Smart contract unknown vulnerability detection method based on CNN-BiLSTM multi-label classification

Abstract

The present invention provides a method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification. The method specifically comprises the following steps: S1, inserting the source code of an Ethereum client Geth; S2, replaying transactions of smart contracts on the official Ethereum website, and obtaining a safe transaction operation code sequence set and a dangerous transaction operation code sequence set through the inserted Ethereum client Geth; S3, training a CNN-BiLSTM multi-label classification model using the obtained safe transaction operation code sequence set and dangerous transaction operation code sequence set; S4, using the inserted Ethereum client in an Ethereum environment, collecting transaction operation code sequences in real time and uploading them to an audit center; S5, obtaining a probability value for each label based on a known vulnerability detection model and determining unknown vulnerabilities according to two set thresholds. The audit center implements the detection of unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification, effectively improving the security of Ethereum smart contracts.

Description

Technical Field

[0001] The present invention relates to the fields of Ethereum smart contracts and cyberspace security, and in particular to a method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification. Background Art

[0002] With the rapid development of blockchain technology, Ethereum has become a leading platform. Compared to Bitcoin, Ethereum supports not only standard transactions but also smart contracts. Because smart contracts hold large amounts of funds and cannot be modified once on-chain, they have become a frequent target for hackers. Compared to attacks on mature traditional applications, these attacks offer low costs and high returns, as exemplified by the infamous The DAO incident. Consequently, smart contract vulnerability detection is attracting increasing attention.

[0003] Smart contract vulnerabilities are constantly emerging. For example, in Ethereum, there are reentrancy vulnerabilities, integer overflow vulnerabilities, and timestamp dependency vulnerabilities. According to statistics, there are over 300 vulnerabilities in Ethereum smart contracts today. Most research on smart contract vulnerability detection focuses on detecting known vulnerabilities in smart contracts, including symbolic execution, fuzz testing, formal verification, and other traditional application vulnerability detection methods, as well as newer methods such as deep learning. However, research on unknown vulnerabilities is relatively rare. Therefore, designing a method to detect unknown vulnerabilities in Ethereum smart contracts has become a breakthrough in smart contract security. Summary of the Invention

[0004] To overcome the above-mentioned shortcomings of the prior art, the present invention provides a method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification to ensure the security of smart contracts. The problem of detecting unknown vulnerabilities in smart contracts is modeled as an end-to-end classification model. For transactions that trigger the execution of smart contracts, the opcode sequences generated by the transactions are collected to determine whether they are unknown vulnerabilities, thereby realizing the detection of unknown vulnerabilities in smart contracts. The specific steps are as follows:

[0005] S1, insert the source code of the Ethereum client Geth;

[0006] S2, replay the transactions of the smart contract in the official Ethereum website, and obtain the safe transaction operation code sequence set and the dangerous transaction operation code sequence set through the plugged Ethereum client Geth;

[0007] S3, using the obtained safe transaction operation code sequence set and dangerous transaction operation code sequence set to train the CNN-BiLSTM multi-label classification model;

[0008] S4, using the instrumented Ethereum client Geth in the Ethereum environment, collects transaction opcode sequences in real time and uploads them to the audit center;

[0009] S5, based on the known vulnerability detection model, obtains the probability value of each label and completes the judgment of unknown vulnerabilities based on the two set thresholds. The Audit Center implements the unknown vulnerability detection of Ethereum smart contracts based on the CNN-BiLSTM multi-label classification model, effectively improving the security of Ethereum smart contracts.

[0010] Furthermore, in S1, the said stub refers to inserting code for collecting transaction opcode sequences into the EVM Ethereum virtual machine in the Ethereum client Geth source code, but does not affect the normal execution of the EVM Ethereum virtual machine. The main information collected includes:

[0011] Block information; transaction information; opcode instruction information; information related to stack, memory, storage and balance change information.

[0012] Block information includes Timestamp; transaction information includes transaction sender address and receiver address, transaction hash, transaction input data and the amount of Ether transferred; opcode instruction information includes ADD, PUSH, MLOAD, RETURN and CALLDATALOAD.

[0013] Furthermore, in S2, the smart contract is written in Solidity and runs on the Ethereum virtual machine.

[0014] Furthermore, in S2, the safe transaction operation code sequence refers to the operation code sequence generated by the transaction that triggers the normal execution of the smart contract; the dangerous transaction operation code sequence refers to the operation code sequence generated by the transaction that triggers the execution of the smart contract vulnerability code.

