Smart contract vulnerability detection method based on contract semantic graph and deep and wide feature fusion

Abstract

The present invention discloses a smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features. The method can make full use of the relevant information of data flow, control flow and fallback operation mechanism in the smart contract code to construct a smart contract semantic graph containing rich structural information. Then, the sequential semantic information of the code token sequence and the structural semantic information of the smart contract semantic graph are combined to extract the deep semantic features of the smart contract using a deep neural network. At the same time, based on pre-defined interpretable artificial vulnerability detection rules, a linear model composed of a fully connected layer and an activation function is used to extract the artificial rule features of the smart contract. Finally, the Wide&Deep model is used to fuse the two features that focus on breadth and depth respectively to perform vulnerability detection on the smart contract. The present invention can effectively represent the semantic information related to vulnerabilities in smart contracts.

Description

Technical Field

[0001] The present invention relates to a smart contract vulnerability detection method, and in particular to a smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features. Background Art

[0002] Smart contracts are an important part of blockchain technology, providing seamless automation for digital currency transactions. As an automated program code running on the blockchain, smart contracts can be automatically triggered and executed, carrying a large amount of financial business logic and being called by users very frequently. Smart contract vulnerabilities refer to program errors or design flaws in smart contracts executed on the blockchain, which allow attackers to exploit these vulnerabilities to perform unauthorized operations or obtain improper benefits. Traditional smart contract vulnerability detection tools that rely on manual rules can no longer meet people's vulnerability detection needs as the types and number of vulnerabilities increase. In recent years, with the successful practice of deep learning technology in fields such as natural language processing and target detection, smart contract vulnerability detection methods based on deep learning have gradually become a research hotspot.

[0003] However, Solidity, the mainstream programming language for smart contracts, has only been around for a short time and lacks comprehensive program analysis tools. In addition, the fallback operation mechanism of smart contracts increases the difficulty of deep learning methods in automatically capturing the characteristics of smart contract code vulnerabilities, which poses challenges to smart contract vulnerability detection methods based on deep learning.

[0004] At present, the common practice of smart contract vulnerability detection methods based on deep learning is to convert the smart contract source code into a vector representation with high semantic capabilities, and then use the extracted semantic vector representation to train a classifier, and use the trained classifier to perform smart contract vulnerability detection tasks. Similar to the practice in the field of natural language, smart contract vulnerability detection methods based on deep learning usually convert smart contract codes into token sequences, and then use sequence neural networks (such as LSTM and GRU, etc.) for processing. Tian et al. (Tian, ​​G., Wang, Q., Zhao, Y., Guo, L., Sun, Z., & Lv, L. (2020). Smart Contract Classification With a Bi-LSTMBasedApproach. IEEE Access, 8, 43806-43816.) used the BiLSTM model and attention mechanism to perform contract-level vulnerability detection on smart contracts.

[0005] Compared with natural language text, code is structured and has rich structural information. Using only token sequences cannot fully utilize the rich structural information and logical relationships in the code. In recent years, graph structures have begun to be used to model smart contract codes, and graph neural networks (such as GAT and GCN) have been used to learn structural information and vulnerability features in contract codes. However, due to the lack of perfect program analysis tools in Solidity, the mainstream programming language for smart contracts, it is difficult to extract detailed data flow information and control flow information, which makes it difficult to model smart contracts as graph structures that can represent code semantic information. Zhuang et al. (Zhuang Y, Liu Z, Qian P, et al. Smart Contract Vulnerability Detection using Graph Neural Network [C] / / IJCAI. 2020: 3283-3290.) extracted different code elements such as variables and functions in smart contract codes, and added edges related to control flow and data flow information according to the time sequence of the use of these code elements. The smart contract was modeled as a contract graph, and a time message propagation network (TMP) was proposed for the vulnerability detection task of smart contracts. Based on the work of Zhuang et al., Liu et al. proposed a CGE method (Liu, Z., Qian, P., Wang, X., Zhuang, Y., Qiu, L., & Wang, X. (2023). Combining Graph Neural Networks With Expert Knowledge for Smart Contract Vulnerability Detection. IEEE Transactions on Knowledge and Data Engineering, 35 (2), 1296-1310.), which uses the same contract graph structure as the TMP method and uses the attention mechanism to integrate expert knowledge into the network to perform vulnerability detection tasks for smart contracts. The contract graphs used in these two works can capture rich structural information in the smart contract code, but in order to reduce the complexity of the contract graph structure and accelerate network training, both works have deleted unimportant nodes in the contract graph, and the important nodes that are not retained do not record information such as the type of variables and the type of function return values. At the same time, there is a lack of consideration for calls between functions, which results in the loss of a large amount of semantic information of the smart contract code in the contract graph. At the same time, this method uses the same convolution and pooling operations to process both the generated code semantic vector representation and the expert knowledge vector representation, without considering the difference between the two in the semantic abstraction level.

