Method and system for detecting vulnerabilities of smart contract based on operation code instruction clustering

Abstract

This invention discloses a smart contract vulnerability detection method and system based on opcode instruction clustering, relating to the field of smart contract technology. The method involves converting the EVM bytecode of a smart contract into opcode instructions, vectorizing the features of these instructions using a word embedding model, clustering the vectorized opcode instructions, selecting vulnerable contracts for slicing to build a vulnerability database, and uniformly replacing opcode instructions belonging to the same cluster in the vulnerability database based on the clustering results. The method then slices the contract to be detected, uniformly replacing opcode instructions belonging to the same cluster in the contract to be detected using the clustering results, and detecting vulnerabilities by comparing similarity with contracts in the vulnerability database. The smart contract vulnerability detection method and system based on opcode instruction clustering provided by this invention solves the problems of difficulty in detecting similar vulnerabilities in opcode instructions generated by different compiler versions and high vulnerability detection time overhead caused by differences in opcode instructions generated by different compiler versions.

Description

Technical Field

[0001] This invention relates to the field of smart contract technology, and more specifically to a smart contract vulnerability detection method and system based on opcode instruction clustering. Background Technology

[0002] Blockchain is a distributed ledger characterized by decentralization, immutability, and multi-party maintenance. In recent years, due to its ability to solve practical problems such as data sharing and secure data transmission, blockchain technology has been widely applied in finance, healthcare, education, and other fields. Smart contracts can implement more complex and diverse business logic, further expanding the functionality of blockchain. Because of their transparent deployment, traceability, and trustlessness, smart contracts are widely used in financial fields such as securities management. For example, in securities management, contracts simplify capital statement management, bypass intermediaries in the securities custody chain, and facilitate automatic dividend payments, stock splits, and debt management.

[0003] However, while expanding the functionality of blockchain, hidden flaws in smart contracts can pose potential security risks, leading to significant financial losses in the management of financial assets. Effective vulnerability detection technologies are needed to avoid substantial losses due to potential vulnerabilities in smart contracts.

[0004] Therefore, how to provide a powerful and fast method for detecting smart contract vulnerabilities is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a smart contract vulnerability detection method based on opcode instruction clustering, which can solve the problem that the difference in opcode instructions generated by different compiler versions makes it difficult to detect the same type of vulnerability in opcode instructions generated by different versions of compilers, as well as the problem of high vulnerability detection time overhead.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A smart contract vulnerability detection method based on opcode instruction clustering includes the following steps:

[0008] S1: Convert the EVM (Ethereum Virtual Machine) bytecode of the smart contract into opcode instructions, and vectorize the opcode instruction features through a word embedding model;

[0009] S2: Cluster the vectorized opcode instructions;

[0010] S3: Select vulnerable contracts, slice them, and build a vulnerability database. Then, based on the clustering results, replace the opcode instructions belonging to the same cluster in the contracts in the vulnerability database.

[0011] S4: Slice the contract to be tested and use the clustering results to uniformly represent the opcode instructions belonging to the same cluster in the contract to be tested. Detect vulnerabilities by comparing the similarity with contracts in the vulnerability database.

[0012] The beneficial effects of the above method are as follows: it combines natural language processing technology to learn opcode instructions and opcode instruction context features, uses slicing technology to reduce interference in the vulnerability detection process, and reduces the time overhead of vulnerability detection by calculating contract similarity, thereby reducing false negatives and false positives in vulnerability detection. It also solves to some extent the problem that the differences in opcode instructions generated by different compiler versions make it difficult to detect similar vulnerabilities in opcode instructions generated by different versions of compilers.

[0013] Preferably, S1 specifically includes:

[0014] S1.1: Input training set The training set includes multiple smart contracts known to contain vulnerabilities and those not containing vulnerabilities;

[0015] S1.2: From the training set Obtain smart contracts sequentially , ;

[0016] S1.3: Determine the smart contract If the code can be compiled, proceed to step S1.4; otherwise, proceed to step S1.5.

[0017] S1.4: Compiling Smart Contracts Then proceed to step S1.6;

[0018] S1.5: Delete smart contract Then proceed to step S1.2;

[0019] S1.6: Output smart contract opcode instruction sequence ;

[0020] S1.7: Preprocessing opcode instruction sequence ,delete Operands in the code are separated by delimiters. The opcode instructions in the code are used to normalize the opcode instruction sequence, and the normalized opcode instruction sequence is then processed. Add opcode instruction sequence set ;

[0021] S1.8: Determine the training set Has all processing been completed? If all processing is completed, proceed to S1.9; otherwise, proceed to S1.2.