[0015] Furthermore, in S2, the obtained safe transaction operation code sequence set and dangerous transaction operation code sequence set include:

[0016] S200, replays smart contract transactions on the official Ethereum website;

[0017] S201, using the plugged Ethereum client Geth to obtain safe transactions and dangerous transactions;

[0018] S202, obtaining a safe transaction operation code sequence set through the inserted Ethereum client Geth; obtaining a dangerous transaction operation code sequence set through the inserted Ethereum client Geth.

[0019] Furthermore, in S3, the safe transaction operation code sequence set and the dangerous transaction operation code sequence set together constitute the transaction operation code sequence set. The transaction operation code sequence set is used as the training set for the CNN-BiLSTM multi-label classification model. The training process of the CNN-BiLSTM multi-label classification model includes:

[0020] S301, preprocess the transaction operation code sequence set obtained in S2, and convert the transaction operation code sequence into a word vector matrix using one-hot encoding;

[0021] S302, inputting the word vector matrix into a convolutional neural network for feature extraction and calculating feature vectors;

[0022] In step S303, the feature vector is input as prior knowledge into the BiLSTM bidirectional recurrent neural network. The number of epochs is set to 100, the maximum length of the model input is 3000, and the Sigmoid classification is used to predict the label sequence to obtain the probability score of each label.

[0023] Furthermore, in S301, the transaction operation code sequence set is pre-processed as follows:

[0024] The dangerous transaction opcode sequence set contains five vulnerability types: incorrect permission check vulnerability, incorrect handling exception vulnerability, lack of standard event vulnerability, strict balance check vulnerability, and timestamp / block number dependency vulnerability. The transaction opcode sequences were converted into word embedding matrices using one-hot encoding. The opcode sequence set was then divided into training, validation, and test sets with a ratio of 7:2:1, with 1,176, 369, and 188 sequences, respectively. The implementation process used the TensorFlow deep learning framework, version 1.15.0.

[0025] Furthermore, in S303, the process of predicting the tag sequence is as follows:

[0026] (1) Input the feature vector y into the BiLSTM bidirectional recurrent neural network model. The forward LSTM and backward LSTM simultaneously process the feature vector y. t The context is operated, the forward LSTM learns the following information, and obtains the forward hidden state Backward LSTM learns the above information and obtains the backward hidden state Concatenate the two to get the hidden state h t .

[0027]

[0028]

[0029]

[0030] Among them, f (LSTM) represents the LSTM algorithm, c t-1 represents the cell state at time t-1, c t+1 represents the cell state at time t+1, h t-1 represents the hidden state at time t-1, h t+1 represents the hidden state at time t+1, h t represents the hidden state at time t;

[0031] (2) The eigenvector y t With the hidden state h t-1 Input to the sigmoid layer for scaling to obtain the predicted label sequence:

[0032] o t =σ(W o *[h t-1 ,y t ]+b o )

[0033] h t =o t tanh(C t )

[0034] Among them, t represents the initial output label sequence, σ represents the sigmoid function, W o represents the output matrix, h t-1 represents the hidden state at time t-1, b o Indicates output bias, h t Represents the final predicted label sequence, and the tanh function is a compression process of the previously obtained information.

[0035] Furthermore, in S4, the audit center includes a cloud server, which stores a trained CNN-BiLSTM multi-label classification model to detect unknown vulnerabilities in smart contracts.

[0036] Furthermore, in S4, the real-time collection of transaction operation code sequences is an operation code sequence generated by the transaction that triggers the execution of the smart contract.

[0037] Furthermore, in S5, the process of detecting unknown vulnerabilities includes:

[0038] S501, setting two thresholds;

[0039] S502, determining whether the sum of the probabilities of each tag in S303 is greater than a first threshold and whether the maximum value of the probability score of each tag is less than a second threshold. If both conditions are met, it is determined that the transaction operation code sequence contains an unknown vulnerability.

[0040] Furthermore, in S501 , the two thresholds are set to 0.2 and 0.999 respectively.

[0041] The beneficial effects of the present invention are:

[0042] 1. This invention provides a method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification. It can dynamically detect unknown vulnerabilities in real time after the smart contract is put on the chain, thereby minimizing user losses to a greater extent.

[0043] 2. The technology of the present invention can be widely applied to industrial platforms.