[0006] In addition, the existing deep learning-based smart contract vulnerability detection methods use a single smart contract feature representation. For example, the method proposed by Tian et al. only uses the sequence features of the smart contract code, while the TMP and CGE methods only use graph structure features. Summary of the invention

[0007] In view of the above-mentioned problems existing in the prior art, the present invention provides a smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features. This method can make full use of the relevant information of data flow, control flow and fallback operation mechanism in the smart contract code to construct a smart contract semantic graph containing rich structural information. Then, the deep semantic features of the smart contract are extracted using a deep neural network by combining the sequential semantic information of the code token sequence with the structural semantic information of the smart contract semantic graph. At the same time, based on pre-defined interpretable artificial vulnerability detection rules, a linear model composed of a fully connected layer and an activation function is used to extract the artificial rule features of the smart contract. Finally, the Wide&Deep model is used to fuse the two features that focus on breadth and depth respectively to detect vulnerabilities in smart contracts. Compared with the code representation method that only uses sequence features or graph structure features, the present invention uses the Wide&Deep model to jointly train the graph- and sequence-based deep learning model and the artificial rule-based linear model. It can effectively integrate the deep semantic features extracted from the sequence information and structure information of the code and the breadth semantic features extracted from the artificial rules, and make full use of the generalization ability of the deep learning model and the memory ability of the linear model to capture more comprehensive and accurate smart contract vulnerability features, which helps to improve the performance of the smart contract vulnerability detection model.

[0008] The objective of the present invention is achieved through the following technical solutions:

[0009] A smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features includes the following steps:

[0010] Step 1: Construct a smart contract semantic graph. The specific steps are as follows:

[0011] Step 1.1: Use the Slither tool to extract the control flow graph of the function in the smart contract;

[0012] Step 1.2: Build an enhanced control flow graph of the smart contract by adding function definition relationships, function call relationships, and contract entry nodes;

[0013] Step 1.3: Extract the data flow information in the smart contract and add the corresponding data flow edges in the enhanced control flow graph;

[0014] Step 1.4: Extract the fallback operation mechanism information in the smart contract and add fallback edges and fallback nodes in the enhanced control flow graph;

[0015] Step 1.5: Integrate the enhanced control flow graph, data flow information, and fallback operation mechanism information to build a smart contract semantic graph;

[0016] Step 2: Extract the deep semantic features of the contract code based on the deep learning model. The specific steps are as follows:

[0017] Step 2.1: Split the smart contract code into token sequences;

[0018] Step 2.2: Use the CodeBert pre-trained model to embed the token sequence of the smart contract and the statements in the nodes of the smart contract semantic graph to obtain their initial vector representation;

[0019] Step 2.3: Use GGNN to learn the representation of the smart contract semantic graph to learn the hidden vector representation of each node, and read out the graph-level vector representation by averaging the node vectors to obtain the structural semantic features of the smart contract code, that is, the vector representation of the contract semantic graph features;

