Smart contract code automatic review method, storage medium and electronic device

Abstract

The application provides a smart contract code automatic review method, a storage medium and an electronic device, and the method comprises the following steps: obtaining multiple different types of smart contract codes, and classifying and labeling the obtained multiple different types of smart contract codes; the obtained smart contract codes are fragmented, and the fragmented code segments are standardized; the standardized code segments are vectorized, and are converted into data readable by a training model; a basic natural language model is selected as the training model, parameters are adjusted to train the basic natural language model, and a code detection model is obtained; the vectorized code segments are input into the code detection model, and a training result is output. Through the above scheme, the smart contract code can be automatically audited based on the training model, the contract auditing cost is reduced, and the auditing efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, specifically to a method for automatic review of smart contract code, a storage medium, and an electronic device. Background Technology

[0002] Smart contracts are programs stored on a blockchain that automatically run when predetermined conditions are met. They are typically used to automate protocols so that all participants can immediately determine the outcome without any intermediaries, saving transaction time. They can also automate workflows, triggering the next action when conditions are met.

[0003] With the development of blockchain technology, more and more smart contract code is being deployed on the blockchain to fulfill various functions. However, flawed smart contract code often leads to unnecessary losses for users. Therefore, smart contracts need to be security audited before deployment. Currently, security auditing methods are still mainly manual, which requires significant manpower and resources and cannot meet the needs of rapidly expanding businesses. Summary of the Invention

[0004] Therefore, a technical solution for automatic review of smart contract code is needed to solve the problems of time-consuming, labor-intensive, and inefficient manual review of existing smart contract code.

[0005] To achieve the above objectives, in a first aspect, the present invention provides a method for automatic review of smart contract code, the method comprising the following steps:

[0006] S1: Obtain multiple different types of smart contract code, and classify and label the obtained multiple different types of smart contract code;

[0007] S2: Slice the acquired smart contract code and standardize the sliced ​​code fragments;

[0008] S3: Vectorize the standardized code snippets to convert them into data that can be read by the training model;

[0009] S4: Select a basic natural language model as the training model, adjust the parameters to train the basic natural language model, and obtain the code detection model;

[0010] S5: Input the vectorized code snippet into the code detection model and output the training results.

[0011] In some embodiments, the smart contract code includes any one or more of smart legal contract code, DAO contract code, application logic contract code, and smart contract code containing various types of malicious code.

[0012] In some embodiments, the standardization process for the fragmented code segments includes:

[0013] Extract the subjective and / or objective features of the fragmented code segments;

[0014] The subjective and / or objective features are used to represent the characteristic attributes of different types of smart contract code; the characteristic attributes include any one or more of the following: number of variables corresponding to the code fragment, number of lines of code, average number of functions per function, number of empty characters and spaces, maximum variable length, number of comments, number of character operation functions, number of execution class function calls, number of system function calls, maximum length of function parameters, and number of encryption / decryption function calls.

[0015] In some embodiments, the method includes:

[0016] By statistically analyzing the smart contract code set, the common analytical conditions that all smart contract codes satisfy are used as feature dimensions.

[0017] In some embodiments, vectorizing the standardized code snippets includes:

[0018] In the standardized code snippet, each keyword is used as a feature vector dimension. By combining the keywords in pairs, a Gram combination is obtained.

[0019] The probability of each Gram combination is calculated based on the N-Gram language model and used as a new feature vector dimension.

[0020] In some embodiments, vectorizing the standardized code snippets further includes:

[0021] An attention mechanism is introduced for training, 1-Gram, 2-Gram, and 3-Gram are used to enhance data coverage, and a decision tree model is used for the final output.

[0022] In some embodiments, the method further includes:

[0023] S6: Adjust the parameters of the code detection model based on the training results of step S5.

[0024] In some embodiments, the method further includes:

[0025] When the code fragment input into the code detection model is determined to be smart contract code containing malicious code, a prompt message is issued.

[0026] In a second aspect, the present invention provides a storage medium storing a computer program that, when executed, implements the method described in the first aspect of the present invention.

