A smart contract vulnerability detection method based on operation code program dependence graph

Abstract

The application relates to the field of smart contract security and discloses a smart contract vulnerability detection method based on an operation code program dependency graph, which aims to obtain effective smart contract vulnerability related semantic information from the bytecode level and improve the accuracy of automatic detection of smart contract vulnerabilities. The method comprises the following steps: collecting a smart contract bytecode dataset and marking operation codes that may trigger vulnerabilities; simulating the execution of a smart contract operation code sequence, constructing a smart contract operation code control flow graph and a data dependency graph; constructing a smart contract operation code program dependency graph; taking the operation codes that may trigger vulnerabilities as key nodes, extracting vulnerability related program dependency graph slices, combining the marked information to construct a slice dataset; encoding the program dependency graph slices; training a smart contract vulnerability detection model based on a graph neural network to extract slice features and realize smart contract vulnerability detection.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of smart contract security, and particularly relates to a smart contract vulnerability detection method based on an operation code program dependency graph. BACKGROUND

[0002] In order to ensure the security of smart contracts, more and more researchers have begun to study the vulnerability detection technology of smart contracts, and have developed various tools to detect and prevent existing smart contract vulnerabilities. The technologies used mainly include symbolic execution, formal verification and fuzz testing. Symbolic execution is the most widely used method, which refers to the conversion of uncertain input into symbolic values during program execution, usually combined with a constraint solver to solve the program execution path. Symbolic execution can achieve more accurate and comprehensive program analysis, but due to the influence of program branches and loops, it usually faces problems such as path explosion. Formal verification mainly uses a strict demonstrable description language or logic to describe the properties and characteristics of the program, and uses mathematical logic proof and reasoning to build formal specifications to determine whether the security property settings meet the expectations. However, the formal verification method requires strong logical reasoning ability and has low automation degree. Fuzz testing uses randomly generated test samples as the input of the smart contract, and monitors the execution process of the smart contract to determine whether a program vulnerability or other abnormal behavior is triggered. The fuzz testing method can effectively detect contract vulnerabilities, but it requires prior access to the source code and ABI interface information of the smart contract.

[0003] In recent years, deep learning-based program analysis methods have gradually become popular in the field of security detection. Deep learning methods have high automation degree and can extract hidden features of programs from a large amount of data, breaking through the limitations of traditional rule-based vulnerability detection methods.

[0004] According to the feature extraction method, the deep learning-based smart contract vulnerability detection model is divided into three categories, namely text processing-based, static analysis-based and image processing-based vulnerability detection.

[0005] The text processing-based method treats smart contract source code, bytecode and operation code as continuous text sequences, uses natural language processing methods to extract semantic information and features of smart contract vulnerabilities. The static analysis-based method uses analysis results such as AST, CFG, etc. to further extract the structural features of smart contracts based on static analysis, enriching vulnerability-related information. The image processing-based method slices and combines smart contract bytecode or operation code sequences to construct a grayscale matrix, and then applies image processing methods to extract features and build a model.

[0006] There are several problems with existing deep learning-based smart contract vulnerability detection methods:

[0007] (1) Most smart contracts are not open source, and source code-based vulnerability detection methods cannot be applied to the entire smart contract field;

[0008] (2) The existing detection methods do not comprehensively represent the semantics and structure of the smart contract;

[0009] (3) The code that produces vulnerabilities in the smart contract only accounts for a small part of the entire smart contract, and the existing detection methods do not focus on mining these key semantic features. SUMMARY

[0010] In view of the above existing problems, the purpose of the present application is to provide a smart contract vulnerability detection method and system based on operation code program dependency graph, which analyzes from the smart contract bytecode level, restores most of the semantics and structure representation of the smart contract by constructing the operation code program dependency graph of the smart contract, and then learns the key features related to vulnerabilities in the operation code program dependency graph to detect vulnerabilities in the smart contract.

[0011] In order to achieve the above purpose, the present application adopts the following technical solutions:

[0012] A smart contract vulnerability detection method based on operation code program dependency graph, the method comprising:

[0013] Collecting a smart contract bytecode dataset, and marking operation codes that may trigger vulnerabilities;

[0014] Simulating the execution of the smart contract operation code sequence, constructing the smart contract operation code control flow graph and the smart contract operation code data dependency graph;

[0015] Constructing the smart contract operation code program dependency graph;

[0016] Taking the operation codes that may trigger vulnerabilities as key nodes, extracting the smart contract operation code program dependency graph slice related to vulnerabilities, and combining the marked information to construct the slice dataset;

[0017] Encoding the smart contract operation code program dependency graph slice;

[0018] Training a graph neural network model to extract the smart contract operation code program dependency graph slice features to realize smart contract vulnerability detection.

