Smart contract attack detection method and apparatus

Abstract

The application provides a smart contract attack detection method and device, and relates to the field of network security, wherein the method comprises the following steps: performing plug-in in an Ethereum client Geth to obtain a transaction operation code sequence of each transaction; obtaining parameter features corresponding to each operation code in the transaction operation code sequence by simulating the execution process of a smart contract involved in the transaction in an EVM; training Embedding word vectors for the transaction operation code sequence and the parameter features respectively by using a pre-trained model to obtain two word vector index dictionaries; converting the transaction operation code sequence and the parameter features into transaction operation code sequence embedding and parameter feature embedding according to the word vector index dictionaries; and training a preset DNN classification model and detecting attack behaviors by using an embedding matrix after feature fusion. The application improves the accuracy of attack behavior detection of smart contract vulnerabilities.

Description

TECHNICAL FIELD

[0001] The present document relates to the technical field of network security, and particularly relates to a smart contract attack detection method and device. BACKGROUND

[0002] The use of smart contracts has gradually become an important part of blockchain applications. Smart contracts can automatically execute the provisions and conditions specified in the contract without the confirmation or verification of a third-party institution. However, the security of Ethereum smart contracts has not received much attention. Cases caused by smart contract security vulnerabilities are not uncommon and have had a significant impact on the ecology of the Ethereum blockchain. Therefore, the research on smart contract security has become an important field in the development process of blockchain technology.

[0003] In recent years, there have been many studies on detecting attack behaviors against smart contract vulnerabilities using deep learning technology. Most of them use static data related to smart contracts as training data for deep learning models, and there are few studies on detecting attack behaviors in smart contract transactions using dynamic data. Zhang et al. proposed a new hybrid deep learning model called CBGRU, which extracts features of smart contract source code through different deep learning models and combines these features for smart contract vulnerability detection. Mi et al. proposed a VSCL framework to automatically detect vulnerabilities in smart contracts on the blockchain. The new feature vector generation technology for smart contract bytecode is used to input the collected vector into a deep neural network (DNN) based on metric learning to obtain the detection result.

[0004] In the above scheme, the original data is generally the entire smart contract source code or the bytecode compiled from the smart contract source code. When constructing the feature vector using deep learning, the context relationship is lacking. Moreover, the information of the smart contract runtime is lacking, which affects the accuracy of the detection of attack behaviors against smart contract vulnerabilities. SUMMARY

[0005] The present application provides a smart contract attack detection method and device, which aims to solve the above problems.

[0006] The present application provides a smart contract attack detection method, which comprises the following steps:

[0007] S1, patching in the Ethereum client Geth, replaying the transaction of calling the smart contract, and obtaining the transaction operation code sequence of each transaction;

[0008] S2, obtaining the parameter features corresponding to each operation code in the transaction operation code sequence by simulating the execution process of the smart contract involved in the transaction in the EVM;

[0009] S3, training Embedding word vectors on the transaction opcode sequence and parameter features respectively by using a pre-trained model to obtain two word vector index dictionaries;

[0010] S4, converting the transaction opcode sequence and parameter features into transaction opcode sequence embedding and parameter feature embedding according to the word vector index dictionary;

[0011] S5, connecting the transaction opcode sequence embedding and the parameter feature embedding by splicing fusion features to obtain an overall transaction opcode sequence embedding matrix;

[0012] S6, training a preset DNN classification model according to the overall transaction opcode sequence embedding matrix and detecting attack behavior.

[0013] The embodiment of the application provides a smart contract attack detection device, which comprises:

[0014] An opcode sequence acquisition module is configured to perform plug-in on an Ethereum client Geth, replay transactions calling a smart contract, and obtain transaction opcode sequences of each transaction;

[0015] A parameter feature acquisition module is configured to acquire parameter features corresponding to each opcode in the transaction opcode sequence by simulating an execution process of a smart contract involved in a transaction in an EVM;

[0016] A word vector index dictionary module is configured to train Embedding word vectors on the transaction opcode sequence and parameter features respectively by using a pre-trained model to obtain two word vector index dictionaries;

[0017] A feature embedding module is configured to convert the transaction opcode sequence and parameter features into transaction opcode sequence embedding and parameter feature embedding according to the word vector index dictionary;

[0018] A feature fusion module is configured to connect the transaction opcode sequence embedding and the parameter feature embedding by splicing fusion features to obtain an overall transaction opcode sequence embedding matrix;

[0019] An attack detection module is configured to train a preset DNN classification model according to the overall transaction opcode sequence embedding matrix and detect attack behavior.

