A smart contract fuzz testing method and system based on long short-term memory network

Abstract

The present invention proposes a smart contract fuzzy testing method and system based on long short-term memory network, including: collecting the transaction sequence and state sequence before the vulnerability triggering time point of the smart contract and characterizing them using the natural language processing method to obtain the transaction feature sequence and state feature sequence; constructing and training the long short-term memory network; inputting the transaction feature sequence and state feature sequence of the smart contract to be tested into the trained long short-term memory network, the long short-term memory network outputs a transaction and acts on the smart contract to be tested, testing the smart contract, and detecting the vulnerability of the smart contract. By characterizing the transaction sequence and state sequence of the smart contract, the complex transaction information and state information are converted into the transaction feature sequence and state feature sequence that can fully express the transaction information and state information, which can effectively improve the accuracy of the smart contract fuzzy test.

Description

Technical Field

[0001] The present invention relates to the field of deep learning and blockchain technology, and more specifically, to a smart contract fuzzy testing method and system based on long short-term memory network. Background Art

[0002] With the development of blockchain technology, a large number of smart contracts have been applied to different fields, such as financial services, public services, and the Internet of Things. Smart contracts are a special protocol, which is essentially a piece of code deployed on the blockchain, which provides a basis for the combination of blockchain and various fields. Smart contracts are prone to many code security issues, and unlike traditional software, smart contracts cannot be modified once deployed, which also means that security vulnerabilities in smart contracts cannot be modified. Therefore, it is necessary to develop an accurate smart contract vulnerability detection tool. At present, the code security problem can be effectively solved by means of vulnerability detection. Before the deployment of smart contracts, vulnerability detection tools are used to diagnose vulnerabilities, discover vulnerabilities and inform developers to fix them. Among them, fuzz testing is a commonly used method, which can generate test data to input the program for testing and quickly discover program vulnerabilities.

[0003] There is a smart contract vulnerability detection method based on expert rules and serialization modeling, which specifically includes: making a smart contract source code data set; conducting case analysis on the smart contract data set; a contract sequence block conversion method for the smart contract; using a vector conversion tool to map the contract sequence block to a vector; using an expert rule automatic extraction tool to extract reentrancy vulnerability expert rules; constructing a forward neural network and a bidirectional long short-term memory model for learning and training to obtain a highly expressive vector set; constructing a classifier model for learning and training, inputting the expert rules extracted by the forward neural network and the bidirectional long short-term memory model and the feature vector set of the contract sequence block into the classifier model, and outputting the reentrancy vulnerability detection result.

[0004] However, the above method requires the definition of specific expert rules, and has low scalability. When different forms of the same vulnerability appear, the vulnerability cannot be successfully detected, and the detection accuracy and efficiency are low. Summary of the invention

[0005] In order to overcome the problems of low accuracy and efficiency of existing smart contract fuzzy testing, the present invention provides a smart contract fuzzy testing method and system based on long short-term memory network.

[0006] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0007] In a first aspect, the present invention proposes a smart contract fuzz testing method based on a long short-term memory network, comprising the following steps:

[0008] S1: Collect smart contracts with vulnerabilities from Ethereum, and collect the transaction sequence and state sequence before the vulnerability trigger time of the smart contract as the data set.

[0009] S2: Use natural language processing methods to extract the features of transaction sequences and status sequences to obtain transaction feature sequences and status feature sequences.

[0010] S3: Construct a long short-term memory network and train it using transaction feature sequences and state feature sequences.

[0011] S4: Extract the features of the transaction sequence and state sequence of the smart contract to be tested, obtain the transaction feature vector sequence and the contract state feature sequence, and then input the transaction feature sequence and the state feature sequence into the trained long short-term memory network, and the long short-term memory network outputs a transaction;

[0012] S5: Set the number of output transactions, and repeat the process of S4 until the LSTM network outputs the preset number of transactions; apply the transactions output by the LSTM network to the smart contract to be tested, test the smart contract, and detect vulnerabilities in the smart contract.

[0013] In this technical solution, by characterizing the transaction sequence and state sequence of the smart contract, complex transaction information and state information are converted into transaction feature sequences and state feature sequences that can fully express the transaction information and state information. At the same time, the natural language processing method is used to semantically extract the function, so that functions with similar functions have similar feature vectors, which can effectively improve the accuracy and efficiency of smart contract fuzz testing.

