Blockchain smart contract attack behavior detection method, storage medium and electronic device

Abstract

The application provides a blockchain smart contract attack behavior detection method, a storage medium and an electronic device, and the method comprises the following steps: acquiring transaction data of a smart contract call, pre-executing the transaction data to obtain transaction call path information; verifying the transaction call path information, and if the verification fails, constructing blocking transaction information, and blocking the current transaction data of the smart contract call according to the blocking transaction information. The above scheme verifies the current transaction data by pre-executing the transaction data and then verifying the transaction call path information obtained by pre-executing. If the verification fails, the transaction data is blocked. Since pre-execution occurs before the current transaction data is formally executed, the transaction data with potential attack behavior can be timely defended and warned, and the security of the smart contract transaction is improved.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, specifically to a method for detecting blockchain smart contract attacks, a storage medium, and an electronic device. Background Technology

[0002] Currently, the blockchain smart contract ecosystem is developing rapidly, attracting internet companies and financial institutions to the blockchain industry. Smart contract security is a key area of ​​focus for many of these companies and institutions. Simultaneously, an increasing number of projects are using smart contracts to develop financial products on the blockchain, and these products interact with each other via smart contracts. The high complexity of contract interactions between different financial product protocols presents a growing challenge for smart contract security auditing. Furthermore, blockchain hackers are constantly monitoring the security of these financial product protocols, and will launch attacks to steal digital assets from smart contracts once they discover exploitable vulnerabilities. Therefore, the detection and defense against smart contract attacks is a pressing issue that needs to be addressed in the blockchain technology field.

[0003] Hackers typically use blacklists and whitelists to restrict attackers' addresses when attacking smart contracts. This involves pre-storing malicious addresses in an address database and comparing the current transaction's account address with the addresses in the database to determine if an attack has occurred. Because this method requires pre-storing malicious addresses in the address database, if an unknown attack address is used, the attack may have already occurred before the transaction data is intercepted, resulting in the loss of digital assets in the smart contract. Summary of the Invention

[0004] Therefore, a technical solution for detecting blockchain smart contract attacks is needed to address the technical problem that existing technologies cannot effectively provide timely and effective protection for smart contracts.

[0005] To achieve the above objectives, in a first aspect, the present invention provides a method for detecting blockchain smart contract attack behavior, the method comprising the following steps:

[0006] Obtain transaction data for calling smart contracts, pre-execute the transaction data, and obtain transaction call path information;

[0007] The transaction call path information is verified. If the verification fails, transaction blocking information is constructed, and the transaction data of the current smart contract call is blocked according to the transaction blocking information.

[0008] In some embodiments, the transaction call path information includes transaction account address call path information;

[0009] The verification of the transaction call path information includes: determining whether the transaction account address call path information matches the preset transaction account address call path information; if it matches, the verification is considered successful; otherwise, the verification is considered unsuccessful.

[0010] In some embodiments, the transaction call path information includes smart contract function call path information;

[0011] The verification of the transaction call path information includes: determining whether the smart contract function call path information matches the preset smart contract function call path information; if it matches, the verification is considered successful; otherwise, the verification is considered unsuccessful.

[0012] In some embodiments, constructing transaction blocking information and blocking the transaction data of the currently invoked smart contract based on the transaction blocking information includes:

[0013] Set a first transaction data whose gas price is higher than the current transaction data and can initiate a global pause. Add the first transaction data as blocking transaction information to the list of pending transaction data and place the execution order of the first transaction data before the current transaction data.

[0014] In some embodiments, the transaction call path information includes transaction account address information and address call order information;

[0015] The construction of transaction blocking information and the blocking of transaction data of the currently invoked smart contract based on the transaction blocking information include:

[0016] The address call order information is used to replace the address information of each transaction account during the pre-execution of the current transaction data, so that the block-producing node is separated from the address information of each transaction account called during the pre-execution of the current transaction data, constructing blocking transaction information controlled by the node program, and blocking the transaction data of the current smart contract based on the blocking transaction information.

