A smart contract unknown vulnerability detection method based on CNN-LSTM multi-classification model

Abstract

The present invention discloses a method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model. The method comprises the following steps: S1, inserting a stub in an Ethereum client Geth; S2, obtaining a normal operation code sequence set and a vulnerability operation code sequence set through the inserted Ethereum client Geth; S3, training an embedding word vector with a pre-training model to obtain a word vector index dictionary; S4, converting the replayed operation code sequence into a feature vector matrix according to the word vector index dictionary, and performing dimensionality reduction using a CNN neural network; S5, training an LSTM classification model using the feature vector matrix after dimensionality reduction; S6, collecting, in real time, the operation code sequences to be tested generated by transactions using the inserted Ethereum client Geth; and S7, in a detection phase, summing the probability values ​​of all vulnerability categories given by the classification model for each operation code sequence to be tested, and comparing the sum with a threshold value, thereby completing the determination of unknown vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the field of vulnerability detection technology, and in particular to a method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model. Background Art

[0002] Deep learning has developed rapidly in recent years, prompting researchers to explore its potential to detect smart contract vulnerabilities. Below are several smart contract vulnerability detection solutions that incorporate deep learning.

[0003] 1) Zhang et al. proposed a smart contract vulnerability detection and analysis method based on n-grams and deep learning. The opcode sequence in this paper refers to the instruction sequence mapped from the bytecode generated after smart contract compilation according to the official Ethereum instruction set. These instructions are also assembly opcodes. By compiling the contract source code and parsing the bytecode, a static opcode data stream is generated. A dictionary is constructed based on the correspondence between opcodes and hexadecimal numbers in the Ethereum Yellow Paper. Different schemes then implement different processes. The n-gram-based scheme simplifies the opcodes, slices them using n-grams, and constructs a feature matrix. This is then trained using different machine learning classification algorithms. The deep learning-based scheme converts the opcode data stream into an opcode sequence represented by hexadecimal numbers and trains it using four different deep learning network structures. A comparison of the training results of the two schemes revealed that the CNN+LSTM deep learning network structure performed best in vulnerability detection.

[0004] 2) He J et al. trained a symbolic execution expert based on the Graph Convolutional Network (GCN) in deep learning by mimicking traditional symbolic execution methods. During the model learning phase, the team ran the symbolic execution expert on tens of thousands of smart contracts, generating thousands of high-quality opcode sequences that were fed into the next training layer, ultimately achieving a fuzzy strategy with higher program coverage. During the implementation phase, the fuzzy strategy learned by the model was used to generate test opcode sequences. The fuzz testing results were then analyzed to determine vulnerability detection. The opcode sequences in this solution simulate the transaction execution process through symbolic execution, which is not necessarily feasible. Therefore, fuzz testing was used to verify the feasibility of the opcode sequences.

[0005] 3) Huang HD et al. translated the compiled hexadecimal bytecode of the smart contract into RGB color coding, thereby converting each smart contract into a fixed-size image code, and used it as the input of the CNN (convolutional neural network) deep learning model for training and detection. However, since this method directly converts the source code into image code, the processing of each layer in the model may cause originally unrelated bytecodes to become related, or destroy the logical relationship between the context. Therefore, the solution must select an appropriate CNN (convolutional neural network) model structure to reduce the impact of this possibility.

[0006] In the above schemes, the raw data is generally static smart contract source code or compiled bytecode, making it impossible to dynamically detect vulnerabilities based on the real-time execution of on-chain transactions. Furthermore, the feature vectors obtained from the raw data lack the semantic information of the opcodes themselves and the context of the sequence. Furthermore, the classification model can only detect a small number of known vulnerabilities and cannot detect unknown vulnerabilities that have not yet been discovered. To the best of our knowledge, there is currently little research on unknown vulnerability detection. Therefore, this paper proposes a method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model. Summary of the Invention

[0007] (1) Technical problems solved

[0008] In view of the shortcomings of the existing technology, the present invention provides a smart contract unknown vulnerability detection method based on the CNN-LSTM multi-classification model to solve the above problems.