[0027] In a third aspect, the present invention also provides an electronic device, comprising:

[0028] The storage medium is the storage medium as described in the second aspect of the present invention;

[0029] A processor, electrically connected to the storage medium, is configured to execute a computer program stored in the storage medium to implement the method as described in the first aspect of the invention.

[0030] Unlike existing technologies, this invention has the following characteristics:

[0031] This invention provides a method, storage medium, and electronic device for automatic review of smart contract code. The method includes the following steps: acquiring multiple types of smart contract code, and classifying and labeling the acquired smart contract code; segmenting the acquired smart contract code and standardizing the segmented code fragments; vectorizing the standardized code fragments to convert them into data readable by a training model; selecting a basic natural language processing model as the training model, adjusting parameters to train the basic natural language processing model, and obtaining a code detection model; inputting the vectorized code fragments into the code detection model and outputting the training results. This approach enables automatic auditing of smart contract code based on a trained model, reducing contract auditing costs and improving auditing efficiency. Attached Figure Description

[0032] Figure 1 This is a flowchart of the automatic smart contract code review method according to the first embodiment of the present invention;

[0033] Figure 2 This is a flowchart of an automatic smart contract code review method according to a second embodiment of the present invention;

[0034] Figure 3 This is a flowchart of the automatic smart contract code review method according to the third embodiment of the present invention;

[0035] Figure 4 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0036] To illustrate the possible application scenarios, technical principles, implementable specific solutions, and achievable objectives and effects of this application in detail, the following description, in conjunction with the listed specific embodiments and accompanying drawings, provides a detailed explanation. The embodiments described herein are merely illustrative of the technical solutions of this application and are therefore intended to limit the scope of protection of this application.

[0037] In this document, the term "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The term "embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment, nor does it specifically limit its independence or connection with other embodiments. In principle, in this application, as long as there are no technical contradictions or conflicts, the technical features mentioned in each embodiment can be combined in any way to form corresponding implementable technical solutions.

[0038] Unless otherwise defined, the technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the use of related terms herein is merely for the purpose of describing particular embodiments and is not intended to limit this application.

[0039] In the description of this application, the term "and / or" is used to describe the logical relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A exists, B exists, and A and B exist simultaneously. Additionally, the character " / " in this document generally indicates that the preceding and following objects have an "or" logical relationship.

[0040] In this application, terms such as “first” and “second” are used only to distinguish one entity or operation from another, and do not necessarily require or imply any actual quantity, hierarchy or order relationship between these entities or operations.

[0041] Unless otherwise specified, the use of terms such as “comprising,” “including,” “having,” or other similar expressions in this application is intended to cover non-exclusive inclusion, which does not exclude the presence of additional elements in a process, method, or product that includes elements, such that a process, method, or product that includes a series of elements may include not only those defined elements but also other elements not expressly listed, or elements inherent to such process, method, or product.

[0042] Similar to the understanding in the Examination Guidelines, in this application, expressions such as "greater than," "less than," and "exceeding" are understood to exclude the stated number; expressions such as "above," "below," and "within" are understood to include the stated number. Furthermore, in the description of the embodiments in this application, "multiple" means two or more (including two), and similar expressions related to "multiple" are also understood in this way, such as "multiple groups" and "multiple times," unless otherwise explicitly specified.

[0043] like Figure 1 As shown, in a first aspect, the present invention provides a method for automatic review of smart contract code, the method comprising the following steps:

[0044] S1: Obtain multiple different types of smart contract code, and classify and label the obtained multiple different types of smart contract code;

[0045] S2: Slice the acquired smart contract code and standardize the sliced ​​code fragments;

[0046] S3: Vectorize the standardized code snippets to convert them into data that can be read by the training model;

[0047] S4: Select a basic natural language model as the training model, adjust the parameters to train the basic natural language model, and obtain the code detection model;

[0048] S5: Input the vectorized code snippet into the code detection model and output the training results.

[0049] In this embodiment, the classification and labeling of the various types of smart contract code obtained in step S1 refers to classifying the smart contract code according to its type and then further distinguishing the categories through labeling. The standardization process in step S2 refers to converting the smart contract code format into a computer program that conforms to predetermined specifications.

