An intelligent contract defect detection method based on ensemble learning and graph neural network

Abstract

The application discloses an intelligent contract defect detection method based on ensemble learning and a graph neural network, and comprises the following steps: acquiring an intelligent contract, and extracting a feature vector of the intelligent contract; acquiring a plurality of intelligent contract defect detection tools, and respectively constructing a confidence model for the plurality of intelligent contract defect detection tools based on a deep neural network; and acquiring a detection result of the intelligent contract based on the plurality of confidence models and the feature vector. The application uses the mode of ensemble learning to combine the detection advantages of a plurality of existing tools to obtain a more accurate detection result, reduces the false alarm and missed alarm problems caused by insufficient capacity of a single tool, simultaneously uses a graph neural network to represent contract graph features, and avoids loss of important information. The application can identify an intelligent contract containing defects before being put online, ensures the safety of the intelligent contract in a blockchain system as much as possible, and avoids economic losses.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of intelligent contract and program defect detection, and particularly relates to an intelligent contract defect detection method based on ensemble learning and graph neural networks. BACKGROUND

[0002] An intelligent contract is an automatically executed digital agreement, which carries huge financial value, and therefore it is crucial to ensure its security. Current intelligent contract defect detection includes traditional detection methods such as static program analysis and dynamic program analysis, and detection methods based on machine learning technology. Traditional detection methods rely on patterns and rules set by experts, are low in efficiency, poor in scalability, and are prone to false negative and false positive detection reports.

[0003] Machine learning technology has developed rapidly in the field of defect detection, and can automatically identify intelligent contracts with defects with high accuracy. There are many mature tools for detecting intelligent contract defects, such as Oyente, Mainan, etc., but each tool uses different rules and principles, and has different detection capabilities for different types of defects, resulting in different detection effects and results.

[0004] Static analysis verifies program code without running the code through lexical analysis, syntax analysis, etc. Symbolic execution, taint analysis, etc. are typical representatives of static analysis methods. Static analysis is high in efficiency, but has a high false positive rate. Unlike static analysis, dynamic analysis performs analysis during program execution, which can greatly reduce the false positive rate, but due to the low coverage, the false negative rate is high.

[0005] Machine learning algorithms have also been applied to intelligent contract defect detection. In the process of structuring intelligent contract code, the traditional method usually encodes the operation code or intelligent contract code as text, and some researchers obtain vectorized representation of intelligent contracts by encoding abstract syntax trees. However, these encoding methods will lose a lot of code information, such as structured information, data dependency information, and control flow information, which will seriously restrict the detection accuracy of the defect detection model. In addition, existing machine learning algorithms ignore the combination with existing tools, and do not fully utilize the advantages of existing tools, so the detection effect is limited. SUMMARY

[0006] The purpose of the present application is to provide an intelligent contract defect detection method based on ensemble learning and graph neural networks to solve the problems existing in the prior art.

[0007] To achieve the above purpose, the present application provides an intelligent contract defect detection method based on ensemble learning and graph neural networks, comprising the following steps:

[0008] obtaining a smart contract, extracting a feature vector of the smart contract;

[0009] obtaining a plurality of smart contract defect detection tools, respectively constructing a confidence model for the plurality of smart contract defect detection tools based on a deep neural network;

[0010] obtaining a detection result of the smart contract based on the plurality of confidence models and the feature vector.

[0011] Optionally, the process of extracting the feature vector of the smart contract comprises:

[0012] constructing a contract graph based on an abstract syntax tree, a control flow graph, a data dependency graph, and a code natural sequence;

[0013] encoding the contract graph, and extracting the feature vector of the smart contract.

[0014] Optionally, the process of constructing the contract graph based on the abstract syntax tree, the control flow graph, the data dependency graph, and the code natural sequence comprises:

[0015] compiling the smart contract to obtain an abstract syntax tree;

[0016] inputting the abstract syntax tree into a smart contract static analysis framework to obtain a control flow graph and a data dependency graph;

[0017] obtaining a code natural sequence of the smart contract, and combining the abstract syntax tree, the control flow graph, the data dependency graph, and the code natural sequence to construct the contract graph.

