A hog and drsn-lstm-based smart contract vulnerability detection method and system

Abstract

The application belongs to the technical field of blockchain smart contract security, and provides a smart contract vulnerability detection method and system based on HOG and DRSN-LSTM. The method comprises the following steps: obtaining contract bytecode running in real time, and converting the contract bytecode into a grayscale image; adopting a bicubic difference algorithm to perform scaling processing on the grayscale image; adopting an HOG algorithm to perform feature extraction on the scaled grayscale image to obtain a feature map; drawing the feature map by using a gradient histogram to obtain a gradient histogram; based on the gradient histogram, adopting a DRSN-LSTM model to obtain a smart contract vulnerability type; the DRSN-LSTM model comprises: the first layer and the second layer each comprising a standardization layer, a Relu and a convolution layer, the third layer being a DRSN structure layer, the fourth layer being a global mean pooling layer, the fifth layer being a full connection layer, the sixth layer being an LSTM structure layer, and the seventh layer being a softmax layer. The application guarantees the accuracy and low false alarm rate of the vulnerability detection of the smart contract vulnerability detection model.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of blockchain smart contract security, and particularly relates to a smart contract vulnerability detection method and system based on HOG and DRSN-LSTM. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute prior art.

[0003] As a new technology, blockchain technology has attracted widespread attention from all walks of life in recent years. Blockchain is essentially a distributed and shared transaction ledger maintained by all miners in the blockchain network according to a consensus protocol. Blockchain technology has the characteristics of high decentralization, data tamper resistance, traceability, and has changed the traditional mode of the industry, and has made breakthrough progress in the fields of medicine, education, supply chain management and many others. Smart contract is a program running automatically on the blockchain, and is also one of the most successful applications of blockchain technology, and has become a hot topic of research in academia and industry.

[0004] Smart contract is a program written in a high-level language, so unreasonable design also exposes many vulnerabilities in the running process of smart contract. Once the smart contract is successfully deployed on the blockchain platform, it cannot be modified or revoked by human intervention until the contract meets the preset termination condition, which undoubtedly becomes the best target for network attackers. The most typical case is the occurrence of the DAO event, in which hackers used the reentrant vulnerability of the DAO contract to steal 3.6 million ethers. The smart contract cannot be modified or revoked after deployment, and the anonymity of blockchain technology makes it impossible to manually intervene to terminate the contract or recover the loss, which has caused serious negative impact and great loss to the society and economy. Therefore, the vulnerability detection research of smart contract has great significance.

[0005] At present, although smart contract vulnerability detection is a research hotspot, the existing smart contract vulnerability detection is mostly concentrated on symbolic execution, formal verification, fuzzy detection and intermediate representation detection methods, these detection methods rely too much on the source code of the contract to extract features, and require high expert experience, which is not conducive to the real-time detection of contract vulnerabilities. The method of using deep learning technology to achieve automatic feature extraction and reduce the dependence on expert experience has been widely recognized by researchers. Although the development of deep learning technology is very rapid, the application research in smart contract vulnerability detection is still very rare, and the existing detection method based on deep learning technology also relies heavily on the contract source code. In order to get rid of the dependence on the contract source code, researchers turn their attention to the contract bytecode, which also makes the contract vulnerability detection have a new detection method, but the existing deep learning technology detection method for bytecode is mostly to get the corresponding operation code by decompiling the bytecode for text binary classification detection, but this method is too backward and complex. Therefore, there is still a lot of room for improvement in the real-time of contract data acquisition, the simplicity of preprocessing, the comprehensiveness and keyness of feature extraction, and the performance improvement of the detection method in the smart contract vulnerability detection. SUMMARY

[0006] The application provides a smart contract vulnerability detection method and system based on HOG and DRSN-LSTM, which aims to solve the problems of over-reliance on contract source code, difficulty in obtaining contract bytecode binary files, difficulty in training after converting to grayscale images with inconsistent size, and incomplete feature extraction with noise in the extracted features, while ensuring the accuracy and low false positive rate of the smart contract vulnerability detection model. The purpose is to improve the robustness of the smart contract vulnerability detection model.