[0022] S1.9: Using the set of smart contract opcode instruction sequences Train the word embedding model;

[0023] S1.10: Retrieve the opcode instructions from the smart contract opcode instruction set one by one. The word embedding model trained using S1.9 is used to obtain... Corresponding opcode instruction vector And store it in the opcode instruction vector set. .

[0024] Preferably, S2 specifically includes:

[0025] S2.1: Input the set of opcode instruction vectors generated in S1 ;

[0026] S2.2: Utilizing the opcode instruction vector set The opcode instruction vectors in the data are clustered according to their distance from the cluster center. A cluster;

[0027] S2.3: Output the clustering results.

[0028] Preferably, S3 specifically includes:

[0029] S3.1: Input a set of smart contracts containing vulnerabilities. ;

[0030] S3.2: Sequentially obtain the contracts containing the vulnerabilities. ,in ;

[0031] S3.3: Compiling a contract containing vulnerabilities Generate the corresponding opcode instruction sequence ;

[0032] S3.4: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ;

[0033] S3.5: Use clustering results to slice the results Instructions belonging to the same cluster are uniformly replaced with cluster numbers, and the resulting sequence of opcode instructions for the vulnerable contract is then used. Add to vulnerability database collection middle;

[0034] S3.6: Vulnerability Database Collection Check if all smart contracts in the code have been compiled. If so, execute S3.7; otherwise, execute S3.2.

[0035] S3.7: Output vulnerability database collection .

[0036] Preferably, S4 specifically includes:

[0037] S4.1: Input the contract to be tested ;

[0038] S4.2: Compile the contract to be tested Generate the corresponding opcode instruction sequence ;

[0039] S4.3: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ;

[0040] S4.4: Use clustering results to slice the results Opcode instructions belonging to the same cluster are uniformly replaced with the cluster number, and the replaced opcode instruction sequence is output. ;

[0041] S4.5: Input vulnerability database set ;

[0042] S4.6: Calculate the sequence of replaced opcode instructions sequentially. and vulnerability database collection Each uniformly replaced opcode instruction sequence of the vulnerability contract similarity ;

[0043] S4.7: Determine similarity Is it greater than the specified threshold? If the similarity is greater than the specified threshold, proceed to step S4.8. Less than the specified threshold Then proceed to step S4.6;

[0044] S4.8: Output the contract to be tested There exists a unified replacement sequence of vulnerability contract opcode instructions. The vulnerability type in the code is identified, and S4.9 is executed.

[0045] S4.9: Determine the sequence of opcode instructions after replacement. Check if the similarity calculation with all contracts in the vulnerability database has been completed. If not, proceed to step S4.6. If all calculations have been completed, end the process.

[0046] The benefits of using the above method are: learning the opcode instruction and opcode instruction context features, shortening the length of the matching object, reducing the matching time consumption, and improving the vulnerability detection efficiency.

[0047] Preferably, S2.2 specifically includes:

[0048] With opcode instruction vector set For input, randomly select Opcode instruction vector As cluster centers, they are selected sequentially from randomly chosen clusters. Opcode instruction vector Select cluster center vector ;

[0049] from The opcode instruction vector is retrieved sequentially. Calculate using the following formulas respectively arrive Cluster center vectors distance And add the opcode instruction to the cluster containing the nearest cluster center;

[0050]

[0051] Once an opcode instruction is added to the corresponding cluster, the center of that cluster is recalculated, and the above operation is repeated until all opcode instructions are added to the corresponding cluster.

[0052] To achieve the above objectives, the present invention also provides a smart contract vulnerability detection system based on opcode instruction clustering. The system includes:

[0053] The instruction vectorization module converts the EVM bytecode of the smart contract into opcode instructions and vectorizes the features of the opcode instructions through a word embedding model.

[0054] The instruction clustering module clusters vectorized opcode instructions.

[0055] The instruction unification module selects vulnerable contracts, slices them, and builds a vulnerability database. Based on the clustering results, it uniformly replaces the opcode instructions belonging to the same cluster in the contracts in the vulnerability database.

[0056] The instruction comparison module slices the contract to be tested and represents the opcode instructions belonging to the same cluster in the contract to be tested in a unified manner based on the clustering results. Vulnerabilities are detected by comparing the similarity with contracts in the vulnerability database.