[0044] 3. Since the transaction operation code sequence is uploaded to the audit center, if a new vulnerability is discovered later, more unknown vulnerabilities can be discovered by retraining the model by obtaining the transaction operation code sequence containing the new vulnerability. Therefore, the present invention has good adaptability and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flowchart of the steps of the method for detecting unknown vulnerabilities in smart contracts of the present invention;

[0046] Figure 2 This is the CNN-BiLSTM multi-label classification model diagram of the present invention;

[0047] Figure 3 It is a schematic diagram of the operation code sequence of the present invention;

[0048] Figure 4 This is a flow chart of the method for detecting unknown vulnerabilities in smart contracts of the present invention. DETAILED DESCRIPTION

[0049] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0050] See also Figure 1 The present invention provides a method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification, comprising the following steps:

[0051] S1, insert the source code of the Ethereum client Geth;

[0052] Furthermore, in S1, the stub refers to inserting code for collecting transaction opcode sequences into the EVM Ethereum virtual machine in the Ethereum client Geth source code, but does not affect the normal execution of the program. The main information collected includes:

[0053] Block information includes Timestamp; transaction information includes the transaction sender address and receiver address, transaction hash, transaction input data, and the amount of Ether transferred in the transaction; opcode instruction information includes ADD, PUSH, MLOAD, RETURN, CALLDATALOAD; information related to stack, memory, and storage; and balance change information.

[0054] S2, replay the transactions of the smart contract in the official Ethereum website, and obtain the safe transaction operation code sequence set and the dangerous transaction operation code sequence set through the plugged Ethereum client Geth;

[0055] Safe transaction opcode sequences are those generated by transactions that trigger the normal execution of smart contracts, while dangerous transaction opcode sequences are those generated by transactions that trigger the execution of vulnerable smart contract code. Contract transactions from the official Ethereum website were replayed using the instrumented Ethereum client Geth to obtain safe and dangerous transactions. Using the instrumented Ethereum client Geth, we obtained the safe transaction opcode sequence set, while also obtaining the dangerous transaction opcode sequence set.

[0056] S3, using the obtained safe transaction operation code sequence set and dangerous transaction operation code sequence set to train the CNN-BiLSTM multi-label classification model;

[0057] The safe transaction operation code sequence set and the dangerous transaction operation code sequence set together constitute the transaction operation code sequence set as the training set of the CNN-BiLSTM multi-label classification model. The dangerous transaction operation code sequence set in the transaction operation code sequence set contains 5 types of vulnerabilities, namely, incorrect permission check vulnerabilities, abnormal vulnerabilities in error handling, lack of standard event vulnerabilities, strict balance check vulnerabilities, and timestamp / block number dependency vulnerabilities. The transaction operation code sequence set obtained from S2 is divided into training set, validation set, and test set in a ratio of 7:2:1, with the numbers being 1176, 369, and 188 respectively. The implementation process uses the Tensorflow deep learning framework, version 1.15.0. The CNN-BiLSTM multi-label classification model is as follows: Figure 2 As shown:

[0058] (1) Use one-hot encoding to convert the transaction operation code sequence into a word vector matrix;

[0059] (2) The transaction operation code sequence word vector matrix is ​​input into the convolution layer to extract high-level features. Each convolution layer applies an activation function to reduce the nonlinearity of the network, and then a maximum pooling layer is applied to reduce the size of the data;

[0060] (3) The results of all max pooling layers are concatenated and used as prior knowledge to input into the BiLSTM bidirectional recurrent neural network. Concat feature fusion is used to further enhance feature propagation. Dropout is used to optimize the neural network to prevent overfitting. The number of epochs is set to 100, and the maximum length of the model input is 3000. Sigmoid classification is used to predict the label sequence and obtain the probability score of each label.

[0061] S4, using the instrumented Ethereum client Geth in the Ethereum environment, collects transaction opcode sequences in real time and uploads them to the audit center;

[0062] The audit center refers to the cloud server, which stores the trained CNN-BiLSTM multi-label classification model to detect unknown vulnerabilities in smart contracts. The real-time collection of transaction operation code sequences is the operation code sequence generated by the transaction that triggers the execution of the smart contract. The sequence is composed of multiple CALLDATALOAD, MSTORE, STOP, PUSH1, and PUSH2 assembly operation codes. Each sequence represents the complete execution process of a transaction. The sequence length is variable, such as Figure 3 shown.

[0063] S5, based on the known vulnerability detection model, obtains the probability value of each label and completes the judgment of unknown vulnerabilities based on the two set thresholds. The Audit Center implements the unknown vulnerability detection of Ethereum smart contracts based on the CNN-BiLSTM multi-label classification model, effectively improving the security of Ethereum smart contracts.

[0064] Unknown vulnerabilities may have a certain degree of similarity with known vulnerabilities. Therefore, the first threshold is set to 0.2 and the second threshold is set to 0.999. The sum of the probabilities of each label obtained by the CNN-BiLSTM multi-label classification model is greater than the first threshold and the maximum probability score of each label is less than the second threshold. If both conditions are met, it is determined that the transaction operation code sequence contains unknown vulnerabilities.

