A consortium chain contract threat detection method

Abstract

The application combines the technical field of dynamic analysis, and provides a consortium chain contract threat detection method, which can detect and process security vulnerabilities of a contract before the contract is formally deployed. The main scheme includes an index function generation module: through a large amount of data, the execution characteristics of the contract are obtained by simulating the execution of the contract, and an index function is constructed; a data variation module: inputting the specification data sample of the execution contract, according to the execution characteristics of the contract and the format requirements of the data, selecting the correct fuzz strategy, generating the data after variation, caching the data after variation, and waiting for the threat discovery module to request or provide data for re-variation; a threat discovery module: obtaining the data after variation from the data variation module, simulating the execution of the contract, obtaining the execution result of the variation data, and matching with the index function, if the deviation reaches a certain value, a threat warning is output.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of software security and the field of blockchains, and provides a consortium chain contract threat detection method. BACKGROUND

[0002] With the continuous popularization of computer software, the security of software is becoming more and more important. As people have more and more functional requirements for software, the software itself becomes more and more complex, and it is difficult to completely avoid vulnerabilities in development, so it is necessary to detect vulnerabilities.

[0003] Software vulnerability detection technology mainly includes static analysis and dynamic analysis.

[0004] Static analysis technology can statically analyze the security of the code itself without executing the program itself. This technology can find vulnerabilities in the development stage, greatly reducing the cost of fixing vulnerabilities. And static analysis needs very few resources. But static analysis also has some shortcomings. Since it is not a program that runs security analysis, for dynamic languages such as javascript, python, etc., it is not possible to determine the class or type of the object at compile time, making the accuracy of static analysis not high. Therefore, in order to make up for some shortcomings of static analysis, dynamic analysis has developed.

[0005] Dynamic analysis technology tests the security vulnerabilities in the program by simulating malicious behavior, and confirms where it can be exploited. Since this dynamic test can simulate the behavior of malicious users, it can accurately show the enterprise the running situation of the program in the actual application environment, and is very reliable. But dynamic analysis needs more resources than static analysis.

[0006] Fuzz testing is a method of software security testing. Traditional manual testing requires testers to manually simulate malicious user behavior to attack the application, which is very inefficient and requires high technical level of testers. Fuzz testing generates a large amount of test data according to the format requirements of the data and the requirements of the communication protocol, using tools to generate test data according to templates, liberating the labor of testers. Since the data generated by fuzz testing has a wider range, it is also easier to find some data that cannot be found by manual testing.

[0007] Blockchain is a very hot technology today. Due to the unique transparency, traceability, and non-tamperability of blockchain technology, blockchain can play an irreplaceable role in some specific scenarios.

[0008] Consortium chain is an implementation of blockchain. Due to its permissioned nature of participating nodes, this implementation has become the most accepted implementation in production practice.

[0009] The contract on the alliance chain and the implementation on other blockchains are different, the design of the contract on the alliance chain is more single, because the main function requirement of the alliance chain is to operate data, so the contract code model is single, the vulnerability type range is smaller, and the threat detection is easier to implement. SUMMARY

[0010] The application discloses a kind of alliance chain contract threat detection method.In the current alliance chain development process, there is no detection for contract.Therefore, reliable contract detection method for alliance chain needs to be researched, which can detect and handle the security vulnerabilities of contract before formal deployment of contract.The detection method for the security of blockchain alliance chain contract based on software analysis method of the present application has reliable contract vulnerability discovery capability, and can detect the vulnerabilities of contract in time.

[0011] To achieve the above purpose, the technical scheme is as follows:

[0012] A kind of alliance chain contract threat detection method, comprising the following modules:

[0013] Indicator function generation module: a large amount of data is simulated to execute contract to obtain execution characteristics, and an indicator function is constructed;

[0014] Data variation module: input the specification data sample of execution contract, according to the execution characteristics of contract, the format requirement of data, select the correct fuzz strategy, generate the data after variation, cache the variation data after variation, wait for threat detection module request or provide data for revariation;

[0015] Threat detection module: obtain the variation data after variation from data variation module, simulate execution contract, obtain the execution result of variation data, match with indicator function, if deviate to a certain value, output threat warning.

[0016] In the above technical scheme, in the indicator function generation module:

[0017] 1) daily production data is used as data source to obtain a large amount of reasonable input data;

[0018] 2) select key value as execution characteristics of input data in key-value key-value pair of input data;

[0019] 3) input the input data obtained in step 1 in test environment and execute contract to obtain execution result;

[0020] 4) associate execution result with execution characteristics to obtain indicator function.

[0021] In the above technical scheme, in the data variation module:

[0022] 1) Daily production data as a data source, obtain a large number of reasonable input data;

[0023] 2) According to the input data format specification, select the appropriate mutation strategy;

[0024] 3) According to the mutation strategy, the input data is mutated to obtain the mutation data;

[0025] 4) The mutation data obtained in step 3 is cached.

[0026] In the above technical solution, the threat discovery module includes four parts: mutation data input, test environment contract execution, index function matching, and output threat detection results. The module mainly includes the following steps:

[0027] S1: Collect the mutation data produced by the data mutation module and input according to the format required by the contract;

[0028] S2: Simulate the execution of the contract in the test environment to obtain the execution result of the mutation data;

[0029] S3: Match the execution result of the mutated data with the index function;

[0030] S4: According to the matching result of S3, output the threat information.

