A ponzi scheme intelligent contract detection method based on adversarial learning

Abstract

The application provides a Ponzi scheme intelligent contract detection method based on adversarial learning, and relates to the technical field of intelligent contract detection. The method first collects and pre-processes intelligent contract data to obtain an intelligent contract operation code sequence; then analyzes the intelligent contract operation code sequence to obtain an operation code behavior sequence containing maximum logical information and semantic information of the operation code; and obtains a word vector representation of the operation code behavior sequence according to a word vector embedding model; then constructs a TextCNN model, and takes the word vector representation of the operation code behavior sequence as the model input to judge the Ponzi scheme intelligent contract; this process can maximize the preservation of the semantic information of the intelligent contract operation code, thus improving the classification effect of the model. Finally, a disturbance is added to the TextCNN model by using an adversarial training algorithm to obtain a Ponzi scheme detection model, so as to overcome the problems of lack of robustness and generalization of the model when facing adversarial attacks.

Description

Technical Field

[0001] This invention relates to the field of smart contract detection technology, and in particular to a method for detecting Ponzi scheme smart contracts based on adversarial learning. Background Technology

[0002] The development of blockchain technology has attracted the attention of investors worldwide. Ethereum, as a representative of the Blockchain 2.0 era, has deployed a large number of smart contracts to realize various business operations. At the same time, fraudulent activities on Ethereum are rapidly increasing, with Ponzi schemes accounting for a significant proportion.

[0003] Current research on detecting Ponzi scheme contracts includes:

[0004] The project "Exploiting blockchain data to detect smart Ponzi schemes on Ethereum" compiles smart contract code into bytecode, then uses external tools to decompile it into opcodes and extracts opcode frequency features. Furthermore, they extract statistical account features from the smart contract's transaction history. Finally, they employ a random forest algorithm as a classification model based on composite features to detect Ponzi scheme contracts. However, this method only analyzes the smart contract's transaction history and opcode frequency features. Detection based on transaction behavior requires a considerable number of transactions to learn the behavior, making it ineffective for smart contracts with few transactions, and manually crafted features cannot capture this information well. While opcode frequency analysis does not involve opcode sequences, individual opcodes appear very frequently in the code. Therefore, although a single opcode can be used for code identification, it is difficult to comprehensively characterize the behavioral features of Ponzi scheme contract code.

[0005] The paper "CTRF: Ethereum-Based Ponzi Contract Identification" proposes a method for detecting Ponzi contracts on Ethereum. It improves the recall of a random forest model by incorporating opcode sequence features into the code features and extracting more effective transaction features. While this method extracts opcode sequence features, it primarily focuses on the n-gram features of the opcodes, essentially using the frequency characteristics of the opcode sequence for detection without considering the semantic information of the opcode sequence.

[0006] The paper "Sadponzi: Detecting and Characterizing Ponzi Schemes in Ethereum SmartContracts" proposes a semantic-aware detection method for identifying Ponzi schemes in Ethereum smart contracts based on dynamic symbolic execution technology. Essentially, it's a heuristic-guided symbolic execution technique that simulates the execution process of the source code and detects Ponzi schemes based on their redistribution strategies and the data structures used to store user information. However, this method's dynamic simulation and pre-testing methods consume significant time and resources. Furthermore, since only a small portion of the smart contract's source code is publicly available, analysis from the source code perspective has limited applicability.

[0007] Machine learning-based methods are easily affected by circumvention techniques. While symbolic execution can dynamically simulate program execution processes and reduce the impact of circumvention techniques, it suffers from significant time and resource consumption. As research progresses, creators of Ponzi scheme contracts may use countermeasures based on existing judgment mechanisms to render such detection techniques ineffective. Summary of the Invention

[0008] The technical problem to be solved by the present invention is to address the shortcomings of the prior art by providing a Ponzi scheme smart contract detection method based on adversarial learning, thereby enabling the detection of Ponzi scheme smart contracts.

[0009] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a Ponzi scheme smart contract detection method based on adversarial learning.

