Smart contract code clone detection method based on AST multi-dimensional feature fusion

Abstract

The present invention discloses a smart contract code clone detection method based on AST multi-dimensional feature fusion, which can effectively solve the problem of smart contract code clone detection. The present invention converts the smart contract code into an abstract syntax tree AST, analyzes the AST in both horizontal and vertical directions, extracts the corresponding grammatical information and semantic information, and then uses an encoder to obtain the AST horizontal and vertical fusion feature vectors; finally, the similarity of the fusion feature vectors of two different contract function blocks is calculated by a similarity detection algorithm. By fusing grammar and syntax features, the method of the present invention can more accurately realize the code clone detection of smart contracts, and has good foresight and reference.

Description

Technical Field

[0001] The present invention belongs to the technical field of code clone detection, and specifically relates to a smart contract code clone detection method based on AST multi-dimensional feature fusion. Background Art

[0002] Code cloning is a process in which developers directly or indirectly reuse code from other projects to improve software development efficiency during software project development. Currently, code reuse has been widely used in the development of blockchain smart contract projects. Smart contracts are programs developed in Turing-complete languages ​​and can run on blockchains; compared to other programming languages, the most typical feature of smart contracts is that the execution of their code consumes Gas (i.e., Ethereum). Therefore, the development of smart contracts requires special attention to the simplicity of the code and the reduction of redundant code as much as possible, which further leads to the phenomenon of code reuse in smart contracts being more common than in other programming languages.

[0003] Unfortunately, if there are risks such as security vulnerabilities and code logic problems in the reused code, it may cause a series of chain security problems. The reuse of risky code is one of the main reasons for the frequent occurrence of smart contract security problems. According to statistics, about 10% of the vulnerabilities are introduced by code reuse. Therefore, it is very necessary to perform code cloning detection for smart contracts, especially for function blocks with important functions (such as transfer, withdrawal, self-destruction, etc.), to avoid the spread of smart contract security vulnerabilities caused by code reuse.

[0004] In order to solve the problem of smart contract code reuse, existing detection technologies obtain two types of intermediate representations through compilation and compilation optimization, and implement similarity measurement of cross-version smart contracts at the basic block granularity and intermediate representation level (such as the Solidity smart contract similarity detection method and system provided by the Chinese patent with publication number CN113268732A); however, with the rapid development of Ethereum, the number and scale of smart contracts are growing rapidly, and the reuse of contract codes has increased and become more refined. Directly performing similarity matching on two smart contracts, this detection method may not be able to accurately detect the reused function blocks in the contract due to the coarse detection granularity when performing similarity detection on large-scale smart contracts. Often, these function blocks usually involve the transfer of user property. Once the spread of smart contract security vulnerabilities caused by code reuse occurs, these reused contract function blocks will cause loss of user property.

[0005] Another detection method is to analyze from a semantic level, extracting semantic information from the smart contract source code through a control flow graph (such as a smart contract code similarity detection method provided by a Chinese patent with publication number CN113312268A). The drawback of this method is that there are two functions with obviously different functions, but the extracted control flow graphs are exactly the same, resulting in the inability to determine whether there is code reuse in the smart contract based on the difference in the extracted semantic information. Summary of the invention

[0006] In view of the above, the present invention provides a smart contract code clone detection method based on AST (Abstract Syntax Tree) multi-dimensional feature fusion, which can accurately realize the clone detection of smart contract source code.

[0007] A smart contract code clone detection method based on AST multi-dimensional feature fusion, comprising the following steps:

[0008] (1) Filter out function block pairs with similar functions from smart contracts;

[0009] (2) For any pair of function blocks C 1 and C 2 , convert it into an abstract syntax tree T 1 and T 2 ;

[0010] (3) Construct an encoder based on the GCN (Graph Convolutional Networks)-Transformer integrated model, with T 1 and T 2 As input, the corresponding encoding sequence G containing the grammatical features of the function block is extracted 1 and G 2 and the encoding sequence Y containing the semantic features of the function block 1 and Y 2 ;

[0011] (4) The grammatical features and semantic features are integrated to obtain G 1 With Y 1 The merged feature vector S 1 and G 2 With Y 2 The merged feature vector S 2 ;

[0012] (5) Calculate the eigenvector S 1 With S 2 If the similarity is greater than the set threshold, the function block C in the smart contract is determined 1 and C 2resemblance.