[0020] By using the pre-trained Word2Vec model to construct the embedding vector of the transaction operation code sequence and the parameter feature, the transaction operation code sequence embedding and the parameter feature embedding are obtained respectively, the transaction operation code sequence embedding and the parameter feature embedding are spliced, and an overall embedding matrix is obtained. The embedding matrix not only retains the semantic information of the transaction operation code sequence on the stack operation, but also retains the source and association information of the parameter feature. Through DNN training, the attack behavior information in the smart contract transaction is maximally learned, and the accuracy of detecting the attack behavior in the smart contract transaction is improved. The application can realize real-time dynamic detection of transaction attacks after the smart contract is chained, and maximally reduce user loss. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the one or more embodiments of the present specification or the prior art, the drawings needed to be used in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 The flowchart of the smart contract attack detection method of the embodiment of the present application;

[0023] Figure 2 The schematic diagram of the smart contract attack detection device of the embodiment of the present application;

[0024] Figure 3 The DNN classification model architecture diagram of the smart contract attack detection method of the embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the person skilled in the art better understand the technical solutions in the one or more embodiments of the present specification, the technical solutions in the one or more embodiments of the present specification will be described clearly and completely below in combination with the drawings in the one or more embodiments of the present specification. Obviously, the described embodiments are only some embodiments of the present specification, not all embodiments. Based on the one or more embodiments of the present specification, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present document.

[0026] Method embodiment

[0027] According to the embodiment of the present application, a smart contract attack detection method is provided, Figure 1 The flowchart of the smart contract attack detection method of the embodiment of the present application, according to Figure 1 The smart contract attack detection method of the embodiment of the present application specifically comprises:

[0028] S1, replaying the transactions that call the smart contract in the Ethereum client Geth, obtaining the transaction opcode sequence of each transaction;

[0029] The plugging in S1 refers to inserting code segments in the Ethereum client Geth source code to collect detailed data of each transaction. These code segments are mainly inserted into the EVM virtual machine opcode method, the classes and functions involved in executing transactions. The collected transaction information includes: block parameters, account addresses involved in the transaction, called smart contract addresses, transfer amount, and transaction input data; among them, the block parameters include: block height, timestamp, root hash, transaction price, nonce value.

[0030] The replay in S1 refers to re-executing all transactions that call the smart contract that have been executed by Ethereum on the plugged-in client Geth, and finally obtaining the transaction opcode sequence and other information of each transaction. The specific process includes:

[0031] Install and start the database on the local or cloud server;

[0032] Enter the instruction to start the replay in the Ethereum client Geth terminal, and the plugging code will automatically process the underlying transaction bytecode to generate the transaction opcode sequence, and store the transaction opcode sequence and the smart contract address in the database.

[0033] S2, obtain the parameter characteristics corresponding to each opcode in the transaction opcode sequence by simulating the execution process of the smart contract involved in the transaction in EVM; S2 specifically includes:

[0034] Analyze the operation of each opcode on the EVM stack, such as the PUSHn instruction, which pushes n-byte length operands onto the stack top; the ADD instruction, which pops two stack top elements and performs addition operation, and then pushes the result onto the stack top; among them, the operand pushed into the stack by the PUSHn instruction is obtained from the outside, and in this paper, the operand corresponding to the operation code that obtains data from the outside and operates on the stack is defined as a parameter type, such as the parameter type of the PUSHn instruction is "VALUE"; while the operand used by the ADD instruction is popped from the stack top, so the parameter type of the ADD instruction is associated with the types of the two operands popped from the stack top, assuming that the popped operands are PUSHn instruction and SELFBALANCE instruction pushed onto the stack top, then the parameter type corresponding to the ADD instruction is "VALUE ACCOUNTBALANCE", and in another case, the two operands popped from the stack top are both pushed onto the stack top by the PUSHn instruction, then the parameter type corresponding to the ADD instruction is only one "VALUE", and other opcodes are repeated.

[0035] The smart contract involved in the simulation transaction is executed in the EVM, and the transaction opcode sequence is essentially a series of actions performed on the stack, so according to the analysis of the above parameter types, the transaction opcode sequence obtained is generated parameter features.