[0020] Step 2.4: Use BiGRU to learn the representation of the token sequence of the smart contract code to obtain the vector representation of the sequence features of the smart contract code;

[0021] Step 2.5: Combine the smart contract sequence features with the contract semantic graph features to obtain the deep semantic features of the smart contract;

[0022] Step 3: Use artificial rules to screen the smart contract code to generate one-hot encoding, and use a linear model composed of a fully connected layer and an activation function to extract broad semantic features based on artificial rules, namely artificial rule features;

[0023] Step 4: Use the Wide&Deep model to fuse the deep semantic features and wide semantic features of the smart contract, and send them to the Softmax layer to get the prediction results. Use the label information to calculate the cross entropy loss function, and adjust the network parameters according to the error back propagation until the network's response to the input reaches the predetermined target range, and the training is completed;

[0024] Step 5: Use the trained complete model to detect vulnerabilities in the smart contract code.

[0025] Compared with the prior art, the present invention has the following advantages:

[0026] 1. The present invention proposes a code representation method called a smart contract semantic graph, which contains rich control flow information, data flow information, and inter-procedural function call information in the smart contract code, and integrates information related to the fallback operation mechanism in the smart contract, which can effectively represent semantic information related to vulnerabilities in smart contracts.

[0027] 2. The present invention uses BiGRU and GGNN to extract the sequence features and structural features of smart contracts, which can effectively capture and learn the vulnerability features in the smart contract code and improve the vulnerability detection performance.

[0028] 3. The present invention fully considers the deep semantic features of smart contracts extracted based on deep learning models and the broad semantic features of smart contracts extracted based on linear models and artificial rules, that is, the artificial rule features of smart contracts, and uses the Wide&Deep model to fuse the two features, making full use of the generalization ability of deep learning models and the memory ability of linear models to capture more comprehensive and accurate smart contract vulnerability features, thereby improving the vulnerability detection performance of smart contract codes. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a schematic diagram of the overall process of the present invention.

[0030] Figure 2 It is a schematic diagram of the construction process of the smart contract semantic graph.

[0031] Figure 3 This is a schematic diagram of the structure of the smart contract vulnerability detection model based on the fusion of contract semantic graph and deep and wide features.

[0032] Figure 4 It is the smart contract code.

[0033] Figure 5 yes Figure 4 Smart contract semantic graph. DETAILED DESCRIPTION

[0034] The technical solution of the present invention is further described below in conjunction with the accompanying drawings, but is not limited thereto. Any modification or equivalent replacement of the technical solution of the present invention without departing from the spirit and scope of the technical solution of the present invention should be included in the protection scope of the present invention.

[0035] The present invention provides a smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features. First, the Slither tool is used to parse the source code to generate the control flow graph of each function in the smart contract. In order to capture richer smart contract structure information, especially the fallback operation mechanism information in the smart contract, the control flow information of the function in the smart contract is enhanced, that is, the entry node of the new contract is created, the call relationship and function definition relationship between the functions are added, and several isolated function control flow graphs are connected to a complete weakly connected graph, and the relevant information of the data flow information and the fallback operation mechanism is added to construct a complete smart contract semantic graph. Next, the smart contract code is divided into token sequences, and the CodeBert pre-training model is used to embed the nodes of the smart contract semantic graph and the token sequence of the code, and the token sequence and the smart contract semantic graph of the smart contract are represented and learned based on the bidirectional gated recurrent neural network (BiGRU) and the gated graph neural network (GGNN), respectively, to extract the sequence features and graph structure features of the smart contract, and then the two features are spliced ​​and fused to obtain the deep semantic features of the smart contract. At the same time, pre-defined artificial rules (such as "whether block.timestamp is used in the smart contract code", "whether the mathematical operation security library is used in the smart contract code", etc.) are used to screen the smart contract code to generate One-hot encoding, and then the artificial rule feature vector representation of the smart contract is obtained through a linear model composed of a fully connected layer and an activation function, that is, the breadth semantic features based on artificial rules. Finally, the Wide&Deep model is used to build a fusion model of the deep semantic features of the smart contract and the artificial rule features, and the fused features are sent to the Softmax classifier to realize the vulnerability detection of the smart contract, that is, to determine whether the smart contract contains security vulnerabilities. Figure 1 As shown, the specific steps are as follows:

[0036] Step 1: Construct a smart contract semantic graph. The specific steps are as follows:

[0037] Step 1.1: Use the Slither tool to extract the control flow graph of the function in the smart contract.