[0009] (2) Technical solution

[0010] To achieve the above-mentioned purpose, the present invention provides the following technical solutions:

[0011] A method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model includes the following steps:

[0012] S1, inserting stubs in the Ethereum client Geth;

[0013] S2, replay the Ethereum block transactions and obtain the normal opcode sequence set and the vulnerable opcode sequence set through the plugged Ethereum client Geth;

[0014] S3, use the Word2vec pre-training model to train the embedding word vector and obtain the word vector index dictionary;

[0015] S4, converts the replayed opcode sequence into a feature vector matrix based on the word vector index dictionary and uses the CNN neural network to reduce the dimension;

[0016] S5, in the training phase, the LSTM classification model is trained using the eigenvector matrix after dimensionality reduction;

[0017] S6, using the instrumented Ethereum client Geth to collect the test opcode sequences generated by transactions in real time;

[0018] S7, in the detection phase, for each opcode sequence to be tested, the probability values ​​of all vulnerability categories given by the classification model are summed and compared with the threshold to complete the determination of unknown vulnerabilities.

[0019] Furthermore, in step S1, the stub is inserted into the source code of the Ethereum client Geth, which is a code segment that can output transaction data. The code is written in Golang. The transaction data collected here includes:

[0020] Block parameters such as block number, Timestamp, nonce value, RootHash, Gas value; transaction information such as account addresses and transfer amounts involved in the transaction; executed smart contract address; balance account balance; opcode sequence consisting of assembly opcodes such as PUSH1, MSTORE, CALLDATASIZE, ISZERO and operands; underlying information related to the Ethereum virtual machine such as memory, storage, and stack.

[0021] Furthermore, in step S2, the replay refers to re-executing the currently executed transactions of Ethereum on the local private chain. The normal operation code sequence set and the vulnerability operation code sequence set can be obtained through the plugged Ethereum client Geth. The two sequence sets constitute the data set input into the subsequent model. The specific process is as follows:

[0022] S201, replaying the block transactions of Ethereum;

[0023] S202, obtain a normal opcode sequence set and a vulnerable opcode sequence set through the plugged Ethereum client Geth.

[0024] Furthermore, in step S3, the Word2vec pre-training model is a type of neural network in the NLP field used to generate embedding word vectors. In the trained word vector index dictionary, one operation code corresponds to one multi-dimensional word vector. The specific process is as follows:

[0025] S301: Build a Word2vec pre-training model. In the parameter settings, the word vector dimension is 128, the number of iterations is 8 (n__epoch=8), the number of samples passed into the model each time is 100 (batch_size=100), and the skip-gram algorithm is used with negative sampling optimization.

[0026] S302: Input the normal opcode sequence set and the vulnerable opcode sequence set into the Word2vec pre-trained model, and output a 129*128 word vector index dictionary, where 129 represents the type of opcode appearing in all opcode sequences, and 128 represents the word vector dimension.

[0027] Furthermore, the specific process of step S4 is as follows:

[0028] S401: Convert each opcode in the opcode sequence into a corresponding word vector according to the word vector index dictionary. Finally, each opcode sequence is converted into a 128*5000 feature vector matrix, where 128 represents the word vector dimension and 5000 represents the length of the opcode sequence.

[0029] S402, build a single-layer CNN neural network;

[0030] In step S403, all multi-dimensional feature vector matrices are input into the CNN neural network for dimensionality reduction, and are ultimately reduced to multiple 64*1249 feature vector matrices through convolution and pooling operations.

[0031] Furthermore, in step S5, the normal opcode sequence set and the vulnerability opcode sequence set constitute a data set input into the LSTM neural network. The training process of the LSTM classification model is as follows:

[0032] S501: Build a single-layer LSTM neural network. In the parameter setting, the number of iterations is 5 (n__epoch=5), the activation function is sigmoid, the loss function is sparse_categorical_crossentropy, and the number of inputs to the model each time is 100 (batch_size=100).

[0033] S502: Input the feature vector matrix after dimensionality reduction by the CNN neural network into the LSTM neural network to obtain a classification model that can distinguish multiple vulnerability categories.

[0034] Furthermore, the operation code sequence to be tested collected in real time in step S6 is an operation code sequence generated by a newly executed transaction on Ethereum.