[0014] Preferably, S2 specifically includes the following steps:

[0015] S2.1: Perform semantic extraction on the functions called in the transaction sequence to obtain the function feature vector of the transaction sequence.

[0016] S2.2: Convert the parameters, sender and number of Ethereum tokens sent in the transaction sequence into feature vectors, and combine them with the function feature vector as a transaction feature sequence.

[0017] S2.3: Convert the variable values ​​in the smart contract, the number of times the function is called, the balance of the smart contract, and the frequency of the bytecode executed by the smart contract during the last call into a feature vector as a state feature sequence.

[0018] Preferably, in S5, the components of the transaction of the output of the long short-term memory network include the called function, parameters, sender and the number of Ethereum tokens.

[0019] Preferably, a function called in a transaction sequence is selected from a smart contract, and the long short-term memory network outputs a function feature vector according to the selected function.

[0020] Preferably, the parameters of the top n transaction sequences with the highest occurrence frequency are selected from the smart contract as the output parameters of the long short-term memory network.

[0021] Preferably, the sender of the output of the long short-term memory network is any one of a contract creator, a contract trustor, or a contract attacker.

[0022] Preferably, the number of Ethereum tokens of the top n transaction sequences with the highest occurrence frequency is selected from the smart contract as the number of Ethereum tokens output by the long short-term memory network.

[0023] Preferably, in S3, a cross-validation method is used to train the long short-term memory network using a stochastic gradient descent method.

[0024] Preferably, in S4, smart contract vulnerabilities include suicide contracts, dependency on block status, uncontrolled program errors, unverified return values, token locks, token leaks, transaction order dependency, and integer overflow.

[0025] In a second aspect, the present invention further proposes a smart contract fuzzy testing system based on a long short-term memory network, which is applied to the smart contract fuzzy testing method based on a long short-term memory network proposed in any of the above schemes, including:

[0026] The data collection module is used to collect smart contracts with vulnerabilities from Ethereum and collect the transaction sequence and state sequence before the vulnerability triggering time of the smart contract as a data set;

[0027] A feature extraction module is used to extract features from the transaction sequence and the state sequence to obtain a transaction feature sequence and a state feature sequence;

[0028] A network construction module is used to construct a long short-term memory network and train the long short-term memory network using transaction feature sequences and state feature sequences;

[0029] The test module is used to test smart contracts and detect vulnerabilities in smart contracts.

[0030] Compared with the prior art, the beneficial effects of the technical solution of the present invention are as follows: the present invention converts complex transaction information and status information into transaction feature sequences and status feature sequences that can fully express the transaction information and status information by characterizing the transaction sequence and status sequence of the smart contract, and uses natural language processing methods to perform semantic extraction of functions, so that functions with similar functions have similar feature vectors, which can effectively improve the accuracy and efficiency of smart contract fuzzy testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The flowchart of the smart contract fuzz testing method based on long short-term memory network.

[0032] Figure 2 The flowchart of the smart contract fuzz testing method based on long short-term memory network.

[0033] Figure 3 The schematic diagram of the smart contract fuzz testing system based on long short-term memory network. DETAILED DESCRIPTION

[0034] The drawings are for illustrative purposes only and should not be construed as limiting the present patent;

[0035] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0036] Example 1

[0037] See also Figure 1 , this embodiment proposes a smart contract fuzz testing method based on long short-term memory network, including the following steps:

[0038] S1: Collect smart contracts with vulnerabilities from Ethereum, and collect the transaction sequence and state sequence before the vulnerability trigger time of the smart contract as the data set.

[0039] S2: Extract the features of transaction sequence and state sequence to obtain transaction feature sequence and state feature sequence.

[0040] S3: Construct a long short-term memory network and train it using transaction feature sequences and state feature sequences.

[0041] S4: Extract the features of the transaction sequence and state sequence of the smart contract to be tested, obtain the transaction feature vector sequence and the contract state feature sequence, and then input the transaction feature sequence and the state feature sequence into the trained long short-term memory network, and the long short-term memory network outputs a transaction;

[0042] S5: Set the number of output transactions, and repeat the process of S4 until the LSTM network outputs the preset number of transactions; apply the transactions output by the LSTM network to the smart contract to be tested, test the smart contract, and detect vulnerabilities in the smart contract.