[0010] By analyzing the opcode sequence of smart contracts, an opcode behavior sequence containing the maximum logical and semantic information of the opcode is obtained;

[0011] The word vector representation of the opcode action sequence is obtained based on the word vector embedding model;

[0012] A TextCNN model is constructed, and the word vector representations of opcode action sequences are used as input to the model to identify Ponzi scheme smart contracts.

[0013] Adversarial training algorithms are used to add perturbations to the TextCNN model, thereby overcoming the lack of robustness and generalization when the model faces adversarial attacks.

[0014] Specifically, the following steps are included:

[0015] Step 1: Smart Contract Data Collection and Preprocessing: Collect a set of tags for labeled Ethereum Ponzi scheme contracts, crawl the Ethereum network to obtain bytecode files of Ponzi scheme smart contracts and non-Ponzi scheme smart contracts; disassemble the bytecode files into opcode files to obtain a complete smart contract opcode sequence.

[0016] Step 2: Extraction of smart contract opcode behavior patterns: Construct a control flow graph G containing logical semantic information from the smart contract opcode sequence.<N,E> Where N is the set of all basic blocks in the control flow graph, and E is the set of edges between all basic blocks in the control flow graph;

[0017] First, the opcode is divided into basic blocks based on the stop and jump instructions, and these basic blocks are regarded as nodes of the control flow graph. Second, directed edges are added between basic blocks according to their jump addresses. For any disconnected subgraphs and isolated nodes, a sequential linking method is used to add directed edges from high to low between nodes with consecutive addresses. At this point, the control flow graph is completed.

[0018] After the control flow graph is established, it is traversed to extract logical semantic information and obtain the opcode behavior sequence. This example uses two methods to traverse the control flow graph. The first method is to start from the first basic block and perform a depth-first traversal, treating each branch of the graph as a path, and then integrating all the obtained paths to obtain the full path sequence of the opcode. The second method is to start from the first basic block and use a depth-first traversal to obtain the depth-first path sequence of the opcode.

[0019] Step 3: Word embedding: After obtaining the opcode action sequence, the sequence is analyzed, where each opcode is treated as a word. The segmented words are then trained using the Word2Vec word embedding model to obtain dense word vectors containing word association information.

[0020] Step 4: Construct a TextCNN model to identify Ponzi scheme smart contracts; Based on the dense word vectors obtained in Step 3, the opcode text sequence is vectorized and then used as input to TextCNN. TextCNN captures local features of the word vectors for training and finally outputs the probability of the possible categories of the smart contract to determine whether it belongs to a Ponzi scheme contract.

[0021] Step 5: Introduce adversarial learning mechanisms into the TextCNN model for adversarial training; by introducing perturbations into the word vector layer of TextCNN to mimic the attacker's modification of the Ponzi scheme contract opcode, the TextCNN model is trained using fast gradient descent, projective gradient descent, and FreeAT respectively; during model training, adversarial examples and normal examples are jointly trained to adjust the model parameters; and the impact of the three adversarial learning algorithms on the robustness of the model is compared and analyzed. Finally, the optimal adversarial training algorithm is selected to construct the Ponzi scheme detection model.

[0022] Step 6: Obtain the smart contract to be tested, and use the Ponzi scheme detection model built in Step 5 to detect the smart contract to be tested as a Ponzi scheme.

[0023] The beneficial effects of adopting the above technical solution are as follows: The Ponzi scheme smart contract detection method based on adversarial learning provided by this invention analyzes the preprocessed Ponzi scheme contract opcode sequence, proposes to establish a control flow graph based on the control flow of the opcode, and obtains the opcode behavior sequence containing the maximum semantic information of the opcode. This sequence is then used as input to the TextCNN model for training, which can retain the semantic information of the smart contract opcode to the greatest extent, thus improving the model's classification performance. Subsequently, deep analysis of the model's classification results yields the optimal opcode behavior sequence. Secondly, an adversarial learning mechanism is introduced into the neural network model, generating a perturbation factor to perturb the input text vector, mimicking the attacker's modification of the Ponzi contract. Then, during the model training process, the network parameters are adjusted to allow the neural network to gradually adapt, thereby improving the model's effectiveness and robustness. Attached Figure Description

[0024] Figure 1 A flowchart illustrating a Ponzi scheme smart contract detection method based on adversarial learning, provided for an embodiment of the present invention;