[0017] In some embodiments, the method further includes:

[0018] The blocked transaction information is executed by the node program and the execution result is analyzed. If the execution result of the blocked transaction information is a net increase in the account assets of an account address other than the initiating account address of the current transaction data, then the blocked transaction information is added to the list of pending transaction data and the execution order of the blocked transaction information is placed before the current transaction data.

[0019] In some embodiments, the method further includes:

[0020] If the transaction call path information fails verification, the current transaction data will be added to the smart contract attack list.

[0021] In some embodiments, the method further includes:

[0022] Machine learning algorithms are used to train all transaction data in the smart contract attack list, and common attribute features of some or all transaction data in the smart contract attack list are sorted out and extracted.

[0023] When verifying new transaction data in the future, it is necessary to verify whether the new transaction data has the aforementioned common attribute characteristics.

[0024] In a second aspect, the present invention provides a storage medium storing a computer program that, when executed, implements the method described in the first aspect of the present invention.

[0025] In a third aspect, the present invention also provides an electronic device, comprising:

[0026] The storage medium is the storage medium as described in the second aspect of the present invention;

[0027] A processor, electrically connected to the storage medium, is configured to execute a computer program stored in the storage medium to implement the method as described in the first aspect of the invention.

[0028] Unlike existing technologies, this invention has the following characteristics:

[0029] This invention provides a method, storage medium, and electronic device for detecting blockchain smart contract attacks. The method includes the following steps: acquiring transaction data that calls the smart contract; pre-executing the transaction data to obtain transaction call path information; verifying the transaction call path information; if the verification fails, constructing blocking transaction information; and blocking the current transaction data that calls the smart contract based on the blocking transaction information. This solution verifies the current transaction data by pre-executing the transaction data and then using the transaction call path information obtained from the pre-executing; if the verification fails, it blocks the transaction. Since the pre-executing occurs before the current transaction data is formally executed, it can provide timely defense and early warning for transaction data with potential attack behaviors, thereby improving the security of smart contract transactions. Attached Figure Description

[0030] Figure 1 This is a flowchart of a blockchain smart contract attack detection method according to the first embodiment of the present invention;

[0031] Figure 2 This is a flowchart of a blockchain smart contract attack detection method according to the second embodiment of the present invention;

[0032] Figure 3 This is a flowchart of a blockchain smart contract attack detection method according to the third embodiment of the present invention;

[0033] Figure 4 This is a flowchart of a blockchain smart contract attack detection method according to the fourth embodiment of the present invention;

[0034] Figure 5 This is a schematic diagram of the module architecture of a computer program according to an embodiment of the present invention;

[0035] Figure 6 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0036] To illustrate the possible application scenarios, technical principles, implementable specific solutions, and achievable objectives and effects of this application in detail, the following description, in conjunction with the listed specific embodiments and accompanying drawings, provides a detailed explanation. The embodiments described herein are merely illustrative of the technical solutions of this application and are therefore intended to limit the scope of protection of this application.

[0037] In this document, the term "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The term "embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment, nor does it specifically limit its independence or connection with other embodiments. In principle, in this application, as long as there are no technical contradictions or conflicts, the technical features mentioned in each embodiment can be combined in any way to form corresponding implementable technical solutions.

[0038] Unless otherwise defined, the technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the use of related terms herein is merely for the purpose of describing particular embodiments and is not intended to limit this application.

[0039] In the description of this application, the term "and / or" is used to describe the logical relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A exists, B exists, and A and B exist simultaneously. Additionally, the character " / " in this document generally indicates that the preceding and following objects have an "or" logical relationship.

[0040] In this application, terms such as “first” and “second” are used only to distinguish one entity or operation from another, and do not necessarily require or imply any actual quantity, hierarchy or order relationship between these entities or operations.