[0057] As can be seen from the above technical solution, compared with the prior art, this invention discloses a smart contract vulnerability detection method and system based on opcode instruction clustering. It combines natural language processing technology to learn opcode instructions and their contextual features, utilizes slicing technology to reduce interference in the vulnerability detection process, and calculates contract similarity to reduce vulnerability detection time overhead, thereby reducing false positives and false negatives. By learning opcode instructions and their contextual features, the length of the matching object is shortened, matching time consumption is reduced, and vulnerability detection efficiency is improved. Simultaneously, it addresses to some extent the problem of difficulty in detecting similar vulnerabilities in opcode instructions generated by different compiler versions due to differences in compiled opcode instructions. This method can be applied to smart contract vulnerability detection across different compiler versions. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0059] Figure 1 The attached diagram is a framework diagram of a smart contract vulnerability detection method based on opcode instruction clustering.

[0060] Figure 2 The attached diagram is a flowchart of the smart contract feature information extraction process.

[0061] Figure 3 The attached diagram is a flowchart of opcode instruction clustering.

[0062] Figure 4 The attached diagram is a flowchart of the vulnerability database construction process.

[0063] Figure 5 The attached diagram shows the flowchart for calculating the similarity between the contract to be tested and the contract in the vulnerability database. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] This invention discloses a smart contract vulnerability detection method based on opcode instruction clustering, such as... Figure 1As shown, it includes the following steps:

[0066] S1: Convert the EVM (Ethereum Virtual Machine) bytecode of the smart contract into opcode instructions, and vectorize the opcode instruction features through a word embedding model;

[0067] S2: Cluster the vectorized opcode instructions;

[0068] S3: Select vulnerable contracts, slice them, and build a vulnerability database. Then, based on the clustering results, replace the opcode instructions belonging to the same cluster in the contracts in the vulnerability database.

[0069] S4: Slice the contract to be tested and use the clustering results to uniformly represent the opcode instructions belonging to the same cluster in the contract to be tested. Detect vulnerabilities by comparing the similarity with contracts in the vulnerability database.

[0070] In one specific embodiment, such as Figure 2 As shown, S1 includes:

[0071] S1.1: Input training set The training set includes multiple smart contracts known to contain vulnerabilities and those not containing vulnerabilities;

[0072] S1.2: From the training set Obtain smart contracts sequentially , ;

[0073] S1.3: Determine the smart contract If the code can be compiled, proceed to step S1.4; otherwise, proceed to step S1.5.

[0074] S1.4: Compiling Smart Contracts Then proceed to step S1.6;

[0075] S1.5: Delete smart contract Then proceed to step S1.2;

[0076] S1.6: Output smart contract opcode instruction sequence ;

[0077] S1.7: Preprocessing opcode instruction sequence ,delete Operands in the code are separated by delimiters. The opcode instructions in the code are used to normalize the opcode instruction sequence, and the normalized opcode instruction sequence is then processed. Add opcode instruction sequence set ;

[0078] S1.8: Determine the training set Has all processing been completed? If all processing is completed, proceed to S1.9; otherwise, proceed to S1.2.

[0079] S1.9: Using the set of smart contract opcode instruction sequences Train the word embedding model;

[0080] S1.10: Retrieve the opcode instructions from the smart contract opcode instruction set one by one. The word embedding model trained using S1.9 is used to obtain... Corresponding opcode instruction vector And store it in the opcode instruction vector set. .

[0081] In steps S1.1 to S1.6, the training set is compiled using the CryticCompile library, and the CryticCompile tool generates smart contracts from source code files. As input, smart contracts Compile into bytecode, and then use the pyevmasm library to convert the bytecode into a sequence of opcode instructions. If the CryticCompile method fails to compile the smart contract... Then proceed to step S1.5 to delete the smart contract. Then execute step S1.2. If it can be compiled, execute step S1.6.

[0082] In step S1.9, the set of smart contract opcode instruction sequences of the training set is... As a corpus, a word embedding model was trained using the gensim library and stored in an opcode instruction vector set. .

[0083] In one specific embodiment, the word embedding model in this invention is the Word2Vec word embedding model.

[0084] In one specific embodiment, such as Figure 3 As shown, S2 includes:

[0085] S2.1: Input the set of opcode instruction vectors generated in S1 ;

[0086] S2.2: Utilizing the opcode instruction vector set The opcode instruction vectors in the data are clustered according to their distance from the cluster center. A cluster;

[0087] S2.3: Output the clustering results.