[0013] Furthermore, the specific implementation method of step (1) is as follows: in a smart contract, a function represents the execution of logic and the transfer of funds. By extracting keywords from the smart contract programming code, analyzing the definition and scope of function variables, pre-judgment of function blocks is performed, and function block pairs with similar functions are specifically extracted therefrom.

[0014] Furthermore, in step (3), for the extraction of grammatical features, since the nodes in GCN contain the grammatical information about the type and value in AST when embedded, the information of each layer of nodes in AST can be aggregated through the hop in GCN, so as to extract the grammatical information horizontally and layer by layer. Specifically, first, T is extracted according to the specific code line. 1 and T 2 The graph is split into two parts, and the graph is regarded as another mode of AST. Starting from the root node in AST, the sibling nodes of the current node are aggregated through the convolution of the first hop, and then the grammatical information from its neighboring nodes is indirectly aggregated by increasing the number of hops. In order to solve the problem that Transformer cannot capture sequential information, the feature of position encoding is introduced in the encoding process. The sequential information is injected into the symbol embedding vector through position encoding, and T is obtained. 1 The coding sequence of G 1 and T 2 The coding sequence of G 2 .

[0015] Furthermore, considering that the code corresponding to a node in AST may have different meanings in different code lines, the initial vector of the node needs to be converted into a semantic vector combined with the usage environment.

[0016] Furthermore, in step (3), the extraction of semantic features is performed according to the abstract syntax tree T 1 and T 2 , extract all pairwise paths between terminal nodes and represent them as a sequence of terminal nodes and non-terminal nodes. Specifically: First, from T 1 and T 2 Extract the corresponding AST path sequence P 1 and P 2 , the first and last nodes of the AST path are terminals, whose values ​​are the tokens in the code. The tokens are split into sub-tokens and a learned embedding matrix E is used. subtokenTo represent each sub-Token, the sub-Token vectors are summed to represent the Token, and then a fully connected layer is applied to connect the vector representations of each terminal node Token; each AST path is encoded separately, and the vector representation of the terminal node combination is aggregated by average pooling to initialize the state of the decoder, and then a learned embedding matrix E is used nodes Represents each node on the path, and then uses the final state of the bidirectional LSTM to encode the entire AST path sequence to obtain T 1 The coding sequence Y 1 and T 2 The coding sequence Y 2 .

[0017] Furthermore, in the process of fusing grammatical features and semantic features in step (4), a multi-head attention mechanism is introduced to analyze the encoding sequence Y from different angles. 1 and Y 2 An attention mechanism analysis is performed to sequentially capture the long and short dependencies in the sequence to further analyze the semantic information.

[0018] Furthermore, in step (5), the cosine similarity detection algorithm is used to calculate the feature vector S 1 With S 2 The similarity.

[0019] The smart contract code cloning detection method of the present invention performs cloning detection on the function blocks with important functions (such as transfer, withdrawal, self-destruction, etc.) of the smart contract code. The code is converted into an abstract syntax tree AST, and then the grammatical features and semantic features extracted therefrom are integrated. A similarity detection algorithm is used to calculate whether there is code reuse, thereby avoiding the propagation of smart contract security vulnerabilities caused by code reuse.

[0020] The smart contract code clone detection method based on AST multi-dimensional feature fusion in this invention effectively solves the problem of Ethereum smart contract similarity detection. Compared with the traditional code reuse detection method, this invention can achieve more accurate detection effect from the perspectives of syntax and semantics, has good foresight and reference, and its specific beneficial technical effects and innovation are mainly reflected in the following four aspects:

[0021] 1. The smart contract function block construction method described in the present invention captures the smart contract syntax information through an abstract syntax tree extraction tool, and subdivides it at the syntax and semantic levels, which can more accurately compare the similarities between two code segments.

[0022] 2. The smart contract similarity detection method based on AST multi-dimensional feature fusion proposed in the present invention can extract code information in the contract from the semantic and grammatical levels, thereby improving the accuracy and efficiency of similarity detection.

[0023] 3. The present invention digitizes the similarity of different contract code lines, and can provide corresponding explanations for smart contract similarity detection, which has reliable reference significance.