[0043] In the specific implementation process, by characterizing the transaction sequence and state sequence of the smart contract, the complex transaction information and state information are converted into transaction feature sequences and state feature sequences that can fully express the transaction information and state information. At the same time, the natural language processing method is used to semantically extract the function, so that functions with similar functions have similar feature vectors, which can effectively improve the accuracy and efficiency of smart contract fuzz testing.

[0044] Example 2

[0045] See also Figure 1-Figure 2 , this embodiment proposes a smart contract fuzz testing method based on long short-term memory network, including the following steps:

[0046] S1: Collect smart contracts with vulnerabilities from Ethereum, and collect the transaction sequence and state sequence before the vulnerability trigger time of the smart contract as the data set;

[0047] This embodiment collects smart contracts with vulnerabilities from the contract library, and collects the transaction sequence and state sequence of the smart contract before the vulnerability trigger time point from Xblock.pro. This embodiment develops a private chain of smart contracts based on Go Ethereum as a virtual operating environment, modifies part of the code to facilitate fuzz testing, and quickly executes smart contracts by sending transactions in the virtual environment. Among them, for the needs of testing, the virtual operating environment will randomly generate multiple accounts as senders of transactions, including the creator, trustor, and attacker of the contract to be tested.

[0048] S2: Extracting features of transaction sequence and state sequence to obtain transaction feature sequence and state feature sequence, specifically including the following steps:

[0049] S2.1: Extract semantics of functions called in the transaction sequence to obtain the function feature vector of the transaction sequence;

[0050] S2.2: convert the parameters, sender and amount of Ethereum tokens sent in the transaction sequence into a feature vector, and combine it with the function feature vector as a transaction feature sequence;

[0051] S2.3: Convert the variable values ​​in the smart contract, the number of times the function is called, the balance of the smart contract, and the frequency of the bytecode executed by the smart contract during the last call into a feature vector as a state feature sequence.

[0052] In the specific implementation process, the function feature vector of the transaction sequence is obtained by using the unsupervised embedding method commonly used in semantic extraction for the functions called in the transaction sequence, so that functions with similar names have feature vectors with similar distances; the integer parameters in each transaction in the transaction sequence, the number of Ethereum tokens sent, and other digital features are converted into feature vectors, which are combined with the function feature vector as the transaction feature vector to obtain the transaction feature sequence; the integer variable values ​​in the smart contract, the number of function calls, the balance of the contract, and the frequency of bytecode executed by the contract during the last call, and other digital features are converted into feature vectors as the state feature sequence.

[0053] S3: Construct a long short-term memory network and train it using transaction feature sequences and state feature sequences.

[0054] This embodiment adopts a cross-validation approach and uses a stochastic gradient descent method to train the long short-term memory network.

[0055] In the specific implementation process, for a transaction sequence that triggers a vulnerability in the data set, a method similar to sequence to sequence is used to first erase the second half of the transaction sequence (including the transaction that triggers the vulnerability), and then input the first half of the transaction sequence into the long short-term memory network. Then, through back-propagation training, the long short-term memory network is enabled to output a transaction sequence similar to the original second half of the erased transaction sequence. Finally, the long short-term memory network is trained using cross-validation and stochastic gradient descent methods.

[0056] The input of the LSTM network is the transaction feature sequence and state feature sequence of the smart contract, and the output is the transaction. The components of the transaction include the called function, parameters, sender, and the number of Ethereum tokens sent. In the process of training the LSTM network, the LSTM network outputs a probability distribution for the optional function, optional parameter, optional number of Ethereum coins, and optional sender type, and selects the function, parameter, number of Ethereum coins, and sender type with the highest probability. The selection method of each element is as follows:

[0057] Called function: The function called in the transaction sequence is selected from the data set, and the long short-term memory network outputs a function feature vector based on the selected function.

[0058] Parameters: Most of the parameters in the smart contract are integers. This embodiment selects the parameters of the top n transaction sequences with the highest occurrence frequency from the data set as the output parameters of the long short-term memory network.

[0059] Sender: The sender of the LSTM output is any one of the contract creator, contract trustor, or contract attacker.

[0060] The number of Ethereum tokens sent: The number of Ethereum tokens in the top n transaction sequences with the highest frequency in the dataset is selected as the number of Ethereum tokens output by the LSTM network.