[0007] In order to achieve the above purpose, the application adopts the following technical scheme:

[0008] The first aspect of the application provides a smart contract vulnerability detection method based on HOG and DRSN-LSTM.

[0009] A smart contract vulnerability detection method based on HOG and DRSN-LSTM, comprising:

[0010] Obtain the contract bytecode running in real time, and convert it into a grayscale image, and use a bicubic difference algorithm to scale the grayscale image;

[0011] Use HOG algorithm to extract features from the scaled grayscale image to obtain a feature map;

[0012] Draw a gradient histogram of the feature map to obtain a gradient histogram;

[0013] Based on the gradient histogram, a DRSN-LSTM model is used to obtain the smart contract vulnerability type;

[0014] The DRSN-LSTM model comprises: the first layer and the second layer each comprising a standardization layer, a Relu and a convolution layer, the third layer being a DRSN structure layer, the fourth layer being a global mean pooling layer, the fifth layer being a full connection layer, the sixth layer being an LSTM structure layer, and the seventh layer being a softmax layer.

[0015] Further, the scaling processing of the gray scale image by using the bicubic difference algorithm specifically comprises: comparing the sizes of all the gray scale images, selecting the mode as the final gray scale image scaling benchmark, and scaling the gray scale image by using the bicubic interpolation algorithm.

[0016] Further, the process of obtaining the gradient histogram comprises:

[0017] The HOG algorithm is used to extract features from the scaled gray scale image to obtain a feature map, calculate the gradient of each pixel of the feature map, capture edge information, divide the feature map into 4x4 connected regions, i.e., 4x4 cell units, divide the angle into eight directions for gradient calculation;

[0018] The gradient histogram of each cell unit is counted to obtain the feature descriptor of each cell unit; several cell units are combined into a block, and the feature descriptors of all cells in the block are concatenated to obtain the HOG feature descriptor of the block, and the HOG feature descriptors of all blocks in the image are concatenated to obtain the gradient histogram.

[0019] Further, the DRSN structure layer adopts an attention mechanism layer and a soft thresholding.

[0020] Still further, the threshold value in the soft thresholding is automatically learned and generated by the attention mechanism, comprising:

[0021] The absolute values of all features of the input gradient histogram are calculated;

[0022] A feature is obtained through global mean pooling and averaging, denoted as A;

[0023] In another path, the gradient histogram after global mean pooling is input into a fully connected network, and a sigmoid function is used as the last layer to normalize the output to [0, 1], obtaining a coefficient denoted as a, and the final threshold value is represented as a x A.

[0024] Further, the smart contract vulnerability detection method further comprises a DRSN-LSTM model training process, the DRSN-LSTM model training process comprises the following steps: adjusting the size of the gray image, adjusting the size of the gray image processed by the bicubic difference algorithm, optimizing the DRSN-LSTM model parameters, selecting the model parameters with the highest smart contract vulnerability detection accuracy for saving, and obtaining the trained DRSN-LSTM model.

[0025] Further, the smart contract vulnerability type comprises: timestamp dependency, reentrant vulnerability, integer overflow, integer underflow, call stack vulnerability and transaction order dependency vulnerability.

[0026] The second aspect of the application provides a smart contract vulnerability detection system based on HOG and DRSN-LSTM.

[0027] A smart contract vulnerability detection system based on HOG and DRSN-LSTM comprises:

[0028] A data acquisition and scaling module configured to: acquire contract bytecode running in real time, and convert the contract bytecode into a gray image; and perform scaling processing on the gray image by using a bicubic difference algorithm.

[0029] A feature extraction module configured to: perform feature extraction on the scaled gray image by using a HOG algorithm, and obtain a feature map.

[0030] A gradient processing module configured to: draw the feature map by using a gradient histogram, and obtain a gradient histogram.