[0088] In step S2.2, the K-means algorithm from the sklearn library is used to cluster opcode instructions. The K-means algorithm uses the opcode instruction vector set... For input, randomly select Opcode instruction vector As cluster centers, they are selected sequentially from randomly chosen clusters. Opcode instruction vector Select cluster center vector ;

[0089] from The opcode instruction vector is retrieved sequentially. Calculate using the following formulas respectively arrive Cluster center vectors distance And add the opcode instruction to the cluster containing the nearest cluster center;

[0090]

[0091] Once an opcode instruction is added to the corresponding cluster, the center of that cluster is recalculated, and the above operation is repeated until all opcode instructions are added to the corresponding cluster.

[0092] In one specific embodiment, such as Figure 4 As shown, S3 includes:

[0093] S3.1: Input a set of smart contracts containing vulnerabilities. ;

[0094] S3.2: Sequentially obtain the contracts containing the vulnerabilities. ,in ;

[0095] S3.3: Compiling a contract containing vulnerabilities Generate the corresponding opcode instruction sequence ;

[0096] S3.4: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ;

[0097] S3.5: Use clustering results to slice the results Instructions belonging to the same cluster are uniformly replaced with cluster numbers, and the resulting sequence of opcode instructions for the vulnerable contract is then used. Add to vulnerability database collection middle;

[0098] S3.6: Vulnerability Database Collection Check if all smart contracts in the code have been compiled. If so, execute S3.7; otherwise, execute S3.2.

[0099] S3.7: Output vulnerability database collection .

[0100] In S3.4, slicing is constructed by analyzing the dependencies between opcode instructions and introduced external data. The slicing algorithm uses the set of instructions in a smart contract that introduce external data. As the starting point of the slice, the instruction The data introduced during execution is Analyze subsequent opcode instructions If the instruction Reference data Then the instruction Add to the slice. Otherwise, skip the instruction. .

[0101] In one specific embodiment, such as Figure 5 As shown, S4 includes:

[0102] S4.1: Input the contract to be tested ;

[0103] S4.2: Compile the contract to be tested Generate the corresponding opcode instruction sequence ;

[0104] S4.3: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ;

[0105] S4.4: Use clustering results to slice the results Opcode instructions belonging to the same cluster are uniformly replaced with the cluster number, and the replaced opcode instruction sequence is output. ;

[0106] S4.5: Input vulnerability database set ;

[0107] S4.6: Calculate the sequence of replaced opcode instructions sequentially. and vulnerability database collection Each uniformly replaced opcode instruction sequence of the vulnerability contract similarity ;

[0108] S4.7: Determine similarity Is it greater than the specified threshold? λ If the similarity is greater than the specified threshold, proceed to step S4.8. Less than the specified threshold λ Then proceed to step S4.6;

[0109] S4.8: Output the contract to be tested There exists a unified replacement sequence of vulnerability contract opcode instructions. The vulnerability type in the code is identified, and S4.9 is executed.

[0110] S4.9: Determine the sequence of opcode instructions after replacement. Check if the similarity calculation with all contracts in the vulnerability database has been completed. If not, proceed to step S4.6. If all calculations have been completed, end the process.

[0111] In step S4.3, slicing is constructed by analyzing the dependencies between opcode instructions and introduced external data. The slicing algorithm uses the set of instructions in the smart contract that introduce external data. As the starting point of the slice, the instruction The data introduced during execution is Analyze subsequent opcode instructions If the instruction Reference data Then the instruction Add to the slice. Otherwise, skip the instruction. .

[0112] In one specific embodiment, Levenshtein distance calculation is used. and similarity In step S4.7, if the similarity Greater than the specified threshold Then proceed to step S4.8 and output the contract to be tested. Vulnerability type; if similarity Less than the specified threshold ， Then execute S4.6 to calculate the similarity with other vulnerability library contracts. Repeat this step until... All opcode instruction sequences in the data and the replaced opcode instruction sequence of the contract to be tested Complete the similarity calculation.

[0113] The mathematical definition of Levenshtein distance is:

[0114]

[0115] when hour, It is 0 otherwise it is 1. that is The former characters and The former Edit distance of one character.

[0116] In one specific embodiment, a smart contract vulnerability detection system based on opcode instruction clustering is provided, comprising:

[0117] The instruction vectorization module converts the EVM bytecode of the smart contract into opcode instructions and vectorizes the features of the opcode instructions through a word embedding model.