[0018] Optionally, the nodes of the contract graph are nodes in the abstract syntax tree, the node types in the contract graph correspond to the types of the nodes in the abstract syntax tree, and the node types include but are not limited to statements and expressions.

[0019] The types of the edges of the contract graph include edges of the abstract syntax tree representing code hierarchical relationships, control flow edges representing program execution paths, data flow edges representing variable access and modification, and code natural sequence edges embodying source code natural order.

[0020] Optionally, the process of encoding the contract graph comprises:

[0021] encoding the types of the nodes in the contract graph to obtain type encodings;

[0022] regarding the token sequence in the node as text and vectorizing to obtain token sequence encodings;

[0023] taking the type encodings and the token sequence encodings as initial feature values of the nodes in the contract graph.

[0024] generate a final feature vector for each node based on the gated graph neural network and the initial feature value of the node;

[0025] sum the final feature vectors of each node to obtain a feature vector of the smart contract.

[0026] Optionally, the final feature vector includes information of the node itself and information of adjacent nodes.

[0027] Optionally, the process of obtaining the detection result of the smart contract based on the plurality of confidence models and the feature vector comprises:

[0028] detecting the smart contract based on each of the plurality of smart contract defect detection tools to obtain a plurality of detection results;

[0029] inputting the plurality of feature vectors into the constructed confidence model respectively, and taking whether the detection result is correct as a label of the confidence model to obtain a confidence of each of the smart contract defect detection tools;

[0030] fitting the confidence of each of the smart contract defect detection tools and the detection result based on a logistic regression model to obtain the detection result of the smart contract.

[0031] Optionally, the input of the logistic regression model is {c1, c2…ci, e1, e2, ei}, wherein ci is the confidence of the i-th smart contract defect detection tool, ei is the detection result of the i-th smart contract defect detection tool, the label is the true situation of whether the smart contract contains defects, and the output is 0 or 1, 0 indicating that there is no defect in the smart contract, and 1 indicating that there is a defect in the smart contract.

[0032] The technical effects of the present application are:

[0033] 1. The present application uses the integrated learning method to combine the detection advantages of multiple existing tools to obtain more accurate detection results, and can reduce the false positives and false negatives caused by the insufficient ability of a single tool.

[0034] 2. The present application constructs a fine-grained contract graph, which can reflect more comprehensive information such as syntax and semantic information, structural information, control dependency relationship, data dependency relationship and natural language sequence in the smart contract. At the same time, the graph neural network is further used to represent the contract graph features, and the graph neural network can make the nodes in the contract graph have node information and neighbor node information at the same time, avoiding the loss of important information.

[0035] 3. The application can identify defective smart contracts before going online, can guarantee the security of smart contracts in the blockchain system as much as possible, and avoid economic losses. BRIEF DESCRIPTION OF DRAWINGS

[0036] The drawings constituting a part of this application are used to provide further understanding of the application, the illustrative embodiments of the application and the description thereof are used to explain the application, and do not constitute improper limitation on the application. In the drawings:

[0037] Figure 1 for the construction process of the contract graph in the embodiment of the application;

[0038] Figure 2 for the contract graph in the embodiment of the application;

[0039] Figure 3 for the construction process of the integrated learning model in the embodiment of the application. DETAILED DESCRIPTION

[0040] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0041] It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0042] Embodiment one

[0043] As shown in the figure, the present embodiment provides a smart contract defect detection method based on integrated learning and graph neural network, which includes the following steps: Figures 1-3

[0044] constructing a contract graph, Figure 1 The specific construction process is introduced. First, the abstract syntax tree is obtained by compiling the smart contract. Then, the abstract syntax tree is input into the smart contract static analysis framework to obtain the control flow graph and the data dependency graph. Finally, the abstract syntax tree, the control flow graph, the data dependency graph and the natural sequence of the smart contract code are combined to obtain the final contract graph.

[0045] The graph neural network is used to encode the contract graph, and the overall process is shown in Figure 2 In the process of encoding nodes, first, the type of node is encoded using one-hot encoding method, the token in the node is regarded as text and is vectorized using word2vec, and the type encoding and token encoding are connected as the initial feature value of the node in the contract graph.​

[0046] Then, the node information adjacent to the current node is obtained using a gated graph neural network. The contract graph is taken as the input of the graph neural network, and the graph neural network will generate a new feature vector for each node in the contract graph, which contains not only the information of the node itself but also the information of the adjacent nodes.