[0025] Figure 2 This is a flowchart of opcode behavior sequence extraction provided in an embodiment of the present invention;

[0026] Figure 3 A diagram illustrating the adversarial training process provided in an embodiment of the present invention;

[0027] Figure 4 A comparison diagram of the loss of the original path, the full path, and the depth-first path used for training the TextCNN model, provided for embodiments of the present invention;

[0028] Figure 5 The loss comparison diagram is provided for the TextCNN model after adding FGM, PGD and FreeAT adversarial training algorithms to the model according to the embodiments of the present invention. Detailed Implementation

[0029] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0030] In this embodiment, a Ponzi scheme smart contract detection method based on adversarial learning is described, such as... Figure 1 As shown, the specific steps include:

[0031] Step 1: Smart Contract Data Collection and Preprocessing: Collect the tag set of Ethereum Ponzi scheme contracts marked in previous relevant research papers, and obtain the bytecode of Ponzi scheme smart contracts and non-Ponzi scheme smart contracts from Ethereum web crawlers; then set up the Ethereum client Go-Ethereum, and use the command "evm disasm bytecode filename" to disassemble the bytecode file into an opcode file to obtain the complete smart contract opcode sequence;

[0032] Step 2: Extraction of opcode behavior patterns: Inspired by static program execution and graph data structures, the opcode sequence is constructed into a control flow graph G containing logical semantic information.<N,E> Where N is the set of all basic blocks in the control flow graph, and E is the set of edges between all basic blocks in the control flow graph;

[0033] Specific steps are as follows: Figure 2 As shown, firstly, based on the stop instructions (RETURN, STOP, INVALID, SELFDESTRUCT, REVERT) and jump instructions (JUMP, JUMPI, JUMPDEST) of the opcode, the opcode is divided into basic blocks, and the basic blocks are regarded as nodes of the control flow graph. Secondly, according to the jump address of the basic block, directed edges are added between the basic blocks. For the existing disconnected subgraphs and isolated nodes, the sequential linking method is used to add directed edges from high to low between nodes with consecutive addresses. At this point, the control flow graph is completed.

[0034] After the control flow graph is established, it is traversed to extract logical semantic information and obtain the opcode behavior sequence. This example uses two methods to traverse the control flow graph. The first method starts with a depth-first traversal from the first basic block, treating each branch of the graph as a path, and then integrating all the obtained paths to obtain the full path sequence (APS) of the opcode. The second method starts with the first basic block and uses a depth-first traversal to obtain the depth-first path sequence (DFS) of the opcode. Analysis shows that the text length of the full path sequence obtained by the former is at most 1,657,279 and at least 8; the text length of the depth-first path sequence obtained by the latter is the same as the initial text, with a maximum of 13,290 and a minimum of 8.

[0035] Step 3: Word Vector Embedding: After obtaining the opcode action sequence, the sequence is analyzed, with each opcode treated as a word. The segmented words are then trained using the Word2Vec word vector embedding model to obtain dense word vectors containing word association information. The Word2Vec model has two structures: CBOW and Skip-gram. Although CBOW is faster than Skip-gram in terms of model training speed, Skip-gram predicts context based on intermediate words, resulting in better semantic performance. Therefore, in this embodiment, the Word2Vec model uses the Skip-gram structure for word vector training. The word vectors obtained after the opcode sequence is processed by the Word2vec model are represented as V = (V1, V2, ..., V...). n ).

[0036] Step 4: Construct a TextCNN model to identify Ponzi scheme smart contracts. TextCNN has single-layer convolution and pooling operations. By changing the size of the sliding window, it performs convolution and pooling operations on the input text to capture local semantic information of the text and obtain local feature vectors containing text semantics. Based on the dense word vectors V obtained in Step 3, the opcode text sequence is vectorized and then used as input to TextCNN. TextCNN captures the local features of the word vectors for training and finally outputs the probability of the possible categories of smart contracts to determine whether they belong to Ponzi scheme contracts.