[0038] Step 1.2: Build an enhanced control flow graph of the smart contract by adding function definition relationships, function call relationships, and contract entry nodes. The specific steps are as follows:

[0039] Step 1.2.1: Traverse the nodes in the control flow graph and record all nodes that contain calls to other functions in the contract;

[0040] Step 1.2.2: Add function call edges between all nodes that contain calls to other smart contract functions and the function entry nodes of the called functions;

[0041] Step 1.2.3: Add the contract entry node;

[0042] Step 1.2.4: Connect the contract entry node with the function entry nodes of all functions through the function definition edge (define edge).

[0043] The enhanced control flow graph generation algorithm is shown in Table 1.

[0044] Table 1

[0045]

[0046] Step 1.3: Extract the data flow information in the smart contract and add the corresponding data flow edges in the enhanced control flow graph. The specific steps are as follows:

[0047] Step 1.3.1: Construct the def map and use set, where: the def map represents the mapping of variables in the smart contract to the node where the variable is defined or last updated; the use set represents the set of variables used in the node;

[0048] Step 1.3.2: Perform a depth-first traversal of the enhanced control flow graph, record the variables used in the nodes into the use set, then use the def map to obtain the node in the use set where the variable was last updated or defined, and finally use the dataflow edge to connect them.

[0049] The data flow extraction algorithm of smart contracts is shown in Table 2.

[0050] Table 2

[0051]

[0052] Step 1.4: Extract the fallback operation mechanism information in the smart contract and add fallback edges and fallback nodes in the enhanced control flow graph. The specific steps are as follows:

[0053] Step 1.4.1: Add fallback node;

[0054] Step 1.4.2: Traverse the nodes of the enhanced control flow graph. If the node has a call to the call.value function, use the fallback edge to connect the node to the fallback node; if the node does not have a call to the call.value function, keep the original node and do not add the fallback edge;

[0055] Step 1.4.3: If the in-degree of the last fallback node is greater than 0, use the fallback edge to connect the fallback node with all function entry nodes; if the in-degree of the fallback node is less than 0, no action is taken.

[0056] The fallback mechanism simulation algorithm of the smart contract is shown in Table 3.

[0057] Table 3

[0058]

[0059] Step 1.5: Integrate the above information and construct the smart contract semantic graph.

[0060] Step 2: Extract the deep semantic features of the contract code based on the deep learning model. The specific steps are as follows:

[0061] Step 2.1: Split the smart contract code into token sequences.

[0062] Step 2.2: Use the CodeBert pre-trained model to embed the token sequence of the smart contract and the statements in the nodes of the smart contract semantic graph to obtain their initial vector representation. The specific steps are as follows:

[0063] Step 2.2.1: Use the CodeBert pre-trained model to embed the token sequence of the smart contract and obtain the embedding vector representation of each token in the token sequence;

[0064] Step 2.2.2: Use the CodeBert pre-trained model to embed the statements contained in the smart contract semantic graph nodes, and use the [CLS] vector in the embedding result as the embedding vector representation of the smart contract semantic graph node.