[0118] The instruction clustering module clusters vectorized opcode instructions.

[0119] The instruction unification module selects vulnerable contracts, slices them, and builds a vulnerability database. Based on the clustering results, it uniformly replaces the opcode instructions belonging to the same cluster in the contracts of the vulnerability database.

[0120] The instruction comparison module slices the contract to be tested and represents the opcode instructions belonging to the same cluster in the contract to be tested in a unified manner based on the clustering results. Vulnerabilities are detected by comparing the similarity with contracts in the vulnerability database.

[0121] This invention provides a smart contract vulnerability detection method and system based on opcode instruction clustering. It combines natural language processing technology to learn opcode instructions and their contextual features, utilizes slicing technology to reduce interference during vulnerability detection, and uses Levenshtein distance to calculate contract similarity, thereby reducing vulnerability detection time overhead and minimizing false positives and false negatives. Compared with other methods, this invention learns opcode instructions and their contextual features, shortens the length of matching objects, reduces matching time consumption, and improves vulnerability detection efficiency. It also addresses, to some extent, the problem of difficulty in detecting similar vulnerabilities in opcode instructions generated by different compiler versions due to differences in compiled opcode instructions. This method can be applied to smart contract vulnerability detection across different compiler versions.

[0122] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0123] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A smart contract vulnerability detection method based on opcode instruction clustering, characterized in that, include: S1: Convert the EVM bytecode of the smart contract into opcode instructions, and vectorize the features of the opcode instructions through a word embedding model; S2: Cluster the vectorized opcode instructions; S3: Select vulnerable contracts, slice them, and build a vulnerability database. Then, based on the clustering results, replace the opcode instructions belonging to the same cluster in the contracts in the vulnerability database. S3 specifically includes: S3.1: Input a set of smart contracts containing vulnerabilities. ; S3.2: Sequentially obtain the contracts containing the vulnerabilities. ,in ; S3.3: Compiling a contract containing vulnerabilities Generate the corresponding opcode instruction sequence ; S3.4: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ; S3.5: Use clustering results to slice the results Instructions belonging to the same cluster are uniformly replaced with cluster numbers, and the resulting sequence of opcode instructions for the vulnerable contract is then used. Add to vulnerability database collection middle; S3.6: Vulnerability Database Collection Check if all smart contracts in the code have been compiled. If so, execute S3.7; otherwise, execute S3.

2. S3.7: Output vulnerability database collection ; S4: Slice the contract to be tested and use the clustering results to uniformly replace the opcode instructions belonging to the same cluster in the contract to be tested. Detect vulnerabilities by comparing the similarity with contracts in the vulnerability database. S4 specifically includes: S4.1: Input the contract to be tested ; S4.2: Compile the contract to be tested Generate the corresponding opcode instruction sequence ; S4.3: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ; S4.4: Use clustering results to slice the results Opcode instructions belonging to the same cluster are uniformly replaced with the cluster number, and the replaced opcode instruction sequence is output. ; S4.5: Input vulnerability database set ; S4.6: Calculate the sequence of replaced opcode instructions sequentially. and vulnerability database collection Each uniformly replaced opcode instruction sequence of the vulnerability contract similarity ; S4.7: Determine similarity Is it greater than the specified threshold? If the similarity is greater than the specified threshold, proceed to step S4.

8. Less than the specified threshold Then proceed to step S4.6; S4.8: Output the contract to be tested There exists a unified replacement sequence of vulnerability contract opcode instructions. The vulnerability type in the code is identified, and S4.9 is executed. S4.9: Determine the sequence of opcode instructions after replacement. Check if the similarity calculation with all contracts in the vulnerability database has been completed. If not, proceed to step S4.

6. If all calculations have been completed, end the process.

2. The smart contract vulnerability detection method based on opcode instruction clustering according to claim 1, characterized in that, S1 specifically includes: S1.1: Input training set The training set includes multiple smart contracts known to contain vulnerabilities and those not containing vulnerabilities; S1.2: From the training set Obtain smart contracts sequentially , ; S1.3: Determine the smart contract If the code can be compiled, proceed to step S1.4; otherwise, proceed to step S1.