[0024] 4. The smart contract similarity detection method based on AST multi-dimensional feature fusion proposed in this invention has good scalability and reference significance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 Schematic diagram of the process of the smart contract similarity detection method of the present invention.

[0026] Figure 2 This is a flow chart of horizontally splitting AST to obtain grammatical features in the present invention.

[0027] Figure 3 It is a flow chart of vertically splitting AST to obtain semantic features in the present invention.

[0028] Figure 4 The figure is a schematic diagram of the simulation process for detecting the similarity of smart contracts according to a specific example of the present invention. DETAILED DESCRIPTION

[0029] In order to describe the present invention more specifically, the technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0030] The present invention is based on the smart contract source code similarity detection based on AST multi-dimensional feature fusion. It uses the AST extraction tool to capture the tree representation of the abstract syntax structure of the smart contract, extracts the feature vectors of the smart contract function block from the two perspectives of syntax and semantics, and obtains the similarity value between different function blocks by merging the information of the two sets of feature vectors as the input of the similarity calculation function. The similarity detection result of the two segments of smart contract source code is obtained by the cosine similarity algorithm. The process is as follows: Figure 1 shown.

[0031] (1) In smart contracts, functions represent the execution of logic and the transfer of funds. By extracting keywords from the smart contract programming code, analyzing the definition and scope of function variables, etc., the function blocks are pre-judged and the function blocks that need to be tested are extracted in a targeted manner. 1 and C 2 , taking it as the research object, using the abstract syntax tree extraction tool to extract the smart contract function block C 1 and C 2 Convert to abstract syntax tree T 1 and T 2 .

[0032] (2) AST horizontal parsing and output of grammatical features.

[0033] like Figure 2 As shown in the figure, the process of horizontally splitting the syntax tree of a smart contract can be summarized as follows: splitting the AST according to different statements, using the pre-order traversal method to generate a node sequence from the AST. The node sequence implies the original order of appearance of the token in the source code. The graph convolutional neural network (GCN) is designed to propagate information along the edges between nodes. Each node can aggregate a wider range of information from adjacent nodes, thereby focusing on a wider range of local syntax information. Since the nodes embedded in the GCN include the "type" and "value" in the AST, which means that the GCN integrates the lexical and structural aspects of the AST, the information of each layer of nodes in the AST can be aggregated through the hop in the GCN, so as to extract syntax information horizontally, layer by layer. Specifically:

[0034] According to the specific code line, T 1 and T 2 To split, we regard the graph as another mode of AST, encoding and extracting grammatical information. Starting from the root node in the abstract syntax tree, intuitively, it can aggregate the sibling nodes of the current node through the convolution of the first hop, and it can also indirectly aggregate more extensive information from its child node neighbors by increasing the number of hops.

[0035] Construct an encoder based on the GCN-Transformer integrated model. In order to solve the problem that the Transformer model cannot capture the sequential sequence, the position encoding feature is introduced when encoding the vector. The sequential information is injected into the symbol embedding vector through position encoding to obtain T 1 The set of feature vectors and T 2 The set of feature vectors Where n represents the dimension of the feature vector.

[0036] (3) AST vertical parsing and output of semantic features.

[0037] like Figure 3 As shown in the figure, the process of vertically splitting the smart contract syntax tree can be summarized as follows: processing the encoded AST path when generating the target sequence, for the AST of a given code segment, the encoder will create a vector representation for all pairwise paths between all terminals, and represent them as a sequence of terminal and non-terminal nodes, specifically:

[0038] First, according to the contract function block C 1 and C 2 The abstract syntax tree T 1 and T 2 , respectively extract the corresponding AST path P 1 ={pi ∈T 1 |p 1 ,...,p m} and P 2 ={p i ∈T 2 |p 1 ,...,p k}, where n and m represent T 1 and T 2 The total number of paths in .

[0039] The first and last nodes of the AST path are terminals, whose values ​​are tokens in the code. We split the code token into sub-tokens, for example, a token with the value ArrayList will be decomposed into Array and List, which is somewhat similar to byte pair encoding in NMT, although in programming languages, encoding conventions (such as camel case encoding rules) provide us with explicit partitioning of each token; we use a learned embedding matrix E subtoken To represent each sub-token, and then sum the sub-token vectors to represent:

[0040]

[0041] To represent the path x=v 1 …v i In , we concatenate the token representation of each terminal node and apply a fully connected layer, where value is a mapping of the terminal node to its associated value, W in is a (2d path +2d token )Hidden matrix.