[0065] Step 2.3: Use GGNN to learn the representation of the smart contract semantic graph to learn the hidden vector representation of each node, and use the node vector average method to read out the graph-level vector representation to obtain the structural semantic features of the smart contract code, that is, the vector representation of the contract semantic graph features. The specific formula is as follows:

[0066]

[0067]

[0068]

[0069]

[0070]

[0071]

[0072]

[0073] Among them, W z , W r , W z with U z , U r , U is the trainable parameter in the network, b z , b r , b is bias, σ is the activation function, represents the hidden vector representation of node u at the t-1th time step, N(v) represents the set of adjacent nodes of node v, It represents the intermediate hidden vector representation of the integrated adjacent node information of the v-th node at the t-th time step, To reset the gate, To update the gate, The node intermediate hidden vector representation represents the node number v that comprehensively resets the gate and updates the gate information at the tth time step, represents the hidden vector representation of the vth node at the tth time step, h g represents the graph-level vector representation of graph g, N represents the node set in the graph, |N| is the modulus of the node set N, that is, the number of nodes contained in the node set N, represents the initial graph-level vector representation of graph g, represents the graph-level vector representation of the graph g at the t-th time step, h graph It is the semantic graph feature of smart contract.

[0074] Step 2.4: Use BiGRU to learn the representation of the token sequence of the smart contract code and obtain the embedded representation of the sequence features of the smart contract code. The specific formula is:

[0075] z t =σ(W z x t +U z h t-1 +b z )

[0076] r t =σ(W r x t +U r h t-1 +b r )

[0077]

[0078]

[0079]

[0080] Among them, W z , W r , W z with U z , U r , U is the trainable parameter in the network, b z , b r , b is bias, σ is activation function, z is GRU reset gate, r is GRU update gate, h t-1 represents the node hidden vector representation passed from the t-1 time step, It represents the hidden vector representation of the node, h t It represents the hidden vector representation of the node at the tth time step after the comprehensive update gate and reset gate information, || represents the concatenation operation of the vector, represents the hidden vector representation obtained at the nth time step during the GRU forward update process, represents the hidden vector representation obtained during the nth time step in the GRU reverse update process, h seq It represents the sequence characteristics of the input smart contract code.

[0081] Step 2.5: Combine the smart contract sequence features with the contract semantic graph features to obtain the deep semantic features of the smart contract. The specific formula is:

[0082] h deep =σ(h seq ||h graph )

[0083] Among them, || represents the concatenation operation of vectors, h seq represents the sequence characteristics of the input smart contract code, h graph Represents the semantic graph features of the input smart contract, h deep Represents the deep semantic features of the input smart contract.

[0084] Step 3: Use artificial rules to screen the smart contract code to generate one-hot encoding, and use a linear model composed of a fully connected layer and an activation function to extract broad semantic features based on artificial rules, namely artificial rule features. The specific steps are as follows:

[0085] Step 3.1: Use pre-defined manual rules for different vulnerabilities to screen the smart contract code. If a rule is met, it is marked as 1, and if it is not met, it is marked as 0. After traversing all the manual rules, several one-hot codes for different vulnerabilities can be obtained.

[0086] Step 3.2: Concatenate several one-hot codes and use a linear model consisting of a fully connected layer and an activation function to extract the artificial rule features of the smart contract. The specific formula is:

[0087] h artificial =σ(W(|| r∈rules x i )+b)

[0088] Among them, W is the trainable parameter in the network, b is the bias, σ is the activation function, || represents the concatenation operation of the vector, rules is the set of artificial vulnerability rules, and x i represents the one-hot encoding of the i-th artificial vulnerability rule, h atificial It represents the extensive semantic features based on artificial rules, that is, the artificial rule features of smart contracts.

[0089] Step 4: Use the Wide&Deep model to fuse the deep semantic features and wide semantic features of the smart contract, and send them to the Softmax layer to get the prediction results. Use the label information to calculate the cross entropy loss function, and adjust the network parameters according to the error back propagation until the network's response to the input reaches the predetermined target range. The training is completed. The specific formula is as follows:

[0090] y=Softmax(W wide h artificial +W deep h deep +b)

[0091]

[0092] Among them, W wide With W deep is a trainable parameter in the network, b is bias, h atificial represents the artificial rule features of the input smart contract, h deep represents the deep semantic features of the input smart contract, Softmax is the activation function, and y is the output prediction result. is the actual label of the sample. If the sample has a vulnerability, the value is 1, otherwise it is 0.