[0047] Finally, the feature vectors of each node in the contract graph are added to form a feature vector that can represent the entire contract graph.

[0048] An ensemble learning model is constructed, and the specific process is shown in Figure 3 A confidence model is constructed for each smart contract defect detection tool using a deep neural network. The input of the confidence model is the contract graph feature vector, the label is whether the tool detects correctly, and the output is the confidence probability of the tool result, i.e., the confidence. Then, a logistic regression model is used to fit the confidence of each tool and the detection result of each tool to obtain the final detection result of the smart contract.

[0049] Embodiment Two

[0050] In this embodiment, a detailed step of a smart contract defect detection method based on ensemble learning and graph neural network is provided, which includes:

[0051] Step 1: Constructing a contract graph. The syntax and semantic information in the smart contract is captured using abstract syntax tree (AST), control flow graph (CFG), and data dependency graph (DDG). The nodes of the contract graph are the nodes in the abstract syntax tree, and the node types also correspond to the node types in the abstract syntax tree, including statements, expressions, etc. The edges of the contract graph have four types, which are the edges of the abstract syntax tree representing the code hierarchy relationship, the control flow edges representing the program execution path, the data flow edges representing the variable access and modification, and the code natural sequence edges representing the natural order of the source code.

[0052] Step 2: Encoding the contract graph and extracting the smart contract features. The code corresponding to the nodes in the contract graph is encoded using word2vec, the node types are encoded using one-hot, and the two parts are connected as the initial vector of the node. Then, the adjacent node information is aggregated using a gated graph neural network to generate the final feature vector of the node. The vectors of all nodes in the contract graph are added to obtain the feature vector of the smart contract.

[0053] Step 3: Build confidence model for each tool. Build confidence model for each tool respectively. Confidence refers to the degree of trust in the detection results of each detection tool. Let t1, t2, t3…tN represent N detection tools. For a specific defect d at position l, whether the smart contract contains the defect can be represented as F(l, d) = ri, and the confidence of the tool can be represented as P(ti, l, d) = ci, and the tool detection result can be represented as E(ti, l, d) = ei. The label of the confidence model is L(ti, l, d) = E(ti, l, d) - F(l, d).

[0054] Step 4: Integrate tool results. Use a logistic regression model to integrate the detection results of each tool. The input of the model is {c1, c2…ci, e1, e2, ei}, and the label is the true situation of whether the smart contract contains defects. The output of the model is 0 or 1, 0 means that there is no defect in the smart contract, and 1 means that there is a defect in the smart contract.

[0055] Example Three

[0056] This embodiment provides an application example of the smart contract defect detection method based on ensemble learning and graph neural network, including the following steps:

[0057] Step 1: Compile the smart contract to obtain the AST in json format;

[0058] Step 2: Input the AST into the Slither analysis framework to obtain the control flow graph and data dependency graph of the smart contract;

[0059] Step 3: Combine the AST, CFG, DDG and natural sequence of the smart contract code to form the contract graph;

[0060] Step 4: Use one-hot encoding to encode the node type in the contract graph, use word2vec to encode the token in the node, and connect the two parts as the feature vector of the node;

[0061] Step 5: Input the encoded contract graph of the node into the gated graph neural network to update the feature vector of the node;

[0062] Step 6: Aggregate the node vector to obtain a feature vector that can represent the entire contract graph;

[0063] Step 7: Use 11 smart contract defect detection tools such as HoneyBadger, Maian, Manticore, Mythril, Osiris, Oyente, Securify, Slither, Smartcheck, Solhint, and Conka to detect the smart contract code in the dataset;

[0064] Step 8: Use the feature vector of the contract graph as input, and the result of the tool detection as label, build a confidence model for each tool using deep neural network;

[0065] Step 9: Use logistic regression to integrate the confidence results of each tool. The output of the model is whether the smart contract contains defects.