[0037] Step 5: Adversarial Training: Introduce adversarial learning mechanisms into the TextCNN model, such as... Figure 3 As shown, by introducing perturbations into the word vector layer of TextCNN to mimic the attacker's modification of the Ponzi scheme contract opcode, three common adversarial training algorithms—Fast Gradient Method, Projected Gradient Descent, and FreeAT (Free Adversarial Training)—were used to train the TextCNN model. The perturbation factor is represented by γ, and the perturbation of the word vectors yields adversarial samples V′ = γ + V. During model training, adversarial samples and normal samples are jointly trained to adjust the model parameters. The impact of the three adversarial learning algorithms on the robustness of the model is compared and analyzed. Finally, the optimal adversarial training algorithm is selected to construct the Ponzi scheme detection model.

[0038] To ensure that the randomly acquired subset of data maintains a consistent distribution with the original dataset, this embodiment randomly divides the preprocessed smart contract behavior sequence dataset into a training set, a test set, and a validation set in a ratio of 7:1:2. The training set is used to train the TextCNN model, the validation set is used to view the training effect of the model, and the test set is used to perform classification tests on the trained model.

[0039] This embodiment uses three performance evaluation metrics, including precision, recall, and F1 score, to evaluate the test results; the higher the value of each of these three metrics, the better the model's performance. The calculation formulas for precision, recall, and F1 score are shown in (1), (2), and (3):

[0040]

[0041]

[0042]

[0043] Wherein, TP stands for True positive, representing the number of samples with a label of 1 and a predicted label of 1; FP stands for False positive, representing the number of samples with a label of 1 and a predicted label of 0; TN stands for True negative, representing the number of samples with a label of 0 and a predicted result of 0; and FN stands for False negative, representing the number of samples with a label of 0 and a predicted result of 1.

[0044] The behavior sequence of the Ponzi scheme smart contract and the test results of the adversarial training algorithm are analyzed based on the values ​​of Precision, Recall and F1-score. The optimal behavior sequence of the Ponzi scheme smart contract is obtained by comparing the results. In addition, after obtaining the opcode behavior sequence of the Ponzi scheme smart contract, the impact of the three adversarial learning algorithms on the robustness performance of the model is compared and analyzed. Finally, the optimal adversarial training algorithm is selected to construct the Ponzi scheme detection model.

[0045] Step 6: Obtain the smart contract to be tested, and use the Ponzi scheme detection model built in Step 5 to detect the smart contract to be tested as a Ponzi scheme.

[0046] This embodiment verifies the extracted opcode behavior sequence of a Ponzi scheme smart contract. The original opcode sequence, the full path sequence (APS), and the depth-first search sequence (DFS) were used as input to the TextCNN model for classification testing. The results are shown in Table 1. The depth-first search sequence showed the best performance and classification effect, with Precision = 0.9785, Recall = 0.9727, and F1-score = 0.9741. Furthermore, as... Figure 4 As shown, compared to the original sequence, the TextCNN models trained with the two path sequences proposed in this invention exhibit a faster loss reduction. Experimental results demonstrate that the depth-first sequence based on opcodes proposed in this invention can preserve the semantic information of smart contract opcodes to the greatest extent, thus improving the model's classification performance.

[0047] Table 1 shows the classification results using different paths as input to the TextCNN model.

[0048] TextCNN 0.9561 0.9574 0.9567 0.093 TextCNN-APS 0.9679 0.9688 0.9681 0.13 TextCNN-DFS 0.9785 0.9727 0.9741 0.1

[0049] This embodiment also tests the impact of three adversarial training methods—FGM, PGD, and FreeAT—on the classification results. The experimental results are shown in Table 2. The table shows that the adversarial training algorithms improve the performance of the TextCNN model to varying degrees, with PGD showing the best classification performance: Precision = 0.9836, Recall = 0.9805, and F1-score = 0.9812. Meanwhile, after adding adversarial training, the loss of the TextCNN model gradually decreases. Figure 5 As shown above, the results demonstrate that adversarial training has a positive impact on the classification performance of the TextCNN model, and also improves the model's robustness.

[0050] Table 2 shows the experimental results after incorporating FGM, PGD, and FreeAT into the TextCNN model.