[0050] In this embodiment, the smart contract code includes any one or more of the following: smart legal contract code, DAO contract code, application logic contract code, and smart contract code containing various types of malicious code. By extracting features from different types of smart contract code and inputting them into a training model, the trained model can automatically and promptly detect smart contract code containing malicious code, thereby completing a security audit.

[0051] In this embodiment, the standardization process for the fragmented code segments includes: extracting the subjective and / or objective features of the fragmented code segments;

[0052] The subjective and / or objective features are used to represent the characteristic attributes of different types of smart contract code.

[0053] The characteristic attributes include any one or more of the following: the number of variables corresponding to the code snippet, the number of lines of code, the average number of functions per function, the number of empty characters and spaces, the maximum variable length, the number of comments, the number of character operation functions, the number of execution class function calls, the number of system function calls, the maximum length of function parameters, and the number of encryption / decryption function calls.

[0054] Furthermore, the method includes: statistically analyzing the smart contract code set and using the common analytical conditions satisfied by all smart contract codes as feature attributes. Extracting these common analytical conditions as feature attributes facilitates subsequent training and computation of the model for each smart contract code.

[0055] like Figure 2 As shown, in some embodiments, vectorizing the standardized code snippets includes:

[0056] First, in step S201, in the standardized code snippet, each keyword is used as a feature vector dimension. By combining the keywords in pairs, a Gram combination is obtained.

[0057] Then, in step S202, the probability of each Gram combination is calculated based on the N-Gram language model, which serves as the new feature vector dimension.

[0058] Preferably, this application uses the N-Gram model for vector feature generation. The basic idea of ​​the N-Gram model is to perform a sliding window operation of size N on the content of text (such as smart contract code snippets), forming a sequence of byte segments of length N. Each byte segment is called a gram. Then, the frequency of occurrence of all grams is statistically analyzed and filtered according to a pre-set threshold to form a list of key grams, which is the vector feature space of this text. Each gram in the list is a feature vector dimension. This model is based on the assumption that the occurrence of the Nth word is only related to the preceding N-1 words and is not related to any other words. The probability of the entire sentence is the product of the probabilities of occurrence of each word. These probabilities can be obtained by directly counting the number of times N words occur simultaneously in the corpus. The N-Gram model includes the binary Bi-Gram model and the ternary Tri-Gram model.

[0059] In some scenarios, where the corpus dataset is not large, in order to extract more features, N-Gram can be considered. Taking the Bi-Gram model as an example, in the original text, each keyword is used as a feature. By combining keywords in pairs, a Bi-Gram combination is obtained. Then, according to the N-Gram language model, the probability of each Bi-Gram combination is calculated as a new feature vector dimension.

[0060] To improve the generalization ability of N-Gram and enhance its recognition of smart contract code, this embodiment, taking into account the sparse and concise nature of smart contract code, further includes vectorizing the standardized code fragments by introducing an attention mechanism for training, using 1-Gram, 2-Gram, and 3-Gram to enhance data coverage, and using a decision tree model for the final result output.

[0061] In some embodiments, the method further includes: S6: Adjusting various parameters of the code detection model based on the training results of step S5. Specifically, feature-vectorized code data can be used as model input, the training process code can be run, and a deployable detection algorithm model can be generated after multiple iterations. Then, based on the system hardware, an algorithm model scheduling system is developed. Users only need to input the corresponding smart contract code, and combined with the original contract code pre-analysis program, the detection system can return the model's judgment result, providing a reference for code security auditors.

[0062] Furthermore, the method also includes: issuing a prompt message when it is determined that the code fragment input to the code detection model is smart contract code containing malicious code. Code security auditors can promptly process the smart contract code containing malicious code based on the prompt message. The prompt message can be a voice message, a pop-up window, a vibration message, or other similar notification.

[0063] like Figure 3 As shown, the automatic smart contract code review method provided in this application first collects smart contract code of different types, then labels, standardizes, and vectorizes the data before inputting it into a natural language model for training. During training, the training parameters are continuously optimized based on the training results, and then the trained model is deployed. Upon receiving smart contract code to be audited, the trained model can automatically review the input code, thus greatly improving review efficiency. Compared with existing technologies, this application expands the application scope of language models beyond general code detection and classification, while also adding the ability to detect smart contract code.