[0031] A vulnerability detection module configured to: based on the gradient histogram, obtain a smart contract vulnerability type by using a DRSN-LSTM model.

[0032] A DRSN-LSTM model construction module configured to: the first layer and the second layer each comprise a standardization layer, a Relu and a convolution layer; the third layer is a DRSN structure layer; the fourth layer is a global mean pooling layer; the fifth layer is a full connection layer; the sixth layer is an LSTM structure layer; and the seventh layer is a softmax layer.

[0033] The third aspect of the application provides a computer readable storage medium.

[0034] A computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the steps of the smart contract vulnerability detection method based on HOG and DRSN-LSTM in the first aspect described above.

[0035] The fourth aspect of the application provides a computer device.

[0036] The computer device comprises a memory, a processor, and a computer program stored on the memory and capable of running on the processor, and the processor implements the steps in the HOG and DRSN-LSTM-based smart contract vulnerability detection method according to the first aspect.

[0037] Compared with the prior art, the present application has the following beneficial effects:

[0038] 1. Compared with the prior art of converting contract bytecode into a grayscale image, the present application is aimed at the hexadecimal compiled bytecode file obtained during the real-time running of the contract, rather than the problem of converting a binary source code file into a grayscale image, and the bytecode object processed is different, and the bytecode of the present application is easier to obtain. At the same time, the present application also considers the problem of inconsistent sizes of grayscale images caused by inconsistent lengths of bytecode, and uses a bicubic interpolation algorithm to scale the grayscale image to generate a grayscale image with consistent size, which is more suitable for classification detection of a deep learning model.

[0039] 2. Compared with the prior art of feature extraction of a contract grayscale image, the feature extraction technology of the present application not only considers the finer granularity advantage of the HOG algorithm in local feature extraction, but also considers the problem of non-physical data noise in the feature image extracted by the HOG, and uses a DRSN-LSTM feature extraction module for secondary feature extraction to achieve denoising processing and further obtain features more suitable for classification model detection and recognition.

[0040] 3. Compared with the prior art of contract detection using deep learning technology, the classification detection module of the DRSN-LSTM model is stacked with an LSTM layer after the DRSN fully connected layer for classification detection, because the features extracted by the grayscale DRSN can also be regarded as a one-dimensional sequence, so after the fusion of the LSTM layer, the dependency between the sequence words can be performed, and the classification detection can be performed in a finer granularity, so that the detection method of the present application is more suitable for real-time running of the contract vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0041] The drawings accompanying the specification of the present application form a part thereof, serve to provide further understanding of the present application, and together with the exemplary embodiments of the present application and their description, serve to explain the present application, and do not constitute an improper limitation of the present application.

[0042] Figure 1 is a schematic diagram of a multi-label vector after labeling of each contract shown in the present application;

[0043] Figure 2 is a process diagram of converting bytecode into a grayscale image shown in the present application;

[0044] Figure 3is a DRSN stack structure diagram shown in the present application;

[0045] Figure 4 is a detection method based on HOG and DRSN-LSTM overall framework diagram shown in the present application. DETAILED DESCRIPTION

[0046] The present application is further described below in conjunction with the accompanying drawings and examples.

[0047] It should be noted that the following detailed description is illustrative only, and is intended to provide further description of the application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0048] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments in accordance with the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, steps, operations, elements, components, and / or groups thereof, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof.

[0049] It should be noted that the flowchart and block diagrams in the drawings show the architecture, functionality, and operation of possible implementations of methods and systems according to various embodiments of the present disclosure. It should also be noted that each block in the flowchart and block diagrams and / or combinations of blocks in the flowchart and block diagrams can be implemented by a module, a program segment, or a combination of executable instructions, which can include one or more executable instructions implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each of the blocks of the flowchart and / or block diagrams and combinations of blocks in the flowchart and / or block diagrams can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and

[0050] Terminology

[0051] HOG: i.e. Histogram of Oriented Gradients, is a feature descriptor in computer vision and image processing for object detection. HOG features are constructed by counting occurrences of gradient orientation in localized portions of an image.