[0042] z=tanh(W in [encode_path(v 1 …v i );encode_token(value(v 1 ));encode_token(value(v i ))])

[0043] Different from the typical encoder-decoder model, the proposed model does not consider the order of the input random paths, each path is encoded separately, and the combined representation is aggregated by average pooling to initialize the state of the decoder.

[0044]

[0045] Then use the learned embedding matrix E nodesRepresents each node, and then uses the final state of the bidirectional LSTM to encode the entire sequence path to obtain the encoded sequence Y 1 and Y 2 .

[0046] (4) Fusion of grammatical and semantic features.

[0047] The multi-head attention mechanism is introduced to further improve the accuracy. The feature vector Y obtained by longitudinal analysis 1 and Y 2 , analyze the attention mechanism from different perspectives, capture the long-short dependency relationship in the sequence to further analyze the semantic information, and finally obtain 1 With G 1 , Y 2 With G 2 The merged feature vector S 1 and S 2 .

[0048] (5) Similarity calculation and code clone detection.

[0049] The present invention adopts a cosine similarity algorithm, that is, the cosine value of the angle between two vectors in a vector space is used as a measure of the size of the difference between two individuals. The closer the cosine value is to 1, the closer the angle is to 0, indicating that the two vectors are more similar. The closer the cosine value is to 0, the closer the angle is to 90 degrees, indicating that the two vectors are less similar.

[0050] Specifically, we transform the feature vector S after horizontal and vertical encoding fusion into 1 and S 2 Substitute it into the cosine similarity algorithm to get the cosine similarity M; set the threshold a, compare M and a, and determine the contract code block C 1 With C 2 Similarity: If M≥a, then C 1 With C 2 have similarity, otherwise C 1 With C 2 There is no similarity.

[0051] Next, we will Figure 4 Taking the smart contract function block to be tested as an example, the specific detection process is as follows:

[0052] (1) First, use the AST extraction tool to convert the smart contract function blocks A and B into abstract syntax trees F 1 and F 2 .

[0053] (2) Then F 1 and F 2 Input to GCN to convert F 1 and F 2Perform horizontal splitting and obtain the AST sequence s through pre-order traversal 1 ={f i ∈F 1 |f 1 ,...,f 8} and s 2 ={f i ∈F 2 |f 1 ,...,f 10}; In this example, contract A has 8 layers and contract B has 10 layers. According to the set hop value, we start to aggregate the syntax information horizontally and further obtain F 1 The set of feature vectors F 2 The set of feature vectors (The dimension of all feature vectors in this example is 64).

[0054] (3) The abstract syntax tree F is encoded by the AST encoder. 1 and F 2 For vertical analysis, in this example, contract A has a total of 10 paths, and contract B has a total of 16 paths, generating AST sequence s 1 and 2 Each path f i The corresponding feature vector further obtains the sequence s composed of all paths 1 The set of feature vectors Path Sequences 2 The set of feature vectors

[0055] (4) MAM is introduced to further improve the accuracy and merge the two coded information to obtain the 1 With Y 1 and G 2 With Y 2 The merged matrix and In order to pay attention from different perspectives and capture long-range dependencies in the sequence, we also introduce a multi-head attention mechanism to pay attention from different perspectives and capture long-short dependencies in sequence.

[0056] (5) The vector p i and Middle p j Input to the cosine similarity calculation function to get p i and p j similarity value M; set a threshold a, and judge the similarity by judging the size of the similarity value M and the threshold, specifically:

[0057] 5-1 Calculation using cosine similarity calculation function and The similarity M between vectors is:

[0058]

[0059] 5-2 Set the threshold a=0.75, compare the similarity value M of function blocks A and B with the threshold a, and determine whether function blocks A and B are similar;

[0060] 5-3 If M ≥ a, that is, the similarity value between function blocks A and B is higher than 0.75, it means that function blocks A and B are similar; otherwise, function blocks A and B are not similar;

[0061] 5-4 In this example, the similarity value M is greater than 0.75, indicating that there is similarity between function blocks A and B.

[0062] The above description of the embodiments is to facilitate the understanding and application of the present invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments. Improvements and modifications made by those skilled in the art to the present invention based on the disclosure of the present invention should be within the protection scope of the present invention.