[0035] Furthermore, the specific process of step S7 is as follows:

[0036] S701: Input the collected opcode sequence to be tested into the trained CNN-LSTM multi-classification model to obtain the probability value of each vulnerability category and sum them up;

[0037] S702, compare the probability sum with the threshold. If the probability sum is greater than the threshold, a new unknown vulnerability is discovered; otherwise, no new unknown vulnerability is discovered.

[0038] (3) Beneficial effects

[0039] Compared with the existing technology, the smart contract unknown vulnerability detection method based on the CNN-LSTM multi-classification model provided by the present invention has the following beneficial effects:

[0040] 1. This method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model supports dynamic detection of unknown vulnerabilities in smart contracts. Based on the premise that unknown vulnerability opcode sequences have a certain similarity with certain known vulnerability opcode sequences, this method combines the advantages of dynamic detection and deep learning technology to build a CNN-LSTM deep learning multi-classification model. The trained model is used as a tool for unknown vulnerability detection, and the accuracy of unknown vulnerability identification is improved based on a custom threshold.

[0041] 2. This smart contract unknown vulnerability detection method based on the CNN-LSTM multi-classification model uses the Word2vec pre-training model to construct an embedding word vector dictionary for the opcode. This can retain the semantic information of the opcode itself and the contextual connection of the opcode sequence, making the extracted feature vector matrix more reasonable and the unknown vulnerability detection results more reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flowchart of the method for detecting unknown vulnerabilities in smart contracts;

[0043] Figure 2 This is a schematic diagram of the system model structure of the smart contract unknown vulnerability detection method;

[0044] Figure 3 This is a system flow diagram of the method for detecting unknown vulnerabilities in smart contracts. DETAILED DESCRIPTION

[0045] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0046] Example

[0047] The system model involved in the method for detecting unknown vulnerabilities in smart contracts based on the CNN-LSTM multi-classification model in this embodiment of the present invention is:

[0048] The detection system solution is divided into two stages: data preprocessing stage and model training and testing stage.

[0049] The data preprocessing phase focuses on word embedding training and feature vector length unification. Due to the lack of real-world unknown vulnerability opcode sequences, the present invention uses some known vulnerability opcode sequences as unknown vulnerability opcode sequences for detection during the experimental phase. Eight opcode sequences are obtained from the database: S0 (normal sequence), S1 (reentrancy vulnerability sequence), S2 (unexpected function call vulnerability sequence), S3 (incorrect permission check vulnerability sequence), S4 (abnormal error handling vulnerability sequence), S5 (lack of standard event vulnerability sequence), S6 (strict balance check vulnerability sequence), and S7 (timestamp / block number dependency vulnerability sequence). These sequences are then divided into two parts: known vulnerability opcode sequences and some normal sequences, and unknown vulnerability opcode sequences and some normal sequences. The first part is used to train the model, while the second part is used to detect unknown vulnerabilities. Due to the small number of samples in S1, there is concern that this will affect the accuracy of the classification model. Therefore, S1 is defaulted as an unknown vulnerability. Furthermore, one of the other six vulnerabilities is extracted as an unknown vulnerability. Thus, there are five known vulnerabilities and two unknown vulnerabilities. The Word2vec neural network is used to pre-train all opcode sequences to obtain embedding word vectors. The feature vector matrix is ​​then filled and the length is unified, effectively preserving the semantic information of the opcode itself and the logical relationship before and after the opcode sequence.

[0050] The model training and testing phase includes two parts: training and unknown vulnerability determination. The complete model constructed by the present invention is an input layer, a CNN (convolutional neural network), an LSTM (long short-term memory model), a fully connected layer, and an output layer. Training phase: the known vulnerability sequence and the normal sequence are input into the model, the CNN (convolutional neural network) reduces the 128*5000 matrix to a 64*1249 matrix, the LSTM (long short-term memory model) is used for multi-batch training and optimizes the parameters through back propagation, and the fully connected layer and the output layer are used for classification and output of the model loss and accuracy. Unknown vulnerability determination phase: the feature vector matrix of the processed unknown vulnerability sequence is input into the trained model, and the probability and threshold of all vulnerability determinations are compared to obtain the detection result. The complete model itself is scalable. The introduction of CNN (convolutional neural network) ensures that it can process very long opcode sequences, and the flexible adjustment of the threshold makes the determination of unknown vulnerabilities more credible. The high threshold and high accuracy prove that the unknown vulnerability has a stronger similarity with the known vulnerability.