[0052] DRSN: Deep Residual Shrinkage Network, is a new improvement of deep residual network, which introduces soft thresholding as a nonlinear layer into the deep residual network structure, thereby improving the feature learning effect on noisy data or complex data.

[0053] LSTM: Long Short-Term Memory Network, is a time recurrent neural network, which is specially designed to solve the long-term dependence problem of general recurrent neural networks.

[0054] Embodiment One

[0055] As shown in Figure 4 , the embodiment provides a smart contract vulnerability detection method based on HOG and DRSN-LSTM. The embodiment takes the method applied to a server as an example. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is realized through the interaction of the terminal and the server. The server can be a standalone physical server, a server cluster composed of multiple physical servers, or a distributed system, and can also be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communications, middleware services, domain name services, security services CDNs, and big data and artificial intelligence platforms. Basic cloud computing services such as platform. The terminal can be a smartphone, tablet computer, notebook computer, desktop computer, smart speaker, smart watch, etc., but is not limited thereto. The terminal and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in the present application. In the embodiment, the method includes the following steps:

[0056] Obtain the real-time running contract bytecode and convert it into a grayscale image, and use a bicubic difference algorithm to scale the grayscale image;

[0057] Use the HOG algorithm to extract features from the scaled grayscale image to obtain a feature map;

[0058] Draw a gradient histogram of the feature map to obtain a gradient histogram;

[0059] Based on the gradient histogram, use the DRSN-LSTM model to obtain the type of smart contract vulnerability;

[0060] The DRSN-LSTM model includes: the first layer and the second layer both contain a standardization layer, a Relu and a convolution layer, the third layer is a DRSN structure layer, the fourth layer is a global average pooling layer, the fifth layer is a fully connected layer, the sixth layer is an LSTM structure layer, and the seventh layer is a softmax layer.

[0061] The specific scheme of the embodiment can be realized according to the following steps:

[0062] 1. Acquisition and construction of data sets

[0063] The verified contract source code is detected for vulnerabilities using seven vulnerability detection tools, including Oyente, Security, Mythril, Maian, and Smartcheck, and detection logs are generated. The vulnerability types of the contract are labeled with multiple labels according to the detection logs. Then, according to the labeled contract address, the corresponding contract bytecode is crawled from the Ethereum.io website. Each contract bytecode obtained is saved in the same csv file. Finally, the contract bytecode is converted into a fixed-width grayscale image.

[0064] Specific steps:

[0065] (1-1) First, the verified contract source code is obtained from the Ethereum.io website. Then, seven vulnerability detection tools, including Oyente, Security, Mythril, Maian, and Smartcheck, are used to detect vulnerabilities in the contract source code, and detection logs are generated. According to the detection logs, the vulnerabilities existing in each contract are labeled with multiple labels. The vulnerability types include six types: timestamp dependency (C1), reentrant vulnerability (C2), integer overflow (C3), integer underflow (C4), call stack vulnerability (C5), and transaction order dependency vulnerability (C6). We encode it as a multi-label vector, as shown in Figure 1 0 indicates no vulnerability, and 1 indicates the presence of a vulnerability of that type. Therefore, contract 1 contains vulnerabilities C3 (integer overflow), C5 (call stack vulnerability), and C6 (transaction order dependency vulnerability), contract 2 contains only C6 (transaction order dependency vulnerability), and contract 3 indicates that the normal contract does not have any type of vulnerability.

[0066] (1-2) After completing the vulnerability type labeling of the contract, the bytecode (i.e., a string of hexadecimal characters) of each contract is crawled from the Ethereum.io website according to the labeled contract address. The bytecode is divided by bits, and each two bits are divided once. Then, the divided two-bit characters are stored in list A in order. The character elements in list A are converted to decimal numbers and stored in a new list B in order. Then, the decimal numbers in list B are stored as pixel points in a fixed-width two-dimensional matrix. Since the length of the contract compilation bytecode is inconsistent, even with a large difference, we select the average value of the length of all contract bytecodes as the fixed width of the final two-dimensional matrix, and convert it to a 0-255 grayscale value, and convert it to a fixed-width grayscale image, as shown in Figure 2 .

