Intelligent contract code clone detection method fusing symbolic representation and graph representation

Abstract

The invention discloses an intelligent contract code clone detection method fusing symbolic representation and graph representation, and belongs to the technical field of code clone detection. The method comprises the steps that a data set is divided into a training data set and a data set to be detected, code file pairs are grouped through the similarity calculated through a detection method based on symbolic representation, the most suitable threshold value of the detection method based on graph representation is determined for each group in the mode of maximizing the F1 score, and follow-up detection is conducted through the threshold value. According to the method, the semantic clone problem in the intelligent contract code can be detected more accurately, the defect that the accuracy of identifying the semantic clone in the intelligent contract code in the prior art is insufficient is overcome, meanwhile, unnecessary graph detection operation is reduced, and the overall detection efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of code clone detection, and in particular to a smart contract code clone detection method that integrates symbolic representation and graph representation. Background Art

[0002] In smart contract development, developers often reuse code frequently to avoid reinventing the wheel and reduce development workload. Code reuse can help developers accelerate the API learning curve and provide fast bug fixes, but it can also lead to the spread of bugs and defects, affecting the reliability and maintainability of the code base.

[0003] In order to reduce the risks brought by code reuse, researchers are committed to detecting code clones. Code clone detection refers to determining whether there are identical or similar source code fragments in two or more programs. According to the degree of code similarity, code clones are usually divided into four categories: 1) completely identical program code; 2) completely reused code except for spaces, comments, variable or function renaming, etc.; 3) code with a small amount of code addition, modification, and deletion operations on the basis of type 2; 4) code with a large amount of code modification on the basis of type 3, but maintaining the same semantics.

[0004] In recent years, researchers have developed many code clone detection technologies and tools. In order to support Solidity, a programming language used to develop smart contracts, recent research has either expanded existing tools or proposed new detection technologies based on the characteristics of smart contracts. Existing smart contract code clone detection technologies are mainly based on similarity comparisons based on code representation methods such as text-based, token-based, tree-based, and graph-based. Figure 1 The present invention is a flowchart of a current symbol-based and graph-based code clone detection process, including: first, preprocessing the code to be detected, and removing uninteresting information as needed. Further, extracting the code into symbol sequence and control flow graph representation respectively. Further, comparing the similarity of symbol sequence or control flow graph by similarity calculation means. Further, defining a detection threshold, and marking the file pairs whose similarity exceeds the threshold as clones.

[0005] Among them, the method based on symbolic representation is very effective in discovering type 1, type 2 and type 3 clones, but it is difficult to discover type 4 clones; the method based on graph representation can effectively discover type 4 clones, but it will produce a large number of false positives and the recognition accuracy is not high.

[0006] Therefore, technicians in this field are committed to developing a smart contract code cloning detection method that integrates symbolic representation and graph representation to solve the above-mentioned problems existing in existing methods. Summary of the invention

[0007] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to discover code clones by integrating symbolic representation and graph representation, thereby solving the deficiency of the prior art in poor accuracy of semantic clones in identifying smart contract codes.

[0008] To achieve the above object, a smart contract code clone detection method integrating symbolic representation and graph representation is provided, characterized in that it comprises the following steps:

[0009] The smart contract code dataset is divided into a training dataset and a test dataset, and the training dataset is manually annotated to obtain the manually annotated code cloning results;

[0010] Pair the code files in the training data set in pairs to obtain code file pairs of the training data set;

[0011] Use a code clone detection tool based on symbolic representation to calculate the similarity of code file pairs in the training data set, and obtain the symbolic representation-based similarity of each pair of code files;

[0012] Grouping code file pairs of the training dataset using the symbolic representation-based similarity of each pair of code files;

[0013] Use a graph-based code clone detection tool to calculate the similarity of the code file pairs in each group after grouping, and obtain the graph-based similarity of each code file pair in each group;

[0014] Using the graph-based similarity of each code file pair in each group, combined with the manually annotated code clone results, the detection threshold of each group that is subsequently used in the graph-based code clone detection tool is calculated;

[0015] The code file pairs of the data set to be detected are preprocessed to obtain the first clone detection results, and then grouped and similarity calculated to obtain the similarity based on the graph representation, and combined with the detection threshold of each group of code clone detection tools based on the graph representation, the second clone detection results of the code file pairs in each group are obtained;

[0016] Summarize the first clone detection result and the second clone detection result of the code file pair in each group and the clone detection result of the code file pair in each group to obtain a clone report;

[0017] According to clone reports, when new smart contract code flaws are announced, flawed code is found to be reused in different smart contracts.