[0093] Step 5: Use the trained complete model ( Figure 3 ) to detect vulnerabilities in smart contract code.

[0094] Example:

[0095] Take a smart contract code with 13 lines of code as an example, the marked statements are the reasons that cause the reentrancy vulnerability, such as Figure 4 shown.

[0096] The vulnerability of this contract is caused by line 6. The vulnerable contract performs a call.value transfer in line 5. Since the fallback mechanism is triggered, the contract does not run to the statement in line 6 to change the balance variable, causing the attacking contract to repeatedly enter the Transactions function to perform wireless transfers and withdrawals. The smart contract semantics diagram of the above contract is as follows: Figure 5 shown.

[0097] Figure 5 The semantic graph of the smart contract shows that there is an obvious ring structure, that is, the process from the IF 2 node to the fallback node and then returning to the function entry node. In this ring structure, there is no statement to change the balance-related variables and to judge the state, so it can be easily found that the attack contract can repeatedly enter the same environment, and the LuckyETH contract can be refunded infinitely by the attacker, and there is a reentrant vulnerability. The method proposed in the present invention can capture the running track of the fallback mechanism in the reentrant vulnerability and the calling relationship between functions through the semantic graph of the smart contract, and can easily find the vulnerability characteristics of the reentrant vulnerability. When the traditional deep learning model (such as LSTM and GRU) with serialized data as input is used to detect the code of the smart contract, it is possible to lose key context information during batch learning, and the sequence structure is also difficult to capture the calling relationship between functions, and it is impossible to extract rich structural information in the smart contract. Finally, the network model proposed by the present invention can also detect that the smart contract has security vulnerabilities.

[0098] The present invention constructs a semantic graph of a smart contract with rich semantic information, and uses BiGRU and GGNN to represent and learn the sequence structure and contract semantic graph of the smart contract, which can fully utilize and learn the sequence information, structural information and context information in the code. BiGRU can capture the forward and reverse sequential dependencies in the smart contract code, while GGNN is suitable for learning the structural feature representation in the graph input, and can adapt to codes of different lengths, without having to represent the code as a fixed-length sequence like traditional LSTM or GRU. Therefore, this method is more suitable for effectively encoding the complex structural semantics of the smart contract code, and at the same time, the sequence information of the smart contract code is integrated to capture more accurate vulnerability features and improve the vulnerability detection performance of the smart contract. In addition, the present invention uses artificial rule features, such as "whether there is a call to call.value in the function" and "whether the mathematical security operation related library is used", etc., which can provide accurate local code information for the deep learning model, further assist the model in performing the smart contract vulnerability detection task, and improve the overall detection performance level of the model.

Claims

1. A smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features, characterized by The method comprises the following steps: Step 1: Construct a smart contract semantic graph. The specific steps are as follows: Step 1.1: Use the Slither tool to extract the control flow graph of the function in the smart contract; Step 1.2: Build an enhanced control flow graph of the smart contract by adding function definition relationships, function call relationships, and contract entry nodes; Step 1.3: Extract the data flow information in the smart contract and add the corresponding data flow edges in the enhanced control flow graph; Step 1.4: Extract the fallback operation mechanism information in the smart contract and add fallback edges and fallback nodes in the enhanced control flow graph; Step 1.5: Integrate the enhanced control flow graph, data flow information, and fallback operation mechanism information to build the smart contract semantic graph; Step 2: Extract the deep semantic features of the contract code based on the deep learning model. The specific steps are as follows: Step 2.1: Split the smart contract code into token sequences; Step 2.2: Use the CodeBert pre-trained model to embed the token sequence of the smart contract and the statements in the nodes of the smart contract semantic graph to obtain their initial vector representation; Step 2.3: Use GGNN to learn the representation of the smart contract semantic graph to learn the hidden vector representation of each node, and read out the graph-level vector representation by averaging the node vectors to obtain the structural semantic features of the smart contract code, that is, the vector representation of the contract semantic graph features; Step 2.4: Use BiGRU to learn the representation of the token sequence of the smart contract code to obtain the vector representation of the sequence features of the smart contract code; Step 2.5: Concatenate the smart contract sequence features with the contract semantic graph features to obtain the deep semantic features of the smart contract; Step 3: Use artificial rules to screen the smart contract code to generate one-hot encoding, and use a linear model composed of a fully connected layer and an activation function to extract broad semantic features based on artificial rules, namely artificial rule features; Step 4: Use the Wide&Deep model to fuse the deep semantic features and wide semantic features of the smart contract, and send them to the Softmax layer to get the prediction results. Use the label information to calculate the cross entropy loss function, and adjust the network parameters according to the error back propagation until the network's response to the input reaches the predetermined target range, and the training is completed; Step 5: Use the trained complete model to detect vulnerabilities in the smart contract code.