[0067] 2. Data scaling preprocessing and HOG feature extraction

[0068] Because the length of the bytecode is inconsistent, the size of the converted grayscale image is also inconsistent, which is not conducive to the later feature extraction and model training, so we use the bicubic interpolation algorithm to preprocess the image and scale it to a consistent size. Then use the HOG algorithm to extract features from the preprocessed image.

[0069] (2-1) Scale the inconsistent image for preprocessing

[0070] In the data set constructed in the previous step, we use the bicubic interpolation algorithm to scale the image to address the problem of fixed width but inconsistent image size. We compare the size of all images, and since some images have a large size difference, we compare the size of the images and select the mode as the final uniform image size benchmark. This allows us to compress or fill as few image data as possible to improve the quality of the scaled data. The images scaled by the bicubic interpolation algorithm are stored in the folder dataset for easy feature extraction in the next step.

[0071] Specific steps: In the data set, compare the size of the images and select the mode as the final image scaling benchmark. Use the bicubic interpolation algorithm to scale the image. The value of function f at point (x, y) can be obtained by weighted average of the nearest sixteen sampling points in the rectangular network. Here we need to use two polynomial interpolation cubic functions, one in each direction, to achieve the purpose of image scaling. The formula is as follows:

[0072]

[0073] Where x and y are the row and column positions. For the pixel point (x, y) to be interpolated (x and y can be floating-point numbers), take its 4x4 neighborhood points (x i ,y j ), i, j = 0, 1, 2, 3. The W function is the BiCubic base function, which is constructed as follows. Where a = -0.5:

[0074]

[0075] (2-2) HOG feature extraction

[0076] First, after image scaling preprocessing, we use the HOG algorithm to extract the first feature of the image data in the dataset. HOG is used to extract the gradient histogram, which can focus on the image edge and more local features, and also realize fine-grained feature extraction. Then, we draw the gradient histogram of each image after HOG feature extraction, save the extracted gradient histogram as the first feature data image, and store it in the feature folder for subsequent model training and prediction.

[0077] Specific steps: loop to read the images under the dataset folder, first grayscale the image, since the image in the field does not exist the influence of light shadow and other factors, so we will omit the Gamma correction method for image standardization (we have verified through experiments that the Gamma correction does not affect the experimental results); Then, calculate the gradient of each pixel of the image, capture the edge information, divide the image into 4x4 connected regions, that is, 4x4 cell units, and divide the angle into 8 directions to calculate the gradient; Statistics of the gradient histogram of each cell unit to obtain the feature descriptor of each cell unit; Group several cell units into a block, concatenate all the cell feature descriptors in a block to get the HOG feature descriptor of the block, and concatenate all the HOG feature descriptors of the blocks in the image to get the HOG feature descriptor of the image. Finally, we draw and save the final HOG feature descriptor gradient histogram in the feature folder as the first feature extraction feature dataset for subsequent model training and detection.

[0078] Among them, the HOG gradient histogram is to use any gradient operator to convolve a block, calculate the gradient direction and amplitude of each pixel point, and the calculation formula is as follows:

[0079]

[0080]

[0081] Among them, I x and I y represent the gradient values in the horizontal and vertical directions, M(x,y) represents the amplitude value of the gradient, and θ(x,y) represents the direction of the gradient.

[0082] 3, DRSN-LSTM model building

[0083] (3-1) Feature extraction module setting of DRSN-LSTM model.