[0051] See also Figure 1-2 The method for detecting unknown vulnerabilities in smart contracts based on the CNN+LSTM multi-classification model provided in this embodiment includes the following steps:

[0052] It mainly includes six workflows: Geth instrumentation, embedding word vector training, data preprocessing, feature vector dimensionality reduction, classification model training and unknown vulnerability determination.

[0053] (1) Geth instrumentation

[0054] This paper inserts code snippets into the Ethereum client's Geth source code, enabling it to output corresponding opcode sequences when executing transactions. This allows the collection of opcode sequences generated by replayed transactions and test opcode sequences generated by newly executed transactions. The replayed opcode sequences are used to train embedding word vectors and then fed into a CNN-LSTM multi-classification model for training. The test opcode sequences are used to detect unknown vulnerabilities.

[0055] (2) Training embedding word vectors

[0056] The present invention trains embedding word vectors through the Word2vec interface of the gensim library. The training data is normal opcode sequences and all vulnerable opcode sequences. The parameter setting is 128 word vector dimensions, 8 iterations (n_epoch = 8), and 100 batches are passed into the model each time (batch_size = 100). The skip-gram algorithm is used and negative sampling optimization is used. Since the Ethereum virtual machine supports only more than 130 types of opcodes, deleting low-frequency opcodes will only affect the accuracy of the model. Therefore, the present invention retains low-frequency opcodes and ultimately generates a 129*128 word vector index dictionary, where 129 represents the opcode type appearing in all opcode sequences and 128 represents the word vector dimension.

[0057] (3) Data preprocessing

[0058] The acquired opcode sequences for five known vulnerabilities and normal opcode sequences were divided into six files by category. The files were read sequentially, and the sequences and labels were stored as lists. The sklearn library's train_test_split interface was then used to split both into training and test sets. The test set was used to test the model's accuracy in detecting known vulnerabilities. The training:test ratio was 4:1, and the ratio of each category in the two datasets was consistent with the ratio in the initial dataset to ensure no impact on model results. The dataset was tokenized by opcode, and each opcode in the dataset was converted to a corresponding word vector using a word vector index dictionary. The sequence library's pad_sequences interface was used to standardize the sequence length to 5000. Sequences shorter than 5000 were padded with zero vectors, and opcodes longer than 5000 were deleted. Finally, two three-dimensional feature vector matrices with a size of 128*5000*num were generated, where num represents the number of opcode sequences.

[0059] (4) Feature vector dimensionality reduction

[0060] Since the feature vector matrix generated after data preprocessing is too large, the present invention builds a CNN neural network to reduce its dimensionality before training. Through convolution and pooling operations, it is finally reduced to a three-dimensional feature vector matrix of 64*1249*num, where num represents the number of operation code sequences. This processing can speed up the training progress without affecting the accuracy of the model.

[0061] (5) Classification model training

[0062] This paper uses an LSTM neural network as the classification model, with 5 iterations (n_epoch = 5), a sigmoid activation function, and a sparse_categorical_crossentropy loss function. The number of inputs to the model is 100 (batch_size = 100), and the final output is the model loss and accuracy. This classification model can distinguish between six categories: normal categories and five known vulnerability categories.

[0063] (6) Determination of unknown vulnerabilities

[0064] The present invention extracts two vulnerability sequences as unknown vulnerability sequences for testing. The unknown vulnerability sequences are read and stored as a list. At the same time, the sequence length is unified to 5000 using the pad_sequences interface of the sequence library. Sequences less than 5000 are padded with 0 vectors, and opcodes exceeding 5000 are deleted. Finally, two three-dimensional vector matrices of 128*5000*num are generated, where num represents the number of opcode sequences. Then, the classification model is input to obtain the judgment probabilities of the six categories respectively. The judgment probabilities of all vulnerability categories except the normal category are summed as the judgment probability of the unknown vulnerability. If the probability is greater than the set threshold (threshold = 0.5), a new unknown vulnerability is found, otherwise it is not found.