[0064] In a second aspect, the present invention also provides a storage medium storing a computer program that, when executed, implements the method described in the first aspect of the present invention.

[0065] In the third aspect, such as Figure 4 As shown, the present invention also provides an electronic device 10, including a storage medium 102 and a processor 101, wherein the storage medium 102 is the storage medium as described in the second aspect; the processor 101 is electrically connected to the storage medium 102 and is used to execute a computer program stored in the storage medium to implement the method as described in the first aspect.

[0066] Preferably, the electronic device can be a computer device, including but not limited to: personal computers, servers, general-purpose computers, special-purpose computers, network devices, embedded devices, programmable devices, smart mobile terminals, smart home devices, wearable smart devices, and in-vehicle smart devices. Storage media include but are not limited to: RAM, ROM, magnetic disks, magnetic tapes, optical discs, flash memory, USB flash drives, portable hard drives, memory cards, memory sticks, network server storage, and network cloud storage. Processors include but are not limited to CPUs (Central Processing Units), GPUs (Graphics Processing Units), and MCUs (Microprocessors).

[0067] Although the above embodiments have been described, those skilled in the art, once they understand the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the above are merely embodiments of the present invention and do not limit the scope of patent protection of the present invention. Any equivalent structural or procedural transformations made using the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for automatically reviewing smart contract code, characterized in that, The method includes the following steps: S1: Obtain multiple types of smart contract code, and classify and label the obtained multiple types of smart contract code; the smart contract code includes any one or more of the following: smart legal contract code, DAO contract code, application logic contract code, and smart contract code containing multiple types of malicious code; S2: The acquired smart contract code is sharded, and the sharded code fragments are standardized. The standardization of the sharded code fragments includes: extracting subjective and / or objective features of the sharded code fragments. The subjective and / or objective features are used to represent the characteristic attributes of different types of smart contract code. The characteristic attributes include any one or more of the following: the number of variables corresponding to the code fragment, the number of lines of code, the average number of functions per function, the number of empty characters and spaces, the maximum variable length, the number of comments, the number of character operation functions, the number of execution class function calls, the number of system function calls, the maximum length of function parameters, and the number of encryption / decryption function calls. S3: Vectorize the standardized code snippets to convert them into data that can be read by the training model; S4: Select a basic natural language model as the training model, adjust the parameters to train the basic natural language model, and obtain the code detection model; S5: Input the vectorized code snippet into the code detection model and output the training results.

2. The automatic smart contract code review method as described in claim 1, characterized in that, The method includes: By statistically analyzing the smart contract code set, the common analytical conditions that all smart contract codes satisfy are used as feature dimensions.

3. The automatic smart contract code review method as described in claim 1, characterized in that, Vectorization of standardized code snippets includes: In the standardized code snippet, each keyword is used as a feature vector dimension. By combining the keywords in pairs, a Gram combination is obtained. The probability of each Gram combination is calculated based on the N-Gram language model and used as a new feature vector dimension.

4. The automatic smart contract code review method as described in claim 3, characterized in that, Vectorization of standardized code snippets also includes: An attention mechanism is introduced for training, 1-Gram, 2-Gram, and 3-Gram are used to enhance data coverage, and a decision tree model is used for the final output.

5. The automatic smart contract code review method as described in claim 1, characterized in that, The method further includes: S6: Adjust the parameters of the code detection model based on the training results of step S5.

6. The method for automatic review of smart contract code as described in claim 1, characterized in that, The method further includes: When the code fragment input into the code detection model is determined to be smart contract code containing malicious code, a prompt message is issued.

7. A storage medium, characterized in that, The storage medium stores a computer program that, when executed, implements the method as described in any one of claims 1 to 6.

8. An electronic device, characterized in that, include: The storage medium is the storage medium as described in claim 7; A processor, electrically connected to the storage medium, is configured to execute a computer program stored in the storage medium to implement the method as described in any one of claims 1 to 6.

Images