[0084] First, load and divide the HOG feature image dataset, and divide it into a training set and a test set in a ratio of 4:1. Then, since the HOG extracted features still have a large amount of data noise, we use the DRSN stacking layer constructed in the DRSN-LSTM model to perform secondary feature extraction of the HOG feature image. The DRSN-LSTM feature extraction module includes four layers of architecture, of which the first two layers are composed of a standardization layer, a Relu, a convolutional layer, the third layer is a residual shrinkage module, and the fourth layer is a global average pooling layer. The last layer is a fully connected layer. The residual shrinkage module in the third layer is the core of the entire feature extraction module, and its structure is as shown in FIG. 8. Figure 3 The attention mechanism layer is set in the residual shrinkage module to pay attention to those unimportant features, and through the soft threshold function, they are set to zero; thus, the secondary denoising feature extraction is performed in the HOG extracted feature image data, so that the final feature used for training is more pure and key. Among them, the soft threshold is the core step of the residual shrinkage module, which deletes the features with absolute value less than a certain threshold, and shrinks the features with absolute value greater than the threshold to the direction of zero. The specific formula is as follows:

[0085]

[0086] Where σ is the threshold value that needs to be set. The threshold value cannot be too large or negative, so the soft threshold value of the present embodiment is automatically learned and generated by the attention mechanism layer, without manual setting. The specific steps of this module are as follows:

[0087] Setup1: Calculate the absolute value of all features of the input feature map.

[0088] Setup2: Obtain a feature A through global average pooling and averaging.

[0089] Setup3: In another path, the feature map after global average pooling is input into a small fully connected network, and a sigmoid function is used as the last layer to normalize the output to 0, 1, to obtain a coefficient a. The final threshold value can be represented as a x A.

[0090] The threshold value learned by the attention mechanism is more convenient than manually setting and more suitable for various training parameters of the model.

[0091] (3-2) Setting of the classification detection module of the DRSN-LSTM model.

[0092] After the DRSN-LSTM feature extraction module, an LSTM layer is added. The LSTM layer is mainly used to calculate the dependency between elements in the sequence and to predict and output the multi-label result.

[0093] Specific steps: After passing through the full connection layer of the feature extraction module of the DRSN-LSTM, the feature matrix is unfolded into a one-dimensional feature vector. Here, the one-dimensional feature vector is input into the LSTM structure layer as a feature sequence. The one-dimensional vector is regarded as a piece of text data, and each pixel value in the one-dimensional vector is regarded as a word. After embedding, each word enters the LSTM layer. The LSTM here is a standard LSTM (including a forgetting gate, an input gate, a cell state update, and an output gate). After a time sequence, t hidden LSTM neural unit vectors are obtained. These vectors pass through a mean pooling layer to obtain a vector h. Then, a simple softmax layer is used to obtain a class distribution vector. The type of vulnerability existing in the contract can be determined according to the class distribution vector value.

[0094] 4. By adjusting the size of the gray-scale image and the size of the image after bicubic interpolation scaling and continuously adjusting and training the structure of the model parameters (such as epoch, batch, and number of layers), the highest precision model parameters are selected and saved for use in smart contract vulnerability detection and classification.

[0095] First, in view of the real-time nature of smart contract data acquisition and the simplicity of preprocessing, the embodiment first acquires the real-time running bytecode according to the labeled contract address on Ethereum.io, then converts it into a gray-scale image, and uses a bicubic interpolation algorithm for gray-scale image scaling preprocessing. This not only realizes the real-time nature of smart contract data acquisition, but also eliminates the need to rely on binary files obtained from source code (such as patent CN108985066A), making it easier to obtain contract data. Since the length of the contract bytecode is inconsistent, the size of the generated gray-scale image is also inconsistent. By using the bicubic interpolation algorithm for preprocessing of the gray-scale image, the size of the gray-scale image is unified. Compared with the method of converting bytecode into opcode for text processing, the method of the embodiment is more concise.