[0041] Unless otherwise specified, the use of terms such as “comprising,” “including,” “having,” or other similar expressions in this application is intended to cover non-exclusive inclusion, which does not exclude the presence of additional elements in a process, method, or product that includes elements, such that a process, method, or product that includes a series of elements may include not only those defined elements but also other elements not expressly listed, or elements inherent to such process, method, or product.

[0042] In this application, expressions such as "greater than", "less than", and "exceeding" are understood to exclude the stated number; expressions such as "above", "below", and "within" are understood to include the stated number. Furthermore, in the description of the embodiments of this application, "multiple" means two or more (including two), and similar expressions related to "multiple" are also understood in this way, such as "multiple groups" and "multiple times", unless otherwise explicitly specified.

[0043] like Figure 1 As shown, in a first aspect, the present invention provides a method for detecting blockchain smart contract attack behavior, the method comprising the following steps:

[0044] First, proceed to step S101 to obtain the transaction data for calling the smart contract, pre-execute the transaction data, and obtain the transaction call path information;

[0045] Then, step S102 is performed to verify the transaction call path information and determine whether the verification is successful.

[0046] If the verification result of step S102 is negative, then proceed to step S103 to construct transaction blocking information, and block the transaction data of the current smart contract call based on the transaction blocking information.

[0047] In this implementation, since ordinary blockchain nodes are not block-producing nodes but only used to synchronize blockchain data, the code logic for executing transaction data in the blockchain node program can be modified to perform pre-execution operations on the local node before the transaction is executed by the blockchain's block-producing node. Because the local node pre-execution operation does not affect the normal operation of the blockchain node program, the transaction call path information obtained from the pre-execution result can be used to verify the current transaction data and determine whether it contains any malicious activity.

[0048] The above solution pre-executes the transaction data and then verifies the current transaction data using the transaction call path information obtained from the pre-execution. If the verification fails, the process is blocked. Since pre-execution occurs before the current transaction data is formally executed, it can provide timely defense and early warning against transaction data with potential attack behaviors, thereby improving the security of smart contract transactions.

[0049] In some embodiments, the transaction call path information includes transaction account address call path information; the verification of the transaction call path information includes: determining whether the transaction account address call path information matches the preset transaction account address call path information; if it matches, the verification is considered successful; otherwise, the verification is considered unsuccessful.

[0050] Typically, completing a transaction on the blockchain requires calling multiple transaction account addresses (i.e., multiple wallet addresses). By recording the transaction account address call path information of normal transaction data in advance, it is possible to analyze the transaction initiation address corresponding to the normal transaction data, the various transaction account addresses called to complete the entire transaction process, and the order of these transaction account addresses. The transaction account address call path information of normal transaction data listed in advance (i.e., preset transaction account address call path information) can be stored in a database. By checking whether any one or more of the transaction initiation address, the various transaction account addresses called to complete the entire transaction process, and the order of these transaction account addresses match the corresponding address order stored in the database, the current transaction data can be verified. Furthermore, since the entire verification process is completed during the pre-execution phase of the current transaction data, if the verification fails, the current transaction data can be blocked in time, preventing the current transaction data from being formally executed and causing asset loss in the smart contract.

[0051] In some embodiments, the transaction call path information includes smart contract function call path information; the verification of the transaction call path information includes: determining whether the smart contract function call path information matches the preset smart contract function call path information; if it matches, the verification is considered successful; otherwise, the verification is considered unsuccessful.

[0052] In this implementation, smart contract function call path information refers to the order in which multiple functions are called to complete a business process. Typically, when different types of transaction data interact with a smart contract, the required functions and their order of call are specific. Therefore, the function call combinations required for each business process (i.e., smart contract function call path information) can be pre-entered into the verification program. The verification program then verifies the function call path of the current transaction data based on the pre-entered function call combinations to ensure the correct business process is followed. If the verification fails, the current transaction data can be blocked to prevent its formal execution and potential loss of smart contract assets.

[0053] In some embodiments, constructing blocking transaction information and blocking the transaction data of the current smart contract call based on the blocking transaction information includes: setting a first transaction data with a gas price higher than the current transaction data and capable of initiating a global pause, including the first transaction data as blocking transaction information in the list of pending transaction data, and placing the execution order of the first transaction data before the current transaction data.