[0019] Further, the collecting of the smart contract bytecode dataset and the marking of the operation codes that may trigger vulnerabilities specifically comprises:

[0020] According to the smart contract bytecode dataset, using a disassembling tool to obtain the smart contract operation code sequence;

[0021] The operation code that may trigger a vulnerability of the smart contract is taken as a mark point, and the mark point operation code is marked by combining the Mythril tool, with 1 indicating a vulnerability and 0 indicating no vulnerability.

[0022] Further, the smart contract operation code control flow graph is a directed graph, the nodes are EVM operation codes excluding POP, DUP, SWAP and LOG series, and the edges are control flow and sequential execution flow between operation codes.

[0023] Further, the smart contract operation code data dependency graph is a directed graph, the nodes are EVM operation codes excluding POP, DUP, SWAP and LOG series, and the edges are data dependency relationships between operation codes.

[0024] Further, the smart contract operation code program dependency graph is constructed, and specifically includes:

[0025] According to the smart contract operation code control flow graph, a smart contract operation code forward dominance tree is constructed;

[0026] According to the smart contract operation code control flow graph and the smart contract operation code forward dominance tree, a smart contract operation code control dependency graph is constructed;

[0027] The smart contract operation code control dependency graph and the smart contract operation code data dependency graph are merged to construct a smart contract operation code program dependency graph.

[0028] Further, the smart contract operation code program dependency graph is a directed graph, the nodes are EVM operation codes excluding POP, DUP, SWAP and LOG series, and the edges include control dependency relationships and data dependency relationships between operation codes.

[0029] Further, the operation code that may trigger a vulnerability is taken as a key node, and a vulnerability-related smart contract operation code program dependency graph slice is extracted, and specifically includes:

[0030] The operation code node that may trigger a vulnerability in the smart contract operation code program dependency graph is taken as a starting node, and a forward slice is obtained by using a breadth-first search algorithm (BFS) to forwardly traverse;

[0031] A backward slice is obtained by using a breadth-first search algorithm (BFS) to backwardly traverse;

[0032] The forward slice and the backward slice are combined to obtain a vulnerability-related smart contract operation code program dependency graph slice.

[0033] Further, the smart contract operation code program dependency graph slice is encoded, and specifically includes:

[0034] The nodes of the smart contract operation code program dependency graph slice are encoded using an n-dimensional onehot vector, where n is the total number of EVM operation codes.

[0035] Further, the training of the graph neural network-based smart contract vulnerability detection model extracts slice features to realize smart contract vulnerability detection, wherein:

[0036] The graph neural network-based smart contract vulnerability detection model comprises an input layer, an Embedding layer, a graph neural network layer, a fully connected layer, and a Sigmoid layer.

[0037] The input layer is configured to receive a smart contract operation code program dependency graph slice.

[0038] The Embedding layer is configured to convert operation code nodes in the smart contract operation code program dependency graph slice into word vectors, and map each operation code node to a high-dimensional space vector as an input of the graph neural network layer.

[0039] The graph neural network layer learns semantic information of the program dependency graph slice using a message propagation network mechanism, and extracts smart contract semantic features.

[0040] The fully connected layer is configured to reduce the dimension of the smart contract semantic features, and map the smart contract semantic features to one-dimensional features corresponding to detection result labels.

[0041] The Sigmoid layer uses the activation function sigmoid to map the output of the fully connected layer to between 0 and 1, and is used to represent the probability of the existence of a smart contract vulnerability.

[0042] Further, the graph neural network layer is a gated graph sequence neural network, wherein:

[0043] The gated graph sequence neural network comprises a node message propagation stage and a graph feature readout stage.