[0096] Second, in view of the comprehensiveness and criticality of feature extraction, the embodiment first uses the HOG algorithm to perform local segmentation on the gray-scale image and calculate and fuse the local features of the gray-scale image according to different directions and gradients of the pixels. Then, the features are fused to achieve more fine-grained feature extraction, making the extracted features more comprehensive. At the same time, the HOG feature extraction also has a serious noise influence (such as patent CN113344045A). Therefore, the embodiment proposes the use of an improved fusion of DRSN and HOG algorithm. The HOG-extracted features are subjected to secondary feature extraction in the residual shrinkage-per-channel different threshold module of DRSN to achieve noise reduction processing, making the extracted features more critical and decisive.

[0097] Finally, in order to improve the performance of the detection method, the embodiment fuses the LSTM layer in the HOG-DRSN model, uses the advantage of sequence detection of LSTM to calculate the dependency between pixel points in the gray image, realizes more fine-grained detection of different vulnerability types, further improves the performance of the detection model, and realizes multi-label classification when classifying and detecting, which can not only detect whether the contract has vulnerabilities, but also judge which type of vulnerability the contract has. Therefore, the detection method described in the embodiment is more suitable for real-time detection of smart contract vulnerabilities.

[0098] Embodiment two

[0099] The embodiment provides a smart contract vulnerability detection system based on HOG and DRSN-LSTM.

[0100] A smart contract vulnerability detection system based on HOG and DRSN-LSTM comprises:

[0101] A data acquisition and scaling module configured to acquire contract bytecode running in real time and convert it into a gray image, and perform scaling processing on the gray image using a double cubic difference algorithm;

[0102] A feature extraction module configured to perform feature extraction on the scaled gray image using an HOG algorithm to obtain a feature map;

[0103] A gradient processing module configured to draw the feature map using a gradient histogram to obtain a gradient histogram;

[0104] A vulnerability detection module configured to obtain a smart contract vulnerability type based on the gradient histogram using a DRSN-LSTM model;

[0105] A DRSN-LSTM model construction module configured to include a standardization layer, a Relu, and a convolution layer in the first layer and the second layer, a DRSN structure layer in the third layer, a global mean pooling layer in the fourth layer, a full connection layer in the fifth layer, an LSTM structure layer in the sixth layer, and a softmax layer in the seventh layer.

[0106] It should be noted that the data acquisition and scaling module, the feature extraction module, the gradient processing module, the vulnerability detection module, and the DRSN-LSTM model construction module described above have the same examples and application scenarios as the steps in Embodiment One, but are not limited to the content disclosed in Embodiment One. It should be noted that the above modules, as part of the system, can be executed in a computer system such as a set of computer executable instructions.

[0107] Embodiment three

[0108] The embodiment provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement steps in the smart contract vulnerability detection method based on HOG and DRSN-LSTM.

[0109] Embodiment four

[0110] The embodiment provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements steps in the smart contract vulnerability detection method based on HOG and DRSN-LSTM when executing the program.

[0111] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage, etc.) containing computer-usable program code.

[0112] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device that implements the flow Figure 1 one or more flows and / or blocks Figure 1 means for performing the function specified by one or more blocks.

[0113] These computer program instructions can also be stored in a computer readable memory capable of directing the computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product comprising instruction means, which implements the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.

[0114] These computer program instructions can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the flowFigure 1 one or more processes and / or functions specified in one or more blocks. Figure 1 one or more blocks or any combination thereof.

[0115] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The program can be stored in a computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiment methods can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), or the like.