[0054] For example, when the verification program determines that a certain transaction (current transaction data) will affect the digital assets in the smart contract, it will send a corresponding signal to the handling program. After receiving the signal that it will affect the assets in the smart contract, the handling program will initiate a globally suspended transaction at a higher gas price, and the execution order of the defensive transaction initiated by the handling program will be placed before the current transaction data (transaction) with potential attack threats, so as to take timely defensive measures before the current transaction data is attacked.

[0055] In some embodiments, the transaction call path information includes transaction account address information and address call order information; constructing blocking transaction information and blocking the transaction data of the current smart contract call according to the blocking transaction information includes: replacing each transaction account address information during the pre-execution of the current transaction data according to the address call order information, so that the block-producing node is separated from each transaction account address information called during the pre-execution of the current transaction data, constructing blocking transaction information controlled by the node program, and blocking the transaction data of the current smart contract call according to the blocking transaction information.

[0056] Preferably, the method further includes:

[0057] The blocked transaction information is executed by the node program and the execution result is analyzed. If the execution result of the blocked transaction information is a net increase in the account assets of an account address other than the initiating account address of the current transaction data, then the blocked transaction information is added to the list of pending transaction data and the execution order of the blocked transaction information is placed before the current transaction data.

[0058] By constructing blocking transaction information controlled by the node program and placing it in the list of pending transaction data, and executing it before the current transaction data, it is possible to effectively block transaction data with potential attack threats before execution, thus ensuring the security of assets on smart contracts.

[0059] In some embodiments, the method further includes: adding the current transaction data to the smart contract attack list when the transaction call path information verification fails. If the transaction call path information verification fails, it indicates that the current transaction data contains attack behavior. Adding it to the smart contract attack list helps to detect and block the same type of transaction data in a timely manner in the future.

[0060] Because various attack methods are constantly emerging, it is necessary to continuously provide new attack features for training and backtesting to identify abnormal transactions encountered in smart contract interactions in historical data. Based on the smart contract attack transactions discovered in history, machine learning is used to sort out and extract the features of these attack transactions.

[0061] Therefore, as Figure 2 As shown, the method further includes:

[0062] First, in step S201, a machine learning algorithm is used to train all transaction data in the smart contract attack list, and the common attribute features of some or all transaction data in the smart contract attack list are sorted out and extracted.

[0063] Then, in step S202, when verifying new transaction data, it is verified whether the new transaction data has the aforementioned common attribute characteristics.

[0064] By using machine learning to extract features from abnormal transactions in historical attack events, the ability to identify attack behaviors can be enhanced. The newly identified features are added to the database, and when the verification business process program verifies the transaction, it adds the new features and verifies it together with the business, which enables the timely detection and recording of new attack behaviors.

[0065] In a second aspect, the present invention also provides a storage medium storing a computer program that, when executed, implements the method described in the first aspect of the present invention.

[0066] In the third aspect, such as Figure 6 As shown, the present invention also provides an electronic device 10, including a storage medium 102 and a processor 101, wherein the storage medium 102 is the storage medium as described in the second aspect; the processor 101 is electrically connected to the storage medium 102 and is used to execute a computer program stored in the storage medium to implement the method as described in the first aspect.

[0067] Preferably, the electronic device can be a computer device, including but not limited to: personal computers, servers, general-purpose computers, special-purpose computers, network devices, embedded devices, programmable devices, smart mobile terminals, smart home devices, wearable smart devices, and in-vehicle smart devices. Storage media include but are not limited to: RAM, ROM, magnetic disks, magnetic tapes, optical discs, flash memory, USB flash drives, portable hard drives, memory cards, memory sticks, network server storage, and network cloud storage. Processors include but are not limited to CPUs (Central Processing Units), GPUs (Graphics Processing Units), and MCUs (Microprocessors).