2. The smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features according to claim 1 is characterized in that The specific steps of step 1.2 are as follows: Step 1.2.1: Traverse the nodes in the control flow graph and record all nodes that contain calls to other functions in the contract; Step 1.2.2: Add function calls between all nodes that contain calls to other smart contract functions and the function entry node of the called function; Step 1.2.3: Add the contract entry node; Step 1.2.4: Connect the contract entry node with the function entry nodes of all functions by defining the function.

3. The smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features according to claim 1 is characterized in that The specific steps of step 1.3 are as follows: Step 1.3.1: Construct the def map and use set, where: the def map represents the mapping of variables in the smart contract to the node where the variable is defined or last updated; the use set represents the set of variables used in the node; Step 1.3.2: Perform a depth-first traversal of the enhanced control flow graph, record the variables used in the nodes into the use set, then use the def map to obtain the node in the use set where the variable was last updated or defined, and finally use the dataflow to connect them.

4. The smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features according to claim 1 is characterized in that The specific steps of step 1.4 are as follows: Step 1.4.1: Add fallback node; Step 1.4.2: Traverse the nodes of the enhanced control flow graph. If the node has a call to the call.value function, use the fallback edge to connect the node to the fallback node; if the node does not have a call to the call.value function, keep the original node and do not add the fallback edge; Step 1.4.3: If the in-degree of the last fallback node is greater than 0, use the fallback edge to connect the fallback node with all function entry nodes; If the in-degree of the fallback node is less than 0, no action is taken.

5. The smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features according to claim 1 is characterized in that The specific steps of step 2.2 are as follows: Step 2.2.1: Use the CodeBert pre-trained model to embed the token sequence of the smart contract and obtain the embedding vector representation of each token in the token sequence; Step 2.2.2: Use the CodeBert pre-trained model to embed the statements contained in the smart contract semantic graph nodes, and use the [CLS] vector in the embedding result as the embedding vector representation of the smart contract semantic graph node.

6. The smart contract vulnerability detection method based on the fusion of contract semantic graph and deep and wide features according to claim 1 is characterized in that The specific steps of step 3 are as follows: Step 3.1: Use pre-defined manual rules for different vulnerabilities to screen the smart contract code. If a rule is met, it is marked as 1, and if it is not met, it is marked as 0. After traversing all the manual rules, several one-hot codes for different vulnerabilities can be obtained; Step 3.2: Concatenate several one-hot codes and use a linear model consisting of a fully connected layer and an activation function to extract the artificial rule features of the smart contract. The specific formula is: h artificial =σ(W(|| r∈rules x i )+b) Among them, W is the trainable parameter in the network, b is the bias, σ is the activation function, || represents the concatenation operation of the vector, rules is the set of artificial vulnerability rules, and x i represents the one-hot encoding of the i-th artificial vulnerability rule, h atificial It represents the extensive semantic features based on artificial rules, that is, the artificial rule features of smart contracts.

Images