[0065] In order to have a clearer understanding of the present invention, Figure 4 As shown in FIG, the present invention elaborates on an unknown vulnerability detection process for initiating transactions with smart contracts:

[0066] (1) Initiate a transaction to the smart contract in Ethereum;

[0067] (2) The plugged-in Ethereum client Geth collects the transaction's opcode sequence in real time and uploads it to the audit center.

[0068] (3) Based on the two thresholds set, the audit center uses the previously trained CNN-BiLSTM multi-label classification model to obtain the probability of each label, which is greater than the first threshold and the maximum probability score of each label is less than the second threshold. If these two conditions are met at the same time, it is determined that the transaction operation code sequence contains unknown vulnerabilities. Otherwise, the transaction does not contain unknown vulnerabilities.

[0069] The above describes in detail the preferred embodiments of the present invention. It should be understood that numerous modifications and variations based on the concepts of the present invention are possible by those skilled in the art without inventive effort. Therefore, any technical solution that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. A smart contract unknown vulnerability detection method based on CNN-BiLSTM multi-label classification, characterized by: The specific steps include: S1, insert the source code of the Ethereum client Geth; S2, replay the transactions of the smart contract in the official Ethereum website, and obtain the safe transaction operation code sequence set and the dangerous transaction operation code sequence set through the plugged Ethereum client Geth; S3, using the obtained safe transaction operation code sequence set and dangerous transaction operation code sequence set to train the CNN-BiLSTM multi-label classification model; S4, using the instrumented Ethereum client Geth in the Ethereum environment, collects transaction opcode sequences in real time and uploads them to the audit center; S5, based on the known vulnerability detection model, obtains the probability value of each label and completes the judgment of unknown vulnerabilities according to the two set thresholds; In S1, the instrumentation refers to inserting code for collecting transaction opcode sequences into the EVM Ethereum virtual machine in the Ethereum client Geth source code, but does not affect the normal execution of the EVM Ethereum virtual machine. The main information collected includes: Block information; transaction information; opcode instruction information; information related to stack, memory, storage, and balance change information; In S3, the safe transaction operation code sequence set and the dangerous transaction operation code sequence set together constitute the transaction operation code sequence set. The transaction operation code sequence set is used as the training set for the CNN-BiLSTM multi-label classification model. The training process of the CNN-BiLSTM multi-label classification model includes: S301, pre-processing the transaction operation code sequence set, using one-hot encoding to convert the transaction operation code sequence into a word vector matrix; S302, inputting the word vector matrix into a convolutional neural network for feature extraction and calculating feature vectors; S303: Input the feature vector as prior knowledge into the BiLSTM bidirectional recurrent neural network to predict the label sequence and obtain the probability score of each label; In S5, the process of detecting unknown vulnerabilities includes: S501, setting two thresholds; S502, determining whether the sum of the probabilities of each tag in S303 is greater than a first threshold and whether the maximum value of the probability score of each tag is less than a second threshold. If both conditions are met, it is determined that the transaction operation code sequence contains an unknown vulnerability.

2. The method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification according to claim 1 is characterized in that: In S2, the smart contract is written in Solidity and runs on the Ethereum Virtual Machine.

3. The method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification according to claim 1 is characterized in that: In S2, the safe transaction operation code sequence refers to the operation code sequence generated by the transaction that triggers the normal execution of the smart contract; the dangerous transaction operation code sequence refers to the operation code sequence generated by the transaction that triggers the execution of the vulnerability code of the smart contract.

4. The method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification according to claim 1, characterized in that: In S2, obtaining a safe transaction operation code sequence set and a dangerous transaction operation code sequence set includes: S200, replays smart contract transactions on the official Ethereum website; S201, using the plugged Ethereum client Geth to obtain safe transactions and dangerous transactions; S202, obtaining a safe transaction operation code sequence set through the inserted Ethereum client Geth; obtaining a dangerous transaction operation code sequence set through the inserted Ethereum client Geth.

5. The method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification according to claim 1, characterized in that: In S4, the audit center includes a cloud server, which stores a trained CNN-BiLSTM multi-label classification model for detecting unknown vulnerabilities in smart contracts.

6. The method for detecting unknown vulnerabilities in smart contracts based on CNN-BiLSTM multi-label classification according to claim 1, characterized in that: In S4, the transaction operation code sequence is an operation code sequence generated by the transaction that triggers the execution of the smart contract.

Images