[0044] The node message propagation stage aggregates domain node information through a gated recurrent unit, and the message propagation formula is as follows:

[0045]

[0046]

[0047]

[0048] wherein x i represents an operation code word vector corresponding to node i, represents a hidden layer feature of node i at time step t, wherein, N denotes the neighbor nodes of node i, W denotes the learnable weight matrix, e ij wherein, T denotes the edge type from node j to node i, GRU denotes the Gated Recurrent Unit;

[0049] The Gated Recurrent Unit updates the node hidden features by controlling the forgetting information and retaining the new information, and the update formula is as follows:

[0050]

[0051]

[0052]

[0053]

[0054] wherein, control the forgetting information, control the generated new information.

[0055] The graph feature reading stage obtains the features of the entire graph by combining the final state features of all nodes.

[0056] A smart contract vulnerability detection system based on opcode program dependence graph, the system comprises:

[0057] A smart contract collection module is configured to obtain a smart contract bytecode dataset.

[0058] A data preprocessing module is configured to convert the smart contract bytecode in the smart contract bytecode dataset into a smart contract opcode sequence, extract a smart contract opcode program dependence graph slice from the smart contract opcode sequence, and perform vulnerability labeling.

[0059] A graph neural network model training module is configured to use the preprocessed smart contract opcode program dependence graph slice as a training sample to train a graph neural network model, and obtain a trained graph neural network model.

[0060] A smart contract vulnerability detection module is configured to use the trained graph neural network model to perform vulnerability detection on a smart contract to be tested.

[0061] Further, the smart contract collection module specifically comprises:

[0062] A smart contract bytecode dataset is constructed by obtaining smart contract bytecodes on Ethereum from EtherScan.

[0063] Further, the data preprocessing module specifically comprises:

[0064] A disassembling tool is used to convert the smart contract bytecode into a smart contract opcode sequence.

[0065] determining operation codes that may trigger a vulnerability in the smart contract operation code sequence according to vulnerability characteristics;

[0066] vulnerability labeling of the operation codes that may trigger a vulnerability using a Mythril tool;

[0067] simulating execution of the smart contract operation code sequence to obtain a smart contract operation code control flow graph and a smart contract operation code data dependency graph;

[0068] constructing a smart contract operation code control dependency graph according to the smart contract operation code control flow graph;

[0069] constructing a smart contract operation code program dependency graph according to the smart contract operation code control dependency graph and the smart contract operation code data dependency graph;

[0070] constructing a smart contract operation code program dependency graph slice dataset by taking the operation codes that may trigger a vulnerability as initial nodes, extracting smart contract operation code program dependency graph slices through forward slicing and backward slicing, and performing vulnerability labeling on the slices according to the smart contract operation code program dependency graph.

[0071] The present application has the following beneficial effects relative to the prior art:

[0072] 1. The present application extracts features at the bytecode level of a smart contract for vulnerability detection, and does not require the use of a smart contract source code, thereby avoiding the problem of difficulty in obtaining a smart contract source code;

[0073] 2. The present application constructs a smart contract operation code program dependency graph using a smart contract bytecode to represent original semantic and structural information of a smart contract, thereby enriching extractable features of a smart contract;

[0074] 3. The present application uses program slicing technology to obtain smart contract operation code program dependency graph slices related to a vulnerability, so that a model only extracts and learns features related to a vulnerability, and does not need to focus on a large number of redundant features, thereby improving vulnerability detection performance of the model;

[0075] 4. The vulnerability detection model based on a gated graph sequence neural network trained by the present application effectively learns time sequence relationships between operation codes, enriches learned slice features, and further improves explainability of vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0076] Figure 1 is a flowchart of a smart contract vulnerability detection method based on an operation code program dependency graph according to Embodiment 1 of the present application;

[0077] Figure 2is a module diagram of the smart contract vulnerability detection system based on the operation code program dependency graph of embodiment 2 of the present application. DETAILED DESCRIPTION

[0078] The present application will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0079] Embodiment 1

[0080] As shown in the drawings, Figure 1 The present application provides a smart contract vulnerability detection method based on operation code program dependency graph, which includes four stages, namely smart contract collection, data preprocessing, model training and smart contract vulnerability detection, wherein:

[0081] Smart contract collection: obtain the smart contract bytecode on Ethereum from EtherScan, and build a smart contract bytecode dataset;

[0082] Data preprocessing: convert the smart contract bytecode into a smart contract operation code sequence using a disassembler tool; build a smart contract operation code program dependency graph slice dataset by simulation execution.