[0061] S4: Extract the features of the transaction sequence and state sequence of the smart contract to be tested, obtain the transaction feature vector sequence and the contract state feature sequence, and then input the transaction feature sequence and the state feature sequence into the trained long short-term memory network, and the long short-term memory network outputs a transaction.

[0062] S5: Set the number of output transactions, and repeat the process of S4 until the LSTM network outputs the preset number of transactions; apply the transactions output by the LSTM network to the smart contract to be tested, test the smart contract, and detect vulnerabilities in the smart contract.

[0063] In this embodiment, the input of the long short-term memory network is the transaction feature sequence and state feature sequence of the smart contract, and the output is a transaction. The components of the transaction include the called function, parameters, sender, and the number of Ethereum tokens sent. In the process of testing the smart contract, the selection method of each element is as follows:

[0064] Called function: The function called in the transaction sequence is selected from the smart contract to be tested, and the long short-term memory network outputs a function feature vector based on the selected function.

[0065] Parameters: Most of the parameters in the smart contract are integers. This embodiment selects the parameters of the transaction sequence with the highest frequency from the smart contract to be tested as the output parameters of the long short-term memory network.

[0066] Sender: The sender of the LSTM output is any one of the contract creator, contract trustor, or contract attacker.

[0067] The number of Ethereum tokens sent: The number of Ethereum tokens in the transaction sequence with the highest frequency in the smart contract to be tested is selected as the number of Ethereum tokens output by the LSTM network.

[0068] In this embodiment, the vulnerabilities of the smart contract include suicide contracts, dependency on block status, uncontrolled program errors, unverified return values, token locks, token leaks, transaction order dependency, and integer overflow. The characteristics of the above vulnerabilities are as follows:

[0069] Suicide contract: A smart contract can be destroyed by any user.

[0070] Dependence on block status: The number of tokens transferred by the smart contract and the conditions for transfer are related to the status of the block, such as the block timestamp.

[0071] Uncontrolled program errors: The smart contract does not handle function call errors of external contracts.

[0072] Unverified return value: The smart contract does not verify the return value of the external call function.

[0073] Token lock: The tokens of the smart contract cannot be withdrawn.

[0074] Token leakage: Smart contract tokens can be stolen by attackers.

[0075] Transaction order dependency: The smart contract status may lead to different results due to different transaction orders.

[0076] Integer overflow: The smart contract's integer variable overflows.

[0077] In this embodiment, vulnerabilities are detected based on the execution log of the smart contract. The corresponding detection mode is designed to match the content in the log to achieve the purpose of detecting vulnerabilities. For integer overflow of the smart contract, this embodiment provides a pseudo code:

[0078]

[0079] For this smart contract, if the original balanceOf[attacker.address]=1, the attacker sends a transaction (withdraw(uint256),2,attacker.address,0) to contract A, where withdraw(uint256) is the function called by the smart contract, 2 is the parameter of the smart contract, attacker.address is the address of the sender of the smart contract, and 0 is the number of Ethereum tokens. Since balanceOf[msg.sender]-amount=-1<0, it will cause integer underflow, making the value of balanceOf[msg.sender] become 2^256-2 (the largest integer is 2^256-1), so that the attacker has a lot of Ethereum in the smart contract, and then he can transfer all the Ethereum in the contract.

[0080] In the specific implementation process, we make full use of the transaction sequence and state sequence information of the smart contract, based on the deep neural network long short-term memory network's powerful ability to process sequence change information, and use the long short-term memory network to extract serialized transaction information and state information, thereby generating high-quality input samples. By checking whether the transaction history and state history in the test process have corresponding features, the vulnerability of the smart contract can be detected with a relatively small number of tests. In addition, by characterizing the transaction sequence and state sequence of the smart contract, the complex transaction information and state information are converted into transaction feature sequences and state feature sequences that can fully express the transaction information and state information. At the same time, the natural language processing method is used to extract the semantics of the function, so that functions with similar functions have similar feature vectors, which can effectively improve the accuracy and efficiency of the smart contract fuzzy test.

[0081] Example 3

[0082] See also Figure 3 This embodiment proposes a smart contract fuzzy testing system based on long short-term memory network, which is applied to the smart contract fuzzy testing method based on long short-term memory network proposed in the above embodiment, including: data collection module, feature extraction module, network construction module and test module.