[0066] The present application uses a gated graph neural network to represent a smart contract, and then uses ensemble learning to combine the advantages of multiple existing tools to build a more effective smart contract defect detection tool. Ensemble learning can fully combine the advantages and characteristics of existing tools, and reduce the high false positive rate and high false negative rate caused by a single tool.

[0067] Graph neural networks have great potential in code feature representation. The gated graph neural network is an information transmission model based on a gated neural unit, which can better handle sequential problems. The gated graph neural network can effectively handle sequential problems and extract comprehensive smart contract code information to provide effective input for model training. Therefore, unlike traditional direct encoding of code text and abstract syntax tree, graph neural networks are based on contract graphs, which integrate data dependencies and control dependencies, and can more comprehensively represent code information. Therefore, by combining graph neural network encoding technology and ensemble learning technology, the integrity of the code representation information can be ensured as much as possible, and the existing tools can be fully utilized to obtain more accurate detection results.

[0068] The present application can identify defects in smart contracts before they are deployed on a blockchain system, thereby avoiding the online of problematic contracts and ensuring account security.

[0069] The above describes only the preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application can be easily thought of by those skilled in the art, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for detecting defects in smart contracts based on ensemble learning and graph neural networks, characterized in that, Includes the following steps: Obtain the smart contract and extract its feature vector; The process of extracting the feature vector of the smart contract includes: Contract graphs are constructed based on abstract syntax trees, control flow graphs, data dependency graphs, and natural code sequences. The contract graph is encoded, and the feature vector of the smart contract is extracted; Acquire several smart contract defect detection tools, and construct confidence models for each of the smart contract defect detection tools based on deep neural networks; The detection results of the smart contract are obtained based on several confidence models and the feature vectors. The process of obtaining the detection result of the smart contract based on several confidence models and the feature vectors includes: The smart contract is tested using several of the aforementioned smart contract defect detection tools, and several detection results are obtained. Several feature vectors are input into the constructed confidence model, and the correctness of the detection result is used as the label of the confidence model to obtain the confidence of each smart contract defect detection tool. The confidence level and detection result of each smart contract defect detection tool are fitted using a logistic regression model to obtain the detection result of the smart contract. The input to the logistic regression model is {c1,c2…ci,e1,e2,ei}, where ci is the confidence level of the i-th smart contract defect detection tool, ei is the detection result of the i-th smart contract defect detection tool, and the label indicates whether the smart contract contains defects. The output is 0 or 1, where 0 indicates that there are no defects in the smart contract and 1 indicates that there are defects in the smart contract.

2. The smart contract defect detection method based on ensemble learning and graph neural networks according to claim 1, characterized in that, The process of constructing a contract graph based on abstract syntax trees, control flow graphs, data dependency graphs, and the natural sequence of code includes: The smart contract is compiled to obtain an abstract syntax tree; The abstract syntax tree is input into the smart contract static analysis framework to obtain the control flow graph and data dependency graph; Obtain the natural sequence of code for the smart contract, and combine the abstract syntax tree, the control flow graph, the data dependency graph, and the natural sequence of code to construct the contract graph.

3. The smart contract defect detection method based on ensemble learning and graph neural networks according to claim 1, characterized in that, The nodes in the contract graph are nodes in the abstract syntax tree. The node types in the contract graph correspond to the node types in the abstract syntax tree. The node types include, but are not limited to, statements and expressions. The types of edges in the contract graph include: edges representing abstract syntax trees that represent code hierarchy relationships, control flow edges representing program execution paths, data flow edges representing variable access and modification, and natural code sequence edges that reflect the natural order of the source code.

4. The smart contract defect detection method based on ensemble learning and graph neural networks according to claim 3, characterized in that, The process of encoding the contract diagram includes: Encode the type of the nodes in the contract graph to obtain the type code; Treat the token sequence in the node as text and vectorize it to obtain the token sequence encoding; The type encoding and the token sequence encoding are used as the initial feature values ​​of the nodes in the contract graph; The final feature vector is generated based on the initial feature values ​​of each node using a gated graph neural network. The final feature vectors of each node are summed to obtain the feature vector of the smart contract.

5. The smart contract defect detection method based on ensemble learning and graph neural networks according to claim 4, characterized in that, The final feature vector includes information about the node itself and information about its neighboring nodes.

Images