the original simplified operation code sequence. If two adjacent key operation code sequences have overlapping parts, only one is retained.

[0104] The following is an example of the above process:

[0105] In this example, the value of n is 3. After simplification, the opcode sequence is "PUSH PUSH CALL PUSH PUSHSSTORE GASPRICE DUP ISZERO PUSH JUMP PUSH DUP REVERT JUMPDEST POP PUSH DUPPUSH PUSH". If the selected key opcodes are CALL and GASPRICE, the context sequence of the key opcode of CALL is "PUSH PUSH CALL PUSH PUSH SSTORE", and the context sequence of the key opcode of GASPRICE is "PUSHPUSH SSTORE GASPRICE DUP ISZERO PUSH". There is an overlap between two adjacent key opcode sequences, which is only retained once. Therefore, the merged opcode sequence is "PUSH PUSH CALL PUSH PUSH SSTORE GASPRICE DUPISZERO PUSH".

[0106] After processing through steps (1) to (4) above, the smart contract dataset with vulnerability labels is processed into the standard input required by the model.

[0107] S104. Build a smart contract vulnerability detection model.

[0108] The smart contract vulnerability detection model is a smart contract vulnerability detection model based on the average stochastic gradient descent weighted long short-term memory network.

[0109] like Figure 2 As shown in the figure, the smart contract vulnerability detection model includes two network models. The language model is used to predict the next opcode of the opcode in the first opcode sequence, and the vulnerability classification model uses the word vector trained by the language model to classify vulnerabilities. The language model includes an input layer, an Embedding layer, three average random gradient descent weighted long short-term memory network layers, and a Softmax layer; the second network includes an Embedding layer, three average random gradient descent weighted long short-term memory network layers, a fully connected layer, and a classifier layer; among them:

[0110] The input layer is used to receive the processed smart contract data set, and the input data is the first operation code sequence;

[0111] In the Embedding layer, each word can be regarded as a vector, which is mainly used to convert each opcode in the first opcode sequence into a word vector, thereby mapping the first opcode sequence into a multidimensional space. Using the Embedding algorithm in this layer can capture the potential relationship between opcodes;

[0112] The average stochastic gradient descent weighted long short-term memory network layer is mainly used to learn the contextual relationship of the word vector in the first opcode sequence and obtain the feature vector of the opcode sequence. DropConnect and ASGD are used to prevent overfitting and filter redundant information;

[0113] The Softmax layer is a classifier layer that uses the softmax function for back propagation to adjust the parameters of the language model (i.e., the weight matrix);

[0114] The fully connected layer is mainly used to reduce the dimension of the feature vector of the learned opcode sequence to improve the accuracy of the model;

[0115] Classifier layer: Implement multi-class classification tasks based on multiple vulnerability labels and use the softmax function to implement multi-class classification.

[0116] S105. Use the training samples to train the smart contract vulnerability detection model to obtain a trained smart contract vulnerability detection model.

[0117] Further, step S105 includes:

[0118] (1) Divide the training samples into test samples.

[0119] Use part of the training sample data as training samples, and the other part as test samples.

[0120] (2) Use the training samples to train the smart contract vulnerability detection model to obtain a trained smart contract vulnerability detection model.

[0121] When classifying vulnerabilities, use label X = (x1, x2, ..., xN) to represent N vulnerability types;

[0122] In this embodiment, N is 3.

[0123] The data in the training samples are input into the smart contract vulnerability detection model, and each detected vulnerability type corresponds to a label; the trained smart contract vulnerability detection model has a good detection effect on N types of vulnerabilities.

[0124] After training, the data in the test sample is used to verify the effect.

[0125] S106. Convert the smart contract to be tested into an operation code sequence; and input the trained smart contract vulnerability detection model to obtain the corresponding detection result.

[0126] According to steps S102-S103, the smart contract to be detected is converted into an operation code sequence, and the obtained operation code sequence is input into the trained smart contract vulnerability detection model to obtain the corresponding detection results, thereby realizing the detection of multiple vulnerabilities.

[0127] Those skilled in the art will appreciate that all or part of the steps in the method for implementing the above embodiments may be completed by instructing related hardware through a program, and the corresponding program may be stored in a computer-readable storage medium.