Claims

1. A smart contract code clone detection method based on AST multi-dimensional feature fusion, comprising the following steps: (1) Filter out function block pairs with similar functions from smart contracts; (2) For any pair of function blocks C 1 and C 2 , convert it into an abstract syntax tree T 1 and T 2 ; (3) Construct an encoder based on the GCN-Transformer integrated model, with T 1 and T 2 As input, the corresponding encoding sequence G containing the grammatical features of the function block is extracted 1 and G 2 and the encoding sequence Y containing the semantic features of the function block 1 and Y 2 ; (4) The grammatical features and semantic features are integrated to obtain G 1 With Y 1 The merged feature vector S 1 and G 2 With Y 2 The merged feature vector S 2 ; (5) Calculate the eigenvector S 1 With S 2 If the similarity is greater than the set threshold, the function block C in the smart contract is determined 1 and C 2 resemblance.

2. The smart contract code cloning detection method according to claim 1, Features: The specific implementation method of step (1) is as follows: in a smart contract, a function represents the execution of logic and the transfer of funds. By extracting keywords from the smart contract programming code, analyzing the definition and scope of function variables, pre-judgment of function blocks is performed, and function block pairs with similar functions are specifically extracted therefrom.

3. The smart contract code cloning detection method according to claim 1, Features: In step (3), for the extraction of grammatical features, since the nodes in GCN contain the grammatical information about the type and value in AST when embedded, the information of each layer of nodes in AST can be aggregated through the hop in GCN, so as to extract the grammatical information horizontally and layer by layer. Specifically, first, T is extracted according to the specific code line. 1 and T 2 The graph is split into two parts, and the graph is regarded as another mode of AST. Starting from the root node in AST, the sibling nodes of the current node are aggregated through the convolution of the first hop, and then the grammatical information from its neighboring nodes is indirectly aggregated by increasing the number of hops. In order to solve the problem that Transformer cannot capture sequential information, the feature of position encoding is introduced in the encoding process. The sequential information is injected into the symbol embedding vector through position encoding, and T is obtained. 1 The coding sequence of G 1 and T 2 The coding sequence of G 2 .

4. The smart contract code cloning detection method according to claim 3, Features: Considering that the code corresponding to a node in AST may have different meanings in different code lines, the initial vector of the node needs to be converted into a semantic vector combined with the usage environment.

5. The smart contract code cloning detection method according to claim 1, Features: In step (3), the semantic features are extracted according to the abstract syntax tree T 1 and T 2 , extract all pairwise paths between terminal nodes and represent them as a sequence of terminal nodes and non-terminal nodes. Specifically: First, from T 1 and T 2 Extract the corresponding AST path sequence P 1 and P 2 , the first and last nodes of the AST path are terminals, whose values ​​are the tokens in the code. The tokens are split into sub-tokens and a learned embedding matrix E is used. subtoken To represent each sub-Token, the sub-Token vectors are summed to represent the Token, and then a fully connected layer is applied to connect the vector representations of each terminal node Token; each AST path is encoded separately, and the vector representation of the terminal node combination is aggregated by average pooling to initialize the state of the decoder, and then a learned embedding matrix E is used nodes Represents each node on the path, and then uses the final state of the bidirectional LSTM to encode the entire AST path sequence to obtain T 1 The coding sequence Y 1 and T 2 The coding sequence Y 2 .

6. The smart contract code cloning detection method according to claim 1, Features: In the process of fusing grammatical features and semantic features in step (4), a multi-head attention mechanism is introduced to analyze the encoded sequence Y from different angles. 1 and Y 2 An attention mechanism analysis is performed to sequentially capture the long and short dependencies in the sequence to further analyze the semantic information.

7. The smart contract code cloning detection method according to claim 1, Features: In step (5), the cosine similarity detection algorithm is used to calculate the feature vector S 1 With S 2 The similarity.

8. The smart contract code cloning detection method according to claim 1, Features: This detection method performs clone detection on smart contract code for function blocks with important functions. It converts the code into an abstract syntax tree, then fuses the grammatical features and semantic features extracted from it, and uses a similarity detection algorithm to calculate whether there is code reuse, thereby avoiding the spread of smart contract security vulnerabilities caused by code reuse.

Images