5. S1.4: Compiling Smart Contracts Then proceed to step S1.6; S1.5: Delete smart contract Then proceed to step S1.2; S1.6: Output smart contract opcode instruction sequence ; S1.7: Preprocessing opcode instruction sequence ,delete Operands in the code are separated by delimiters. The opcode instructions in the code are used to normalize the opcode instruction sequence, and the normalized opcode instruction sequence is then processed. Add opcode instruction sequence set ; S1.8: Determine the training set Has all processing been completed? If all processing is completed, proceed to S1.9; otherwise, proceed to S1.

2. S1.9: Using the set of smart contract opcode instruction sequences Train the word embedding model; S1.10: Retrieve the opcode instructions from the smart contract opcode instruction set one by one. The word embedding model trained using S1.9 is used to obtain... Corresponding opcode instruction vector And store it in the opcode instruction vector set. .

3. The smart contract vulnerability detection method based on opcode instruction clustering according to claim 1, characterized in that, S2 specifically includes: S2.1: Input the set of opcode instruction vectors generated in S1 ; S2.2: Utilizing the opcode instruction vector set The opcode instruction vectors in the data are clustered according to their distance from the cluster center. A cluster; S2.3: Output the clustering results.

4. The smart contract vulnerability detection method based on opcode instruction clustering according to claim 3, characterized in that, Specifically, S2.2 includes: With opcode instruction vector set For input, randomly select Opcode instruction vector As a cluster center, among which, , sequentially from randomly selected Opcode instruction vector Select cluster center vector ,in, ; from The opcode instruction vector is retrieved sequentially. ,in, Calculate using the following formulas respectively arrive Cluster center vectors distance And add the opcode instruction to the cluster containing the nearest cluster center; Once an opcode instruction is added to the corresponding cluster, the center of that cluster is recalculated, and the above operation is repeated until all opcode instructions are added to the corresponding cluster.

5. A smart contract vulnerability detection system based on opcode instruction clustering, applied to the smart contract vulnerability detection method based on opcode instruction clustering as described in any one of claims 1-4, characterized in that, The system includes: The instruction vectorization module converts the EVM bytecode of the smart contract into opcode instructions and vectorizes the features of the opcode instructions through a word embedding model. The instruction clustering module clusters vectorized opcode instructions. The instruction unification module selects vulnerable contracts, slices them, and builds a vulnerability database. Based on the clustering results, it uniformly replaces the opcode instructions belonging to the same cluster in the contracts in the vulnerability database. The instruction unification module specifically includes: S3.1: Input a set of smart contracts containing vulnerabilities. ; S3.2: Sequentially obtain the contracts containing the vulnerabilities. ,in ; S3.3: Compiling a contract containing vulnerabilities Generate the corresponding opcode instruction sequence ; S3.4: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ; S3.5: Use clustering results to slice the results Instructions belonging to the same cluster are uniformly replaced with cluster numbers, and the resulting sequence of opcode instructions for the vulnerable contract is then used. Add to vulnerability database collection middle; S3.6: Vulnerability Database Collection Check if all smart contracts in the code have been compiled. If so, execute S3.7; otherwise, execute S3.

2. S3.7: Output vulnerability database collection ; The instruction comparison module slices the contract to be tested and represents the opcode instructions belonging to the same cluster in the contract to be tested in a unified manner according to the clustering results. It detects vulnerabilities by comparing the similarity with contracts in the vulnerability database. The instruction comparison module specifically includes: S4.1: Input the contract to be tested ; S4.2: Compile the contract to be tested Generate the corresponding opcode instruction sequence ; S4.3: Analyze the opcode instruction sequence The dependencies between opcode instructions and imported external data are identified, and slicing is performed based on these dependencies, with the sliced ​​results output. ; S4.4: Use clustering results to slice the results Opcode instructions belonging to the same cluster are uniformly replaced with the cluster number, and the replaced opcode instruction sequence is output. ; S4.5: Input vulnerability database set ; S4.6: Calculate the sequence of replaced opcode instructions sequentially. and vulnerability database collection Each uniformly replaced opcode instruction sequence of the vulnerability contract similarity ; S4.7: Determine similarity Is it greater than the specified threshold? If the similarity is greater than the specified threshold, proceed to step S4.

8. Less than the specified threshold Then proceed to step S4.6; S4.8: Output the contract to be tested There exists a unified replacement sequence of vulnerability contract opcode instructions. The vulnerability type in the code is identified, and S4.9 is executed. S4.9: Determine the sequence of opcode instructions after replacement. Check if the similarity calculation with all contracts in the vulnerability database has been completed. If not, proceed to step S4.

6. If all calculations have been completed, end the process.

Images