[0051] TextCNN 0.9785 0.9727 0.9441 0.1 TextCNN+FGM 0.9810 0.9766 0.9776 0.087 TextCNN+PGD 0.9836 0.9805 0.9812 0.088 TextCNN+FreeAT 0.9785 0.9727 0.9441 0.13

[0052] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. A method for detecting Ponzi scheme smart contracts based on adversarial learning, characterized in that: By analyzing the opcode sequence of smart contracts, an opcode behavior sequence containing the maximum logical and semantic information of the opcode is obtained; The word vector representation of the opcode action sequence is obtained based on the word vector embedding model; A TextCNN model is constructed, and the word vector representations of opcode action sequences are used as input to the model to identify Ponzi scheme smart contracts. Adversarial training algorithms are used to add perturbations to the TextCNN model in order to overcome the lack of robustness and generalization when the model faces adversarial attacks. The method includes the following steps: Step 1: Smart Contract Data Collection and Preprocessing: Collect a set of tags for labeled Ethereum Ponzi scheme contracts, and crawl the Ethereum network to obtain the bytecode files of Ponzi scheme smart contracts and non-Ponzi scheme smart contracts. Disassemble the bytecode file into an opcode file to obtain the complete smart contract opcode sequence; Step 2: Extraction of smart contract opcode behavior patterns: Construct a control flow graph containing logical semantic information from the smart contract opcode sequence; traverse the control flow graph and extract logical semantic information from it to obtain the opcode behavior sequence; Step 3: Word embedding: After obtaining the opcode action sequence, the sequence is analyzed, where each opcode is treated as a word. The segmented words are then trained using the Word2Vec word embedding model to obtain dense word vectors containing word association information. Step 4: Build a TextCNN model to identify Ponzi scheme smart contracts; Step 5: Introduce adversarial learning mechanisms into the TextCNN model for adversarial training to obtain a Ponzi scheme detection model; by introducing perturbations into the word vector layer of TextCNN to simulate the attacker's modification of the Ponzi scheme contract opcode, multiple adversarial learning algorithms are used to train the TextCNN model; during model training, adversarial examples and normal examples are jointly trained to adjust the model parameters; and the impact of multiple adversarial learning algorithms on the robustness of the model is compared and analyzed. Finally, the optimal adversarial training algorithm is selected to construct the Ponzi scheme detection model. Step 6: Obtain the smart contract to be tested and use the Ponzi scheme detection model to detect it as a Ponzi scheme.

2. The method for detecting Ponzi scheme smart contracts based on adversarial learning according to claim 1, characterized in that: The specific method for constructing a control flow graph containing logical semantic information from the smart contract opcode sequence in step 2 is as follows: The opcode is divided into basic blocks based on the stop and jump instructions, and these basic blocks are considered nodes in the control flow graph. Next, directed edges are added between basic blocks according to their jump addresses. For any disconnected subgraphs and isolated nodes, a sequential linking method is used to add directed edges from high to low address between nodes with consecutive addresses, thereby establishing a control flow graph containing logical semantic information. G < N , E > where N is the set of all basic blocks in the control flow graph, and E is the set of edges between all basic blocks in the control flow graph.

3. The method for detecting Ponzi scheme smart contracts based on adversarial learning according to claim 2, characterized in that: Step 2 employs two methods to traverse the control flow graph. The first method involves a depth-first traversal starting from the first basic block, treating each branch of the graph as a path, and then integrating all the obtained paths to obtain the full path sequence of the opcodes. The second method uses the first basic block as the starting point and employs a depth-first traversal to obtain the depth-first path sequence of the opcodes.

4. The method for detecting Ponzi scheme smart contracts based on adversarial learning according to claim 3, characterized in that: The specific method for step 4 is as follows: Based on the dense word vectors obtained in step 3, the opcode text sequence is vectorized and then used as input to TextCNN. TextCNN captures local features of the word vectors for training and finally outputs the probability of the possible categories of the smart contract to determine whether it belongs to a Ponzi scheme contract.

5. The method for detecting Ponzi scheme smart contracts based on adversarial learning according to claim 4, characterized in that: Step 4 employs three adversarial learning algorithms—fast gradient descent, projective gradient descent, and FreeAT—to train the TextCNN model.

Images