[0036] S3, using a pre-trained model to train an Embedding word vector for the transaction opcode sequence and the parameter features respectively, and obtaining two word vector index dictionaries; S3 specifically comprises:

[0037] A Word2Vec pre-trained model is built, a skip-gram algorithm is used, and negative sampling optimization is used.

[0038] The transaction opcode sequence and the parameter feature dataset are respectively input into the Word2Vec pre-trained model, and then the word vector index dictionaries of the transaction opcode sequence and the parameter features are respectively output.

[0039] Word2Vec is a group of related models used to generate word vectors. These models are shallow and double-layer neural networks used to train to reconstruct linguistic word texts. The network is represented by words, and needs to guess the input words in adjacent positions. Under the bag-of-words model assumption in Word2Vec, the order of words is not important. After training is completed, the Word2Vec model can be used to map each word to a vector, which can be used to represent the relationship between words. Skip-gram is a very large neural network. Gradient descent in such a large neural network is quite slow, and a large amount of training data is needed to adjust these weights and avoid overfitting. The embodiment of the present application solves this problem through negative sampling. It is a method used to improve training speed and improve the quality of the obtained word vector.

[0040] S4, converting the transaction opcode sequence and the parameter features into transaction opcode sequence embedding and parameter feature embedding according to the word vector index dictionary; S4 specifically comprises:

[0041] According to the word vector index dictionary, the transaction opcode sequence is converted into the transaction opcode sequence embedding;

[0042] Since some operation codes correspond to parameter types containing multiple parameter types (theoretically up to 20 parameter types), after statistics, the length of the parameter type corresponding to an operation code is uniformly 5 (longer than 5 is cut off, and less than 5 is supplemented with 0), which can not only retain most of the semantic information, but also can well reduce the dimension of the embedding matrix. The parameter features are converted into parameter type embeddings by using this method.

[0043] S5, connecting the transaction opcode sequence embedding and the parameter feature embedding by splicing fusion features to obtain an overall transaction opcode sequence embedding matrix; S5 specifically comprises:

[0044] By splicing the fused features, the transaction operation code sequence embedding and the parameter feature embedding are spliced into a transaction operation code sequence embedding matrix with higher dimensions and containing more feature information.

[0045] S6, training a preset DNN classification model according to the overall transaction operation code sequence embedding matrix and detecting attack behaviors. S6 specifically includes:

[0046] Training the DNN classification model using the embedding matrix after feature fusion;

[0047] Inputting the transaction operation code sequence to be tested into the trained DNN model to detect whether there is an attack behavior.

[0048] In order to facilitate understanding, a specific implementation of an embodiment of the present method is provided, and the specific steps are as follows:

[0049] (1) Geth plug-in and replay phase

[0050] First, install the Ethereum client Geth on the local or cloud server and plug in. The plug-in refers to inserting code segments in the Ethereum client Geth source code to collect detailed data of each transaction. These code segments are mainly inserted into the EVM virtual machine operation code method, the classes and functions involved in executing transactions. The collected transaction information includes: block parameters, account addresses involved in transactions, called smart contract addresses, transaction amounts, transaction input data, and dynamic transaction operation code sequences composed of EVM virtual machine underlying operation codes and operation arrays; wherein the blockchain parameters include: block height, timestamp, root hash, transaction price, nonce value.

[0051] Then install MongoDB and start the service, input the instruction geth-syncmode full-datadir data in the Geth background terminal, use the local or cloud server as a full node to replay all transactions of the called smart contract executed by Ethereum so far, in this process, the plug-in code will automatically obtain all smart contract addresses called by each transaction, process the underlying transaction bytecode to generate dynamic transaction operation code sequences, and finally store the transaction operation code sequences and smart contract addresses in MongoDB.

[0052] (2) Parameter feature acquisition phase

[0053] The data obtained in this phase is parameter features.

[0054] First, analyze how all types of operation codes in EVM operate on the stack. In one specific implementation of the invention, operation codes can be divided into three categories:

[0055] The first type of operation code does not operate on the stack, and is only used to represent the state of the contract execution, such as JUMPDEST, STOP, INVALID;

[0056] The second type of operation code is used to obtain external data and push the data into the stack for subsequent use, such as the PUSHn instruction obtaining n bytes of data from the contract code and pushing the data into the top of the stack, and the ADDRESS instruction obtaining the address of the current execution account and pushing the address into the top of the stack.