[0128] It should be noted that although the method operations of the above embodiments are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. On the contrary, the steps depicted can be performed in a different order. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0129] Embodiment 2:

[0130] like Figure 3 As shown, this embodiment provides a smart contract vulnerability detection system. In order to facilitate the use of the method of Example 1 to perform customized smart contract vulnerability detection, the system includes a smart contract data set acquisition module 301, a first data processing module 302, a smart contract vulnerability detection model training module 303, a second data processing module 304 and a smart contract vulnerability detection module 305, wherein:

[0131] A smart contract data set acquisition module 301 is used to acquire a smart contract data set according to the smart contract vulnerability type;

[0132] A first data processing module 302, configured to convert the smart contracts in the smart contract data set into an operation code sequence, and use the operation code sequence as a training sample;

[0133] A smart contract vulnerability detection model training module 303 is used to train the smart contract vulnerability detection model using the training samples to obtain a trained smart contract vulnerability detection model; wherein the smart contract vulnerability detection model is a smart contract vulnerability detection model based on an average stochastic gradient descent weighted long short-term memory network;

[0134] The second data processing module 304 is used to convert the smart contract to be tested into an operation code sequence, where the operation code sequence is the operation code sequence to be tested;

[0135] The smart contract vulnerability detection module 305 is used to input the operation code sequence to be tested into the trained smart contract vulnerability detection model to obtain corresponding detection results.

[0136] Further, the first data processing module includes a data preprocessing unit and an operation code processing unit, wherein:

[0137] The data preprocessing unit is used to clean the smart contract data set and classify and label the vulnerabilities to obtain a smart contract data set with vulnerability labels. Use one-hot Encoding to label the vulnerability classification labels, that is, use the label X = (x1, x2, ..., xN), where xN = 0 means that the smart contract does not belong to the Nth type of vulnerability, and xN = 1 means that the smart contract belongs to the Nth type of vulnerability;

[0138] The opcode processing unit is used to convert the smart contracts in the smart contract data set with vulnerability labels into smart contract opcode sequences (opcode sequence X), simplify the smart contract opcode sequences according to the opcode rules of Ethereum, and then extract the key opcodes related to the corresponding vulnerabilities from the simplified smart contract opcode sequences, and finally integrate all the key opcodes and their contexts to obtain the opcode sequence;

[0139] Furthermore, the smart contract vulnerability detection model includes two network models, namely the language model and the vulnerability classification model; among them:

[0140] Language model, used to predict the next word in a sentence. It includes input layer, Embedding layer, multiple averaged stochastic gradient descent weighted long short-term memory network layers and Softmax layer;

[0141] The vulnerability classification model is used to classify vulnerabilities using word vectors trained by the language model. It includes an embedding layer, multiple averaged random gradient descent weighted long short-term memory network layers, a fully connected layer, and a classifier layer.

[0142] Furthermore, the smart contract vulnerability detection system may also include a file upload module; the file upload module is used to upload smart contracts in the smart contract data set and smart contracts to be detected. Users can upload smart contracts in a customized smart contract data set and smart contracts to be detected for subsequent model training and vulnerability detection.

[0143] The specific implementation of each module in this embodiment can refer to the above-mentioned embodiment 1, which will not be described one by one here; it should be noted that the system provided in this embodiment is only illustrated by the division of the above-mentioned functional modules. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure can be divided into different functional modules to complete all or part of the functions described above.

[0144] Embodiment 3:

[0145] This embodiment provides a computer device, which may be a computer, such as Figure 4As shown, a processor 402, a memory, an input device 403, a display 404 and a network interface 405 connected via a system bus 401 are provided. The processor is used to provide computing and control capabilities. The memory includes a non-volatile storage medium 406 and an internal memory 407. The non-volatile storage medium 406 stores an operating system, a computer program and a database. The internal memory 407 provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. When the processor 402 executes the computer program stored in the memory, the smart contract vulnerability detection method of the above-mentioned embodiment 1 is implemented as follows:

[0146] Obtain smart contract datasets based on smart contract vulnerability types;

[0147] Convert the smart contracts in the smart contract data set into operation code sequences, and use the operation code sequences as training samples;

[0148] Using the training samples to train the smart contract vulnerability detection model to obtain a trained smart contract vulnerability detection model; wherein the smart contract vulnerability detection model is a smart contract vulnerability detection model based on an average stochastic gradient descent weighted long short-term memory network;

[0149] Converting the smart contract to be tested into an operation code sequence, where the operation code sequence is the operation code sequence to be tested;

[0150] The operation code sequence to be tested is input into the trained smart contract vulnerability detection model to obtain corresponding detection results.