[0031] In the above technical solution, the feature extraction part in the index function generation module:

[0032] a. According to the type of input data, such as string, integer, classification;

[0033] b. Count the number of occurrences of different types of parameters;

[0034] c. Count the length of each parameter;

[0035] d. Encode these statistics as feature vectors to obtain execution features.

[0036] In the above technical solution, the output result part of the threat discovery module:

[0037] 1) If the index function matches successfully, no threat is found;

[0038] 2) If the index function fails to match, match with the index function of each common vulnerability;

[0039] 3) Output the matching result and the data cache of the data mutation module as the detection result;

[0040] 4) Notify the data mutation module to clear the cache.

[0041] The present application has the following beneficial effects because of adopting the above technical solutions.

[0042] The general alliance chain contract deployment process does not detect the contract security of the alliance chain, or does not detect the contract in the specific scenario of the alliance chain, and the above technical solution can well solve this problem.

[0043] The dynamic analysis technology is adopted, so that the accuracy of detection is higher.

[0044] When the dynamic analysis data is used, the fuzz technology is used, the test data coverage range is larger, and the efficiency is higher. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The overall architecture diagram of the present application;

[0046] Figure 2 The processing process of the malicious behavior discovery module. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application, that is, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments.

[0048] The detailed description of the embodiments of the present application is not intended to limit the scope of the claimed application, but only represents selected embodiments of the application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0049] It should be noted that the terms "first" and "second" and the like relational terms are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0050] I. The process executed by the index function generation module

[0051] a. Reasonable data input, obtain reasonable data input into the module by collecting or designing data of normal production environment.

[0052] b. Feature index extraction, extract various features of input data, mainly including parameter type input1, parameter length input2, etc.

[0053] c. Test environment contract execution: test reasonable data in the test environment, obtain resource consumption during program runtime in the entire process of the experiment, such as memory env1, usage of each register env2, etc.

[0054] d. Construction of index function: construct index function f = ∑ (ax + b) by combining various indexes such as resource consumption during program runtime with input data indexes, where x is each index, a and b are test parameters, and send to the threat discovery module.

[0055] II. Process executed by the data mutation module

[0056] a) Obtain a large amount of reasonable input data by taking daily production data as the data source; select appropriate Fuzz strategy according to the type of input data, application usage scenario, protocol, etc.

[0057] b) Data mutation: mutate data according to the selected Fuzz strategy. The mutated data still satisfies the reasonableness of the data.

[0058] c) Mutation data caching: cache the generated mutated data, which can be mutated multiple times to increase the coverage of the data.

[0059] II. Process executed by the threat discovery module

[0060] a) Mutation data input: obtain mutated data from the data mutation module.

[0061] b) Test environment contract execution: test the mutated data in the test environment, obtain resource consumption during program runtime in the entire process of the experiment, such as memory env1, usage of each register env2, etc.

[0062] c) Index function matching: input various indexes such as resource consumption during program runtime into the index function in combination with input data indexes, observe whether f(x) matches the benign index function set {f1(x), f2(x), …}, if the deviation is too large, match with the characteristics of each common vulnerability to confirm the vulnerability type.

[0063] d) Output threat detection results: output results in combination with matching results and mutated data, if the detection is completed, notify the data mutation module to clear the cache.

Claims

1. A method for alliance chain contract threat detection, characterized in that, Comprise: Index function generation module: through a large number of data, simulate the execution contract to obtain the execution characteristics, and construct the index function; Data variation module: input the specification data sample of the execution contract, select the correct fuzz strategy according to the execution characteristics of the contract and the format requirements of the data, generate the mutated data, cache the mutated data, and wait for the threat discovery module to request or provide data for further mutation; Threat discovery module: obtain the mutated data from the data variation module, simulate the execution contract, obtain the execution result of the mutated data, and match with the index function. If the deviation reaches a certain value, a threat warning is output; In the index function generation module: Select the key value in the input data key-value pair as the execution characteristic of the input data, associate the execution result with the execution characteristic, and obtain the index function; The feature extraction part in the index function generation module: Step a. According to the type of key value in the input data key-value pair, including string, integer type; Step b. Count the number of occurrences of different types of key values; Step c. Count the length of each key value; Step d. Encode the statistical information obtained in steps b and c as a feature vector to obtain the execution characteristic.

2. The method of claim 1, wherein, In the data variation module: Step 2.1, take daily production data as the data source to obtain a large number of reasonable input data; Step 2.2, select the appropriate mutation strategy according to the format specification of the input data; Step 2.3, mutate the input data according to the mutation strategy to obtain the mutated data; Step 2.4, cache the mutated data obtained in step 2.

3.

3. The method of claim 1, wherein, The threat discovery module includes four parts: mutation data input, test environment execution contract, index function matching, and output of threat detection results. The module mainly includes the following steps: Step 3.1: collect the mutated data produced by the data variation module and input according to the format required by the contract; Step 3.2: simulate the execution contract in the test environment to obtain the execution result of the mutated data; Step 3.3: match the mutated data execution result with the index function; Step 3.4: output the threat information according to the matching result of 3.

3.

4. The method of claim 3, wherein, The output result part of the threat discovery module: 1) If the index function matches successfully, no threat is found; 2) If the index function fails to match, match with the index functions of common vulnerabilities. The index functions of common vulnerabilities are generated and cached by the index function generation module after collecting vulnerability information; 3) Output the matching result and the data cache of the data variation module as the detection result; 4) Notify the data variation module to clear the cache.

Images