[0057] The third type of operation code pops data from the stack and performs a specific operation, such as the ADD instruction, which pops the top two elements of the stack for addition operation and pushes the result into the top of the stack.

[0058] For the second type of operation code that introduces data from the outside and pushes it into the top of the stack, different operation codes of this type are defined with different parameter types (operation code: parameter type), as shown in Table 1, which has the following 22 parameter types:

[0059] Table 1 Parameter Type

[0060]

[0061]

[0062] The first type of operation code only represents the execution state of the contract, and in the embodiment of the present application, the default parameter type of STOP, INVALID, and JUMPDEST is NULL, and the data type of the third type of operation code is a combination of the first and second types of data.

[0063] The transaction operation code sequence is essentially a series of behaviors on the stack. Through the above analysis, the parameter characteristics corresponding to each transaction operation code sequence can be obtained, and the parameter characteristics are stored in the MongoDB database.

[0064] (3) Embedding matrix construction stage

[0065] The Embedding word vector is trained through the Word2Vec interface of the gensim library, and the training data is the transaction operation code sequence and the parameter characteristics. In the parameter setting, the vector dimension is 128, the iteration number is 8 (n_epoch=8), the number of each model input is 100 (batch_size=100), the skip-gram algorithm is used, and the negative sampling optimization is used. Finally, a 144*128 transaction operation code sequence word vector index dictionary and a 22*128 parameter characteristic word vector index dictionary are generated, 143 represents the operation code type in all transaction operation code sequences, 22 represents the parameter type in all parameter characteristics, and 128 represents the word vector dimension.

[0066] Then, each operation code in the transaction operation code sequence and its corresponding parameter type are converted into corresponding word vectors according to the transaction operation code sequence word vector index dictionary and the parameter feature word vector index dictionary respectively. Since there are some operation codes corresponding to parameter types composed of multiple parameter types, the word vectors of the data types contained in the parameter types can be added and averaged to obtain vector representation. Meanwhile, the sequence library pad_sequences interface is used to unify the lengths of the two sequences to 5000. The sequences less than 5000 are supplemented with 0 vectors, and the operation codes exceeding 5000 are deleted. Finally, a 128*5000*num three-dimensional feature vector matrix of the transaction operation code sequence is generated, and num represents the number of transaction operation code sequences and a 128*5000*num three-dimensional feature vector matrix of the parameter features, and num represents the number of parameter features.

[0067] Finally, by splicing and fusing the features, the two feature vector matrices are fused into a 128*20000*num matrix as the input data of the DNN model.

[0068] (4) Detection model training and testing phase

[0069] In a specific implementation of the embodiment of the application, the BiLSTM-Attention model is selected as the intelligent contract transaction attack behavior detection model. The model combines the BiLSTM model and the attention mechanism. The model includes an embedding layer, two bidirectional LSTM layers, an attention layer, a fully connected layer, and an output layer. The two bidirectional LSTM layers can extract bidirectional features of the input sequence while preserving the context information. A Dropout layer is used between the two LSTM layers to avoid overfitting. The Attention layer accepts the output of the bidirectional LSTM layer, calculates the attention weight of each time step, and uses the weights to perform weighted summation on the output of the LSTM. The weighted summation result is passed to the fully connected layer, which performs nonlinear transformation on it, and then the output is passed to the output layer, which uses the Softmax function to convert the hidden state into the probability of each class. After the model training is completed, the transaction operation code sequence obtained is subjected to the second and third stages to obtain a fully embedded matrix, which is input into the detection model for detection.

[0070] By adopting the embodiment of the application, the following beneficial effects are achieved:

[0071] 1. The application provides an intelligent contract attack detection method based on transaction operation code sequences and parameter features, which can detect transaction attacks in real time and dynamically after the intelligent contract is chained, thereby minimizing user losses.

[0072] 2. This smart contract attack detection method based on transaction opcode sequences and parameter features utilizes a pre-trained Word2Vec model to construct embedding vectors for transaction opcode sequences and parameter features, obtaining transaction opcode sequence embeddings and parameter feature embeddings respectively. The transaction opcode sequence embeddings and parameter feature embeddings are concatenated to obtain a unified embedding matrix. This embedding matrix retains both the semantic information of the transaction opcode sequence on stack operations and the source and association information of the parameter features. By training a DNN, the method maximizes the learning of attack behavior information in smart contract transactions, thereby improving the accuracy of detecting attack behavior in smart contract transactions.