[0068] like Figure 3 and Figure 4 As shown, the blockchain smart contract attack detection method of the present invention may include the following steps:

[0069] Step 1: Add a "caller blacklist / whitelist" and a "stop service switch" to the code of the blockchain smart contract.

[0070] Step 2: Monitor the transactions that call smart contracts. Add the smart contracts that need to be monitored in the project to the "Smart Contract Data Monitoring Program". The monitoring program will analyze all transactions that call smart contracts. In addition to analyzing and recording the transaction data that has been packaged on the blockchain, it will also analyze and record the transaction data that has not been packaged based on the data in step 5 below.

[0071] The database records information including transaction details and fund change information. Transaction details include the transaction initiation address, all account transaction addresses in the execution chain, the functions called by the transaction within the smart contract, and related function information from the calling parties. Fund change information includes changes in digital assets within the smart contract before and after the transaction execution, as well as the flow of digital assets within the smart contract during the transaction's execution. The data recorded in the database will be used as input for verification in the "Verification Business Process Program," and the verification results will be output.

[0072] Step 3: Analyze the call flow between various functions in the business logic to form a "Business Flow Verification Program." Add the function call path data for each business function to the "Business Flow Verification Program." Then, based on the Transaction-related function call paths from Step 2, input the function call path of each Transaction into the "Business Flow Verification Program" for verification. Identify and record any abnormal function call paths that do not conform to the business flow, and output the verification result. If the verification fails, a "Handling Program" will be triggered to block the attack.

[0073] Step 4: Organize the flow data of digital assets in the smart contracts of the business, add the flow data of digital assets in each smart contract to the "Verify Business Process Program", and pass the flow data of digital assets in the smart contracts when the Transaction in Step 2 is executed to the "Verify Business Process Program" for verification, identify abnormal fund links in the Transaction and record them, and output the verification result after recording. If the verification fails, the "Disposal Program" will be triggered to block the attack.

[0074] Step 5: Modify the blockchain node program. Modify the code in the blockchain node program that involves the Transactions Pool using hook technology. Collect transaction data that has not yet been packaged by the blockchain program and store the collected transaction data in the database. This part of the data is also the source of another part of the data needed in Step 2.

[0075] Step 6: By modifying the code logic of the blockchain node program that executes transactions, a pre-execution operation is performed on the local node before the transaction is executed by the blockchain block-producing node. Since the local node pre-execution operation does not affect the normal operation of the blockchain node program, a "transaction pre-execution program" can be developed in this way. The "transaction pre-execution program" is responsible for pre-executing the incoming transaction locally before it is packaged and executed by the blockchain, and feeding back the pre-execution result to the "verification business process program". The "verification business process program" determines whether the unpackaged transaction contains malicious behavior based on the input data.

[0076] Step 7: Steps 1 to 6 achieve the functions of transaction data capture and abnormal transaction identification and detection. Therefore, an attack behavior "handling procedure" is also needed to achieve automated defense. The "handling procedure" takes the optimal blocking method based on the data returned by the "verification business process procedure". For example, if the "verification business process procedure" returns that a certain transaction will affect the digital assets in the smart contract, the "handling procedure", upon receiving the signal that it will affect the assets in the smart contract, will initiate a globally suspended transaction at a higher gas price, allowing the defensive transaction to be executed by the blockchain node before the attacking transaction. This enables timely defense to be taken and implemented before an attack.

[0077] like Figure 5 As shown, the computer program involved in this invention may include the following modules: a data acquisition layer, a data monitoring layer, a pre-execution layer, an identification / verification layer, and an attack handling layer.

[0078] The data acquisition layer is used to collect blockchain transaction data;

[0079] The data monitoring layer is used to monitor transaction data;

[0080] The pre-execution layer is used to pre-execute the current transaction data;

[0081] The identification / verification layer is used to verify the pre-execution results. Specifically, it can determine whether there is an attack on the current transaction data by verifying the business process program, or it can determine whether there are new attack features in the current transaction data by identifying new attack features, and thus determine whether there is an attack on the current transaction data.