[0116] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Those skilled in the art can make various modifications and changes to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting vulnerabilities of smart contracts based on HOG and DRSN-LSTM, characterized in that, The method comprises the following steps: The real-time running contract bytecode is acquired and converted into a gray image, and a double cubic difference algorithm is used to scale the gray image; A HOG algorithm is used to extract features from the scaled gray image to obtain a feature map; A gradient histogram is drawn for the feature map to obtain a gradient histogram; Based on the gradient histogram, a DRSN-LSTM model is used to obtain a smart contract vulnerability type; The DRSN-LSTM model comprises: the first layer and the second layer each comprising a standardization layer, a Relu and a convolution layer, the third layer being a DRSN structure layer, the fourth layer being a global mean pooling layer, the fifth layer being a full connection layer, the sixth layer being an LSTM structure layer, and the seventh layer being a softmax layer. 2.The HOG and DRSN-LSTM based smart contract vulnerability detection method of claim 1, wherein, The scaling process of the gray image by using the double cubic difference algorithm comprises the following steps: comparing the sizes of all the gray images, selecting the mode as the final gray image scaling benchmark, and scaling the gray image by using a double cubic interpolation algorithm. 3.The HOG and DRSN-LSTM based smart contract vulnerability detection method of claim 1, wherein, The process of obtaining the gradient histogram comprises the following steps: A HOG algorithm is used to extract features from the scaled gray image to obtain a feature map, the gradient of each pixel of the feature map is calculated, edge information is captured, the feature map is divided into 4x4 connected regions, i.e., 4x4 cell units, the angle is divided into eight directions for gradient calculation, and the gradient histogram of each cell unit is counted to obtain a feature descriptor of each cell unit; several cell units are combined into a block, the feature descriptors of all cells in the block are concatenated to obtain a HOG feature descriptor of the block, and the HOG feature descriptors of all blocks in the image are concatenated to obtain a gradient histogram. The DRSN structure layer adopts an attention mechanism layer and a soft thresholding.

4. The HOG and DRSN-LSTM-based intelligent contract vulnerability detection method according to claim 1, characterized in that, The threshold value in the soft thresholding is automatically learned and generated by an attention mechanism, comprising the following steps: 5.The HOG and DRSN-LSTM based smart contract vulnerability detection method of claim 4, wherein, The absolute values of all features of the input gradient histogram are calculated; A feature is obtained by global mean pooling and averaging, and is denoted as A; In another path, the gradient histogram after global mean pooling is input into a fully connected network, a sigmoid function is used as the last layer, the output is normalized to [0, 1], a coefficient a is obtained, and the final threshold value is represented as a x A. The smart contract vulnerability detection method further comprises a process of training the DRSN-LSTM model, which comprises the following steps: adjusting the size of the gray image, adjusting the size of the gray image processed by the double cubic difference algorithm, optimizing the parameters of the DRSN-LSTM model, selecting the model parameters with the highest smart contract vulnerability detection accuracy for saving, and obtaining a trained DRSN-LSTM model. 6.The HOG and DRSN-LSTM based smart contract vulnerability detection method of claim 1, wherein, The smart contract vulnerability types include: timestamp dependency, reentrant vulnerability, integer overflow, integer underflow, call stack vulnerability and transaction order dependency vulnerability.

7. The HOG and DRSN-LSTM-based intelligent contract vulnerability detection method according to claim 1, characterized in that, The method comprises the following steps: 8.A system for detecting vulnerabilities of smart contracts based on HOG and DRSN-LSTM, characterized in that, A data acquisition and scaling module is configured to acquire real-time running contract bytecode, convert the contract bytecode into a gray image, and scale the gray image by using a double cubic difference algorithm; A feature extraction module is configured to extract features from the scaled gray image by using a HOG algorithm to obtain a feature map; ​ a gradient processing module configured to obtain a gradient histogram by using a gradient histogram drawing feature map; a vulnerability detection module configured to obtain a smart contract vulnerability type by using a DRSN-LSTM model based on the gradient histogram; the DRSN-LSTM model construction module is configured to: the first layer and the second layer each include a standardization layer, a Relu, and a convolution layer, the third layer is a DRSN structure layer, the fourth layer is a global mean pooling layer, the fifth layer is a full connection layer, the sixth layer is an LSTM structure layer, and the seventh layer is a softmax layer.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps in the HOG and DRSN-LSTM-based smart contract vulnerability detection method according to any one of claims 1-7.

10. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the steps in the HOG and DRSN-LSTM-based smart contract vulnerability detection method according to any one of claims 1-7.

Images