[0151] Embodiment 4:

[0152] This embodiment provides a storage medium, which is a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the smart contract vulnerability detection method of the above embodiment 1 is implemented as follows:

[0153] Obtain smart contract datasets based on smart contract vulnerability types;

[0154] Convert the smart contracts in the smart contract data set into operation code sequences, and use the operation code sequences as training samples;

[0155] Using the training samples to train the smart contract vulnerability detection model to obtain a trained smart contract vulnerability detection model; wherein the smart contract vulnerability detection model is a smart contract vulnerability detection model based on an average stochastic gradient descent weighted long short-term memory network;

[0156] Converting the smart contract to be tested into an operation code sequence, where the operation code sequence is the operation code sequence to be tested;

[0157] The operation code sequence to be tested is input into the trained smart contract vulnerability detection model to obtain corresponding detection results.

[0158] It should be noted that the computer-readable storage medium of the present embodiment may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0159] In summary, the present invention cleans the smart contracts in the smart contract data set and classifies the vulnerabilities to obtain a smart contract data set with vulnerability labels; converts the smart contracts in the smart contract data set with vulnerability labels into an operation code sequence X, simplifies the operation code sequence X according to the operation code rule of the Ethereum virtual machine, and extracts the operation codes related to different vulnerability types as key operation sequences to obtain an operation code sequence Y as a training sample; establishes a smart contract vulnerability detection model based on an average stochastic gradient descent weighted long short-term memory network, and trains the smart contract vulnerability detection model using training samples; converts the smart contract to be detected into an operation code sequence Y, and then inputs it into the trained smart contract vulnerability detection model to detect multiple vulnerabilities.

[0160] The above is only a preferred embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical solution and inventive concept of the present invention within the scope disclosed by the present invention, which shall fall within the protection scope of the present invention.

Claims

1. A smart contract vulnerability detection method, characterized in that: The method comprises: Obtain smart contract datasets based on smart contract vulnerability types; Convert the smart contracts in the smart contract data set into operation code sequences; the operation code sequences are used as training samples; The smart contract vulnerability detection model is trained using the training samples to obtain a trained smart contract vulnerability detection model; the smart contract vulnerability detection model includes a language model and a vulnerability classification model, wherein the language model is used to predict the next operation code of the operation code in the operation code sequence, including an input layer, an Embedding layer, a plurality of average random gradient descent weight long short-term memory network layers and a Softmax layer; the vulnerability classification model is used to classify vulnerabilities using word vectors trained by the language model, including an Embedding layer, a plurality of average random gradient descent weight long short-term memory network layers, a fully connected layer and a classifier layer; the input layer is used to receive the operation code sequence; the Embedding layer is used to convert the operation code sequence into a word vector. Each opcode in the opcode sequence is converted into a word vector, thereby mapping the opcode sequence to a multidimensional space; the average random gradient descent weighted long short-term memory network layer is used to learn the contextual relationship of the word vectors in the opcode sequence, obtain the opcode sequence feature vector, and use DropConnect and ASGD to prevent overfitting and filter redundant information; the Softmax layer is used to adjust the language model parameters and use the softmax function for back propagation; the fully connected layer is used to reduce the dimension of the opcode sequence feature vector to improve the accuracy of the smart contract vulnerability detection model; the classifier layer: used to implement multi-classification tasks according to multiple vulnerability labels, and use the softmax function to implement multi-classification; Converting the smart contract to be tested into an operation code sequence; the operation code sequence is the operation code sequence to be tested; Inputting the operation code sequence to be tested into the trained smart contract vulnerability detection model to obtain corresponding detection results; The converting of the smart contracts in the smart contract data set into an operation code sequence specifically includes: According to the smart contract dataset, a smart contract dataset with vulnerability labels is obtained; Select key operation codes based on the smart contract vulnerability type; The source code of the smart contract in the smart contract data is compiled by a compiler to obtain the corresponding bytecode; Then, a disassembler is used to convert the bytecode into a smart contract opcode sequence containing operands; According to the operation code rules of the Ethereum virtual machine, multiple identical operation codes in the smart contract operation code sequence are unified into one operation code, and all operands in the smart contract operation code sequence are removed to obtain a simplified operation code sequence; For each key operation code appearing in the simplified operation code sequence, a plurality of operation codes before and after the key operation code are selected to form a context sequence of the key operation code; The context sequences of all key operation codes in the simplified operation code sequence are extracted and reorganized into an operation code sequence in the original order. If the context sequences of two adjacent key operation codes have overlapping parts, they are only retained once.