[0083] In the specific implementation process, the data collection module collects smart contracts with vulnerabilities from Ethereum and collects the transaction sequence and state sequence before the vulnerability triggering time point of the smart contract as the data set; the feature extraction module extracts features from the transaction sequence and state sequence to obtain transaction feature sequence and state feature sequence; the network construction module constructs a long short-term memory network, and trains the long short-term memory network using transaction feature sequence and state feature sequence; the testing module tests the smart contract to detect vulnerabilities in the smart contract.

[0084] The terms used in the drawings to describe positional relationships are only used for illustrative purposes and should not be construed as limiting this patent;

[0085] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A smart contract fuzz testing method based on long short-term memory network, characterized in that: The following steps are involved: S1: Collect smart contracts with vulnerabilities from Ethereum, and collect the transaction sequence and state sequence before the vulnerability trigger time of the smart contract as the data set; S2: Use natural language processing methods to extract the features of transaction sequences and status sequences, and obtain transaction feature sequences and status feature sequences, including: S2.1: Extract semantics of functions called in the transaction sequence to obtain the function feature vector of the transaction sequence; S2.2: convert the parameters, sender and amount of Ethereum tokens sent in the transaction sequence into a feature vector, and combine it with the function feature vector as a transaction feature sequence; S2.3: Convert the variable values ​​in the smart contract, the number of times the function is called, the balance of the smart contract, and the frequency of the bytecode executed when the smart contract was last called into a feature vector as a state feature sequence; S3: Construct a long short-term memory network and train it using transaction feature sequences and state feature sequences; S4: Extract the features of the transaction sequence and state sequence of the smart contract to be tested, obtain the transaction feature vector sequence and the contract state feature sequence, and then input the transaction feature sequence and the state feature sequence into the trained long short-term memory network, and the long short-term memory network outputs a transaction; S5: Set the number of output transactions, and repeat the process of S4 until the LSTM network outputs the preset number of transactions; apply the transactions output by the LSTM network to the smart contract to be tested, test the smart contract, and detect vulnerabilities in the smart contract.

2. The smart contract fuzz testing method based on long short-term memory network according to claim 1 is characterized in that: The components of the transaction for the LSTM output include the called function, parameters, sender and the amount of Ethereum tokens.

3. The smart contract fuzz testing method based on long short-term memory network according to claim 2 is characterized in that: The function called in the transaction sequence is selected from the smart contract, and the long short-term memory network outputs a function feature vector based on the selected function.

4. The smart contract fuzz testing method based on long short-term memory network according to claim 2 is characterized in that: Select the parameters of the top n transaction sequences with the highest frequency from the smart contract as the output parameters of the long short-term memory network.

5. The smart contract fuzz testing method based on long short-term memory network according to claim 2 is characterized in that: The sender of the LSTM output is any one of the contract creator, contract trustor, or contract attacker.

6. The smart contract fuzz testing method based on long short-term memory network according to claim 2 is characterized in that: The number of Ethereum tokens in the top n transaction sequences with the highest frequency in the smart contract is selected as the number of Ethereum tokens output by the long short-term memory network.

7. The smart contract fuzz testing method based on long short-term memory network according to claim 1 is characterized in that: In S3, the cross-validation method is used to train the long short-term memory network using the stochastic gradient descent method.

8. The smart contract fuzz testing method based on long short-term memory network according to claim 1 is characterized in that: In S4, smart contract vulnerabilities include suicide contracts, dependency on block status, uncontrolled program errors, unverified return values, token locks, token leaks, transaction order dependency, and integer overflow.

9. A smart contract fuzzy testing system based on long short-term memory network, applied to the smart contract fuzzy testing method based on long short-term memory network as described in any one of claims 1 to 8, characterized in that: include: The data collection module is used to collect smart contracts with vulnerabilities from Ethereum and collect the transaction sequence and state sequence before the vulnerability triggering time of the smart contract as a data set; A feature extraction module is used to extract features from the transaction sequence and the state sequence to obtain a transaction feature sequence and a state feature sequence; A network construction module is used to construct a long short-term memory network and train the long short-term memory network using transaction feature sequences and state feature sequences; The test module is used to test smart contracts and detect vulnerabilities in smart contracts.

Images