[0073] Device Examples

[0074] According to an embodiment of the present invention, a smart contract attack detection device is provided. Figure 2 This is a schematic diagram of a smart contract attack detection device according to an embodiment of the present invention. Figure 2 As shown, the smart contract attack detection device of this embodiment of the invention specifically includes:

[0075] The opcode sequence acquisition module 20 is used to instrument the Ethereum client Geth, replay the transactions that call the smart contract, and obtain the transaction opcode sequence of each transaction.

[0076] The parameter feature acquisition module 21 is used to acquire the parameter features corresponding to each opcode in the transaction opcode sequence by simulating the execution process of the smart contract involved in the transaction in the EVM.

[0077] The word vector index dictionary module 22 is used to train Embedding word vectors on the transaction opcode sequence and parameter features respectively using a pre-trained model to obtain two word vector index dictionaries;

[0078] Feature embedding module 23 is used to convert the transaction opcode sequence and parameter features into transaction opcode sequence embedding and parameter feature embedding based on the word vector index dictionary;

[0079] The feature fusion module 24 is used to connect the transaction opcode sequence embedding and the parameter feature embedding by splicing and fusing features to obtain an overall transaction opcode sequence embedding matrix;

[0080] The attack detection module 25 is used to train a preset DNN classification model based on the overall transaction opcode sequence embedding matrix and detect attack behavior.

[0081] The instrumentation in the Ethereum client Geth within the opcode sequence acquisition module specifically includes:

[0082] A code segment is inserted in the source code of the Ethereum client Geth to collect detailed data of each transaction; the code segment is inserted into the EVM virtual machine opcode method, the class and function involved in executing the transaction, and the collected detailed data of the transaction includes block parameters, account addresses involved in the transaction, called smart contract addresses, transfer amounts, and transaction input data.

[0083] The operation code sequence acquisition module replays the transaction calling the smart contract to obtain the transaction operation code sequence of each transaction, which specifically includes:

[0084] All transactions calling the smart contract that have been executed by Ethereum are re-executed on the instrumented client Geth, and finally the transaction operation code sequence and other information of each transaction are obtained, and the specific process includes:

[0085] Install and start the database on the local or cloud server;

[0086] Enter the instruction to start the replay in the Ethereum client Geth terminal, and the instrumented code automatically processes the underlying transaction bytecode to generate the transaction operation code sequence, and stores the transaction operation code sequence and the smart contract address in the database.

[0087] The parameter feature acquisition module is specifically used for:

[0088] By simulating the execution process of the smart contract involved in the transaction in the EVM, the parameter feature corresponding to each operation code in the transaction operation code sequence is obtained.

[0089] The word vector index dictionary module is specifically used for:

[0090] Build a Word2Vec pre-training model, and use the skip-gram algorithm and negative sampling to optimize the model.

[0091] Input the transaction operation code sequence and the parameter feature into the Word2Vec pre-training model to obtain the word vector index dictionary of the transaction operation code sequence and the parameter feature.

[0092] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting smart contract attacks, characterized in that, include: S1. Instrument the Ethereum client Geth to replay the transactions that call the smart contract and obtain the transaction opcode sequence for each transaction. S2. By simulating the execution process of the smart contracts involved in the transaction in the EVM, obtain the parameter characteristics corresponding to each opcode in the transaction opcode sequence; Specifically, the acquisition of parameter features corresponding to each opcode in the transaction opcode sequence includes: Analyze the operation behavior of each opcode on the EVM stack in the transaction opcode sequence, and define parameter types based on operands; For opcodes that push external data onto the stack, the parameter type is defined as the parameter type corresponding to the operand; For opcodes that perform calculations by popping operands from the top of the stack, the parameter types are determined by the combination of the parameter types corresponding to the popped operands. If the parameter types of the operands are the same, they are merged. S3. Use the pre-trained model to train Embedding word vectors for the transaction opcode sequence and parameter features respectively, and obtain two word vector index dictionaries; S4. Based on the word vector index dictionary, convert the transaction opcode sequence and parameter features into transaction opcode sequence embeddings and parameter feature embeddings; S5. By splicing and fusing features, the transaction opcode sequence embedding and parameter feature embedding are connected to obtain an overall transaction opcode sequence embedding matrix; S6. Train the preset DNN classification model based on the overall transaction operation code sequence embedding matrix and detect attack behavior.