2. The smart contract vulnerability detection method according to claim 1, characterized in that: The step of obtaining a smart contract dataset with vulnerability labels according to the smart contract dataset specifically includes: Cleaning the smart contract data set to obtain a processed smart contract data set; Vulnerability classification and labeling are performed on the processed smart contract dataset to obtain a smart contract dataset with vulnerability labels.

3. A smart contract vulnerability detection system, characterized in that: The system comprises: Smart contract data set acquisition module, used to obtain smart contract data sets according to the smart contract vulnerability type; A first data processing module, configured to convert the smart contracts in the smart contract data set into operation code sequences, and use the operation code sequences as training samples; A smart contract vulnerability detection model training module is used to train the smart contract vulnerability detection model using the training samples to obtain a trained smart contract vulnerability detection model; the smart contract vulnerability detection model includes a language model and a vulnerability classification model, wherein the language model is used to predict the next opcode of the opcode in the opcode sequence, including an input layer, an Embedding layer, a plurality of average random gradient descent weighted long short-term memory network layers and a Softmax layer; the vulnerability classification model is used to classify vulnerabilities using word vectors trained by the language model, including an Embedding layer, a plurality of average random gradient descent weighted long short-term memory network layers, a fully connected layer and a classifier layer; the input layer is used to receive the opcode sequence; the Embedding The layer is used to convert each opcode in the opcode sequence into a word vector, thereby mapping the opcode sequence to a multidimensional space; the average random gradient descent weighted long short-term memory network layer is used to learn the contextual relationship of the word vectors in the opcode sequence, obtain the opcode sequence feature vector, and use DropConnect and ASGD to prevent overfitting and filter redundant information; the Softmax layer is used to adjust the language model parameters and use the softmax function for back propagation; the fully connected layer is used to reduce the dimension of the opcode sequence feature vector to improve the accuracy of the smart contract vulnerability detection model; the classifier layer: used to implement multi-class classification tasks according to multiple vulnerability labels, and use the softmax function to implement multi-class classification; A second data processing module is used to convert the smart contract to be tested into an operation code sequence; the operation code sequence is the operation code sequence to be tested; A smart contract vulnerability detection module, used to input the operation code sequence to be tested into the trained smart contract vulnerability detection model to obtain corresponding detection results; Wherein, the first data processing module is specifically used for: According to the smart contract dataset, a smart contract dataset with vulnerability labels is obtained; Select key operation codes based on the smart contract vulnerability type; The source code of the smart contract in the smart contract data is compiled by a compiler to obtain the corresponding bytecode; Then, a disassembler is used to convert the bytecode into a smart contract opcode sequence containing operands; According to the operation code rules of the Ethereum virtual machine, multiple identical operation codes in the smart contract operation code sequence are unified into one operation code, and all operands in the smart contract operation code sequence are removed to obtain a simplified operation code sequence; For each key operation code appearing in the simplified operation code sequence, a plurality of operation codes before and after the key operation code are selected to form a context sequence of the key operation code; The context sequences of all key operation codes in the simplified operation code sequence are extracted and reorganized into an operation code sequence in the original order. If the context sequences of two adjacent key operation codes have overlapping parts, they are only retained once.

4. A storage medium storing a program, characterized in that: When the program is executed by the processor, the smart contract vulnerability detection method described in any one of claims 1-2 is implemented.

Images