[0065] The aforementioned embodiments of the present invention provide a method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model, enabling dynamic detection of unknown vulnerabilities in smart contracts. This method, based on the premise that the opcode sequences of unknown vulnerabilities bear a certain resemblance to those of known vulnerabilities, combines the advantages of dynamic detection with deep learning techniques to build a CNN-LSTM deep learning multi-classification model. This trained model serves as a tool for detecting unknown vulnerabilities, and the accuracy of identifying unknown vulnerabilities is improved based on customizable thresholds.

[0066] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model, characterized in that: The following steps are involved: S1, inserting stubs in the Ethereum client Geth; S2, replay the Ethereum block transactions and obtain the normal opcode sequence set and the vulnerable opcode sequence set through the plugged Ethereum client Geth; S3, use the Word2vec pre-training model to train the embedding word vector and obtain the word vector index dictionary; S4, converts the replayed opcode sequence into a feature vector matrix based on the word vector index dictionary and uses the CNN neural network to reduce the dimension; S5, in the training phase, the LSTM classification model is trained using the eigenvector matrix after dimensionality reduction; S6, using the instrumented Ethereum client Geth to collect the test opcode sequences generated by transactions in real time; S7, in the detection phase, for each opcode sequence to be tested, the probability values ​​of all vulnerability categories given by the classification model are summed and compared with the threshold to complete the determination of unknown vulnerabilities; In step S2, the replay refers to re-executing the currently executed transactions on Ethereum on the local private chain, and obtaining the normal operation code sequence set and the vulnerable operation code sequence set through the plugged Ethereum client Geth. The two sequence sets constitute the data set input into the subsequent model. The specific process is as follows: S201, replaying the block transactions of Ethereum; S202, obtaining a normal opcode sequence set and a vulnerable opcode sequence set through the instrumented Ethereum client Geth; The specific process of step S7 is as follows: S701: Input the collected opcode sequence to be tested into the trained CNN-LSTM multi-classification model to obtain the probability value of each vulnerability category and sum them up; S702, compare the probability sum with the threshold. If the probability sum is greater than the threshold, a new unknown vulnerability is discovered; otherwise, no new unknown vulnerability is discovered.

2. The method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model according to claim 1, characterized in that: In step S1, the stub is inserted into the source code of the Ethereum client Geth, and the code is written in Golang. The collected transaction data includes: Block number, Timestamp, nonce value, RootHash, Gas value block parameters; Transaction information including the account addresses and transfer amounts involved in the transaction; The address of the smart contract being executed; balance account balance; PUSH1, MSTORE, CALLDATASIZE, ISZERO assembly opcode and operand sequence; Memory, storage, and stack information related to the underlying Ethereum virtual machine.

3. The method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model according to claim 1, characterized in that: In step S3, the Word2vec pre-training model is a type of neural network in the NLP field used to generate embedding word vectors. In the trained word vector index dictionary, one operation code corresponds to one multi-dimensional word vector. The specific process is as follows: S301, build a Word2vec pre-training model, using the skip-gram algorithm and negative sampling optimization; S302: Input the normal operation code sequence set and the vulnerability operation code sequence set into the Word2vec pre-training model, and output the word vector index dictionary.

4. The method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model according to claim 1, wherein: The specific process of step S4 is as follows: S401, converting each opcode in the opcode sequence into a corresponding word vector according to the word vector index dictionary, and finally converting each opcode sequence into a multi-dimensional feature vector matrix; S402, build a single-layer CNN neural network; S403, input all multi-dimensional feature vector matrices into the CNN neural network for dimensionality reduction.

5. The method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model according to claim 1, wherein: In step S5, the normal opcode sequence set and the vulnerability opcode sequence set constitute the data set input into the LSTM neural network. The training process of the LSTM classification model is as follows: S501, build a single-layer LSTM neural network; S502, input the feature vector matrix after dimensionality reduction by the CNN neural network into the LSTM neural network to obtain a classification model that distinguishes multiple vulnerability categories.

6. The method for detecting unknown vulnerabilities in smart contracts based on a CNN-LSTM multi-classification model according to claim 1, characterized in that: The operation code sequence to be tested collected in real time in step S6 is an operation code sequence generated by a newly executed transaction on Ethereum.

Images