2. The method according to claim 1, characterized in that, The instrumentation in the Ethereum client Geth specifically includes: inserting code segments into the Geth source code to collect detailed data for each transaction; the code segments are inserted into EVM virtual machine opcode methods, classes and functions involved in executing transactions, and the collected transaction details include: block parameters, account addresses participating in the transaction, smart contract addresses called, transfer amounts, and transaction input data.

3. The method according to claim 1, characterized in that, The replaying of transactions that invoke smart contracts to obtain the transaction opcode sequence for each transaction specifically includes: All transactions that have been executed on Ethereum that call smart contracts are re-executed on the instrumented Geth client, ultimately obtaining the transaction opcode sequence and other information for each transaction. The specific process includes: Install and start the database on a local or cloud server; Enter the command to start replay in the Ethereum client Geth terminal. The instrumented code automatically processes the underlying transaction bytecode to generate a transaction opcode sequence, and then stores the transaction opcode sequence and smart contract address in the database.

4. The method according to claim 1, characterized in that, S3 specifically includes: A Word2Vec pre-trained model was built, and the skip-gram algorithm and negative sampling were used to optimize the Word2Vec pre-trained model. Input the transaction opcode sequence and parameter features into the Word2Vec pre-trained model to obtain a dictionary of word vector indices for the transaction opcode sequence and parameter features.

5. A smart contract attack detection device, characterized in that, include: The opcode sequence acquisition module is used to instrument the Ethereum client Geth, replay the transactions that call the smart contract, and obtain the transaction opcode sequence of each transaction. The parameter feature acquisition module is used to acquire the parameter features corresponding to each opcode in the transaction opcode sequence by simulating the execution process of the smart contract involved in the transaction in the EVM. Specifically, the acquisition of parameter features corresponding to each opcode in the transaction opcode sequence includes: Analyze the operation behavior of each opcode on the EVM stack in the transaction opcode sequence, and define parameter types based on operands; For opcodes that push external data onto the stack, the parameter type is defined as the parameter type corresponding to the operand; For opcodes that perform calculations by popping operands from the top of the stack, the parameter types are determined by the combination of the parameter types corresponding to the popped operands. If the parameter types of the operands are the same, they are merged. The word vector index dictionary module is used to train Embedding word vectors on the transaction opcode sequence and parameter features respectively using a pre-trained model to obtain two word vector index dictionaries; The feature embedding module is used to convert the transaction opcode sequence and parameter features into transaction opcode sequence embedding and parameter feature embedding based on the word vector index dictionary; The feature fusion module is used to connect the transaction opcode sequence embedding and the parameter feature embedding by splicing and fusing features to obtain a total transaction opcode sequence embedding matrix; The attack detection module is used to train a preset DNN classification model based on the overall transaction opcode sequence embedding matrix and detect attack behaviors.

6. The apparatus according to claim 5, characterized in that, The instrumentation in the Ethereum client Geth within the opcode sequence acquisition module specifically includes: A code segment is inserted into the source code of the Ethereum client Geth to collect detailed data for each transaction. The code segment is inserted into the EVM virtual machine opcode method, the class and function involved in executing the transaction, and the collected transaction details include: block parameters, account addresses participating in the transaction, smart contract addresses called, transfer amount, and transaction input data.

7. The apparatus according to claim 5, characterized in that, The opcode sequence acquisition module replays the transactions that call the smart contract to obtain the transaction opcode sequence for each transaction, specifically including: All transactions that have been executed on Ethereum that call smart contracts are re-executed on the instrumented Geth client, ultimately obtaining the transaction opcode sequence and other information for each transaction. The specific process includes: Install and start the database on a local or cloud server; Enter the command to start replay in the Ethereum client Geth terminal. The instrumented code automatically processes the underlying transaction bytecode to generate a transaction opcode sequence, and then stores the transaction opcode sequence and smart contract address in the database.

8. The apparatus according to claim 5, characterized in that, The word vector index dictionary module is specifically used for: A Word2Vec pre-trained model was built, and the skip-gram algorithm and negative sampling were used to optimize the Word2Vec pre-trained model. Input the transaction opcode sequence and parameter features into the Word2Vec pre-trained model to obtain a dictionary of word vector indices for the transaction opcode sequence and parameter features.

Images