[0083] Model training: build a smart contract vulnerability detection model based on a graph neural network, use the smart contract operation code program dependency graph slice as a training sample to train the smart contract vulnerability detection model, and obtain a trained smart contract vulnerability detection model;

[0084] Smart contract vulnerability detection: obtain the smart contract operation code program dependency graph slice of the smart contract to be tested after data preprocessing, and use the trained smart contract vulnerability detection model for vulnerability detection.

[0085] The smart contract vulnerability detection method based on the smart contract operation code program dependency graph proposed in this embodiment specifically includes the following steps:

[0086] S1: Obtain the smart contract bytecode on Ethereum from EtherScan, and build a smart contract bytecode dataset.

[0087] S2: Convert the smart contract bytecode into a smart contract operation code sequence using a disassembler tool.

[0088] S3: Use the Mythril tool to mark the operation codes that may trigger vulnerabilities, for example, the CALL operation code may trigger a reentrant vulnerability.

[0089] S4: Based on the smart contract operation code sequence, build a smart contract operation code program dependency graph.

[0090] Further, step S4 includes:

[0091] simulate the smart contract operation code sequence to obtain a smart contract operation code control flow graph and a smart contract operation code data dependency graph;

[0092] construct a smart contract operation code control dependency graph according to the smart contract operation code control flow graph;

[0093] construct a smart contract operation code program dependency graph according to the smart contract operation code control dependency graph and the smart contract operation code data dependency graph;

[0094] S5: taking the operation code to be marked as an initial node, extracting a smart contract operation code program dependency graph slice through forward slicing and backward slicing, marking the slice for vulnerabilities, and constructing a smart contract operation code program dependency graph slice dataset;

[0095] S6: constructing a smart contract vulnerability detection model based on a graph neural network.

[0096] The smart contract vulnerability detection model based on the graph neural network comprises an input layer, an Embedding layer, a graph neural network layer, a full connection layer, and a Sigmoid layer, wherein:

[0097] The input layer is configured to receive the smart contract operation code program dependency graph slice;

[0098] The Embedding layer is configured to convert the operation code nodes in the smart contract operation code program dependency graph slice into word vectors, map each operation code node to a high-dimensional space vector, and serve as an input of the graph neural network layer;

[0099] The graph neural network layer is configured to learn semantic information of the program dependency graph slice by using a message propagation network mechanism and extract smart contract semantic features;

[0100] The full connection layer is configured to reduce the dimension of the smart contract semantic features and map the smart contract semantic features to one-dimensional features corresponding to detection result labels;

[0101] The Sigmoid layer is configured to map the output of the full connection layer to between 0 and 1 by using an activation function sigmoid, and is configured to represent a probability that the smart contract has a vulnerability.

[0102] S7: training the smart contract vulnerability detection model by taking the smart contract operation code program dependency graph slice as a training sample to obtain a trained smart contract vulnerability detection model.

[0103] S8: performing vulnerability detection by using the trained smart contract vulnerability detection model on a smart contract operation code program dependency graph slice obtained by data preprocessing on a smart contract to be detected.

[0104] Embodiment 2

[0105] AsFigure 2 As shown, the system for detecting vulnerabilities of smart contracts based on opcode program dependence graph provided by the application comprises a smart contract collection module, a data preprocessing module, a smart contract vulnerability detection model training module, and a smart contract vulnerability detection module. Among them:

[0106] The smart contract collection module is used to collect Ethereum smart contract bytecodes on EtherScan and construct a smart contract bytecode dataset.

[0107] The data preprocessing module is used to construct a smart contract opcode program dependence graph according to the smart contract bytecodes, then extract smart contract opcode program dependence graph slices using a slicing algorithm, and construct a training dataset.

[0108] The smart contract vulnerability detection model training module constructs a smart contract vulnerability detection model based on a graph neural network, and trains the smart contract vulnerability detection model using the smart contract opcode program dependence graph slices as training samples.

[0109] The smart contract vulnerability detection module uses the trained smart contract vulnerability detection model to detect vulnerabilities of the smart contract to be tested after data preprocessing to obtain smart contract opcode program dependence graph slices.