[0082] The attack handling layer is used to handle transaction data that has been found to contain attack behavior. Specifically, it constructs blocking transaction information to block the interaction between the current transaction data and the smart contract.

[0083] This invention parses the block data of the blockchain node program, enabling a "monitoring program" to obtain real-time transaction data related to smart contracts in the monitoring list. By analyzing expected function call paths and fund flow data within the smart contracts, a "verification business process program" can detect attacks involving abnormal transactions. Then, by modifying the blockchain node program, a "transaction pre-execution program" is obtained. This program can locally pre-execute transactions related to the monitoring list and return the execution results.

[0084] This invention also identifies attack behaviors by setting up a "monitoring program," a "transaction pre-execution program," and a "verification business process program," and achieves automated defense through a "handling program." A "novel attack signature identification program" backtests historical attack behaviors to further refine the characteristics of the attack behaviors, thereby accelerating the identification of attack behaviors. Furthermore, because the "transaction pre-execution program" can obtain the pre-execution results locally before the attack behaviors are packaged and executed by the blockchain nodes, attack transactions can be identified in advance and handled promptly before they are packaged and executed.

[0085] The above solution enables real-time capture of transaction data from smart contracts in the monitoring list, identifying attacks such as reentrancy vulnerabilities, flash loan attacks, and overflow vulnerabilities. Upon identifying an attack, it can promptly suspend the relevant business operations of the smart contract by constructing a defensive transaction to prevent the attacking transaction (i.e., the current transaction data) from executing normally, and cooperate with relevant parties to complete vulnerability patching and business recovery.

[0086] Although the above embodiments have been described, those skilled in the art, once they understand the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the above are merely embodiments of the present invention and do not limit the scope of patent protection of the present invention. Any equivalent structural or procedural transformations made using the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for detecting blockchain smart contract attack behavior, characterized in that, The method includes the following steps: Obtain transaction data for calling smart contracts, pre-execute the transaction data, and obtain transaction call path information; The transaction call path information is verified. If the verification fails, transaction blocking information is constructed, and the transaction data of the current smart contract call is blocked according to the transaction blocking information. The transaction call path information includes the transaction account address call path information; The verification of the transaction call path information includes: determining whether the transaction account address call path information matches the preset transaction account address call path information; if it matches, the verification is considered successful; otherwise, the verification is considered unsuccessful. The transaction call path information includes transaction account address information and address call order information; The construction of transaction blocking information and the blocking of transaction data of the currently invoked smart contract based on the transaction blocking information include: The address call order information is used to replace the address information of each transaction account during the pre-execution of the current transaction data, so that the block-producing node is separated from the address information of each transaction account called during the pre-execution of the current transaction data, constructing blocking transaction information controlled by the node program, and blocking the transaction data of the current smart contract based on the blocking transaction information. The method further includes: The blocked transaction information is executed by the node program and the execution result is analyzed. If the execution result of the blocked transaction information is a net increase in the account assets of an account address other than the initiating account address of the current transaction data, then the blocked transaction information is added to the list of pending transaction data and the execution order of the blocked transaction information is placed before the current transaction data.

2. The blockchain smart contract attack detection method as described in claim 1, characterized in that, The method further includes: If the transaction call path information fails verification, the current transaction data will be added to the smart contract attack list.

3. The blockchain smart contract attack detection method as described in claim 2, characterized in that, The method further includes: Machine learning algorithms are used to train all transaction data in the smart contract attack list, and common attribute features of some or all transaction data in the smart contract attack list are sorted out and extracted. When verifying new transaction data in the future, it is necessary to verify whether the new transaction data has the aforementioned common attribute characteristics.

4. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed, implements the method as described in any one of claims 1 to 3.

5. An electronic device, characterized in that, include: The storage medium is the storage medium as described in claim 4; A processor, electrically connected to the storage medium, is configured to execute a computer program stored in the storage medium to implement the method as described in any one of claims 1 to 3.

Images