Claims

1. A method for vulnerability detection of a smart contract based on an operation code program dependence graph, characterized in that, The method comprises: Collecting a smart contract bytecode dataset, and marking opcodes that exist trigger vulnerabilities; Simulate the execution of the smart contract opcode sequence, build a smart contract opcode control flow graph and a smart contract opcode data dependency graph; Build a smart contract opcode program dependency graph; The smart contract opcode program dependency graph is built, specifically including: According to the smart contract opcode control flow graph, build a smart contract opcode forward dominance tree; Combine the smart contract opcode control flow graph and the smart contract opcode forward dominance tree to build a smart contract opcode control dependency graph; Merge the smart contract opcode control dependency graph and the smart contract opcode data dependency graph to build a smart contract opcode program dependency graph; Take the opcodes that may trigger vulnerabilities as key nodes, extract vulnerability-related smart contract opcode program dependency graph slices, and build a slice dataset combined with the marking information; Encode the smart contract opcode program dependency graph slice; Train a graph neural network model to extract smart contract opcode program dependency graph slice features to realize smart contract vulnerability detection; The training of the smart contract vulnerability detection model based on the graph neural network extracts the slice features to realize the smart contract vulnerability detection, wherein: The smart contract vulnerability detection model based on the graph neural network includes an input layer, an Embedding layer, a graph neural network layer, a fully connected layer and a Sigmoid layer; The input layer is used to receive the smart contract opcode program dependency graph slice; The Embedding layer is used to convert the opcode nodes in the smart contract opcode program dependency graph slice into word vectors, and map each opcode node to a high-dimensional space vector as the input of the graph neural network layer; The graph neural network layer learns the semantic information of the program dependency graph slice using a message passing network mechanism to extract smart contract semantic features; The fully connected layer is used to reduce the dimension of the smart contract semantic features and map the smart contract semantic features to a one-dimensional feature corresponding to the detection result label; The Sigmoid layer uses the activation function sigmoid to map the output of the fully connected layer to between 0 and 1, which is used to represent the probability of the existence of smart contract vulnerabilities.

2. The method of claim 1, wherein, The collection of the smart contract bytecode dataset, the marking of the opcodes that may trigger vulnerabilities, specifically includes: According to the smart contract bytecode dataset, use the disassembly tool to get the smart contract opcode sequence; Take the opcodes that may trigger smart contract vulnerabilities as marking points, and use the Mythril tool to mark the opcode points. Mark 1 for vulnerabilities and 0 for no vulnerabilities. 3.The method of claim 1, wherein, The smart contract opcode control flow graph is a directed graph, the nodes are EVM opcodes excluding POP, DUP, SWAP and LOG series, and the edges are control flow and sequential execution flow between opcodes.

4. The method of claim 1, wherein, The smart contract opcode data dependency graph is a directed graph, the nodes are EVM opcodes excluding POP, DUP, SWAP and LOG series, and the edges are data dependency relationships between opcodes.

5. The method of claim 1, wherein, The smart contract operation code program dependency graph is a directed graph, the nodes of which are EVM operation codes excluding POP, DUP, SWAP and LOG series, and the edges include control dependency and data dependency between operation codes.

6. The method of claim 1, wherein, The operation code that may trigger a vulnerability is taken as a key node, and a vulnerability-related smart contract operation code program dependency graph slice is extracted, specifically including: Taking the operation code node that may trigger a vulnerability in the smart contract operation code program dependency graph as a starting node, a forward slice is obtained by using a breadth-first traversal algorithm to traverse forward; A backward slice is obtained by using a breadth-first traversal algorithm to traverse backward; The forward slice and the backward slice are combined to obtain a vulnerability-related smart contract operation code program dependency graph slice.

7. The method of claim 1, wherein the method further comprises: The smart contract operation code program dependency graph slice is encoded, specifically including: An n-dimensional onehot vector is used to encode the nodes of the smart contract operation code program dependency graph slice, n being the total number of EVM operation codes. 8.The method of claim 1, wherein, The graph neural network layer is a gated graph sequence neural network, wherein: The gated graph sequence neural network includes a node message propagation stage and a graph feature reading stage; The node message propagation stage aggregates domain node information through a gated recurrent unit, and a message propagation formula is as follows: wherein, representing a node a corresponding opcode word vector, representing a node the hidden layer features at time step , representing a neighbor node of node , representing a learnable weight matrix, representing a node to node , representing a gated recurrent unit; The gated recurrent unit updates the node hidden feature by controlling the forgetting information and retaining the new information, and an update formula is as follows: wherein, controlling the forgotten information, controlling the generated new information; The graph feature reading stage obtains the feature of the whole graph by combining the final state features of all nodes.

Images