[0018] Furthermore, the manually annotated code cloning results are represented by whether the code files in the training data set are clones of each other.

[0019] Furthermore, the similarity of each pair of code files in each group is used in combination with the manually annotated code clone results to calculate the detection threshold of each group of graph-based code clone detection tools, including:

[0020] Using the similarity of each pair of code files in each group and the manually annotated code cloning results, we calculate the F1 score of each group at each value in the [0,1] interval with a step size of 0.01. We select the value in the [0,1] interval corresponding to the maximum F1 score in each group as the detection threshold of each group of graph-based code clone detection tools.

[0021] Furthermore, the code file of the data set to be detected is preprocessed to obtain a first clone detection result, including:

[0022] Pair the code files of the data set to be tested in pairs to obtain code file pairs of the data set to be tested;

[0023] Use the symbolic representation-based code clone detection tool to calculate the similarity of the code file pairs in the detection dataset, and obtain the symbolic representation-based similarity S of each pair of code files. 1 ;

[0024] The similarity S between each pair of code files is calculated using the threshold S_token specified by the code clone detection tool based on symbolic representation 1 Compare, if S 1 If it is greater than S_token, the pair of code files is determined to be cloned, otherwise it is determined to be non-cloned, and the first clone detection result is obtained.

[0025] Furthermore, grouping and similarity calculation are performed to obtain similarity based on graph representation, including:

[0026] According to the symbolic similarity S of each pair of code files, 1 Grouping the code file pairs corresponding to non-clones in the first clone detection result;

[0027] Use the graph-based code clone detection tool to calculate the similarity of the code file pairs in each group after grouping, and obtain the graph-based similarity S 2 .

[0028] Furthermore, the second clone detection results of the code file pairs in each group include:

[0029] Similarity S based on graph representation 2 If it is greater than the detection threshold of each set of graph-based code clone detection tools, it is determined to be a clone, otherwise it is determined to be a non-clone.

[0030] A computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement any of the above-mentioned smart contract code cloning detection methods that integrate symbolic representation and graphical representation.

[0031] The present invention uses symbolic similarity to group code file pairs of the data set to be detected, and selects the most suitable threshold of the smart contract code clone detection tool based on graph representation for each group of code file pairs after grouping; compared with the prior art, the present invention can achieve more accurate detection effect on the semantic clone of smart contracts, while reducing unnecessary graph-based operations, improving the overall detection efficiency, and adaptively adjusting the detection threshold according to data characteristics, improving detection adaptability, and has good foresight and reference value.

[0032] Compared with the prior art, the present invention has the following advantages:

[0033] 1. By integrating symbolic representation and graphical representation, the present invention can more accurately detect semantic cloning problems in smart contract codes, making up for the defect of insufficient accuracy of existing technologies in identifying semantic cloning in smart contract codes.

[0034] 2. Through the parameter optimization process of the training data set, the selection of the graph detection threshold is guided by symbol similarity, and the threshold can be adaptively adjusted according to the specific data characteristics, thereby improving the adaptability of the detection.

[0035] 3. Further using graph detection methods based on symbol similarity screening can reduce unnecessary graph detection operations and improve overall detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of the current code clone detection process based on symbolic representation and graph representation;

[0037] Figure 2 It is a flow chart of the smart contract code clone detection method integrating symbolic representation and graphical representation of the present invention;

[0038] Figure 3 The improvement chart of precision, recall rate and F1 score of the present invention compared with the direct combination of the clone detection tool based on symbolic representation and the clone detection tool based on graph representation. DETAILED DESCRIPTION

[0039] The present invention is further described in detail below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention but not to limit the scope of the present invention.

[0040] In traditional smart contract code clone detection methods, type 4 semantic clones cannot be identified or have low accuracy. Figure 1 As shown in the figure, the current smart contract code clone detection method based on symbolic representation is to convert the code into a symbol sequence after deleting comments and renaming variables in the code file, and compare the similarity between the symbol sequences. At the same time, a threshold S_token is given, and the code pairs with similarity between the symbol sequences greater than the threshold S_token are marked as clones. This clone detection method can produce excellent results for type 1, type 2, and type 3 clones, but it is difficult to identify type 4 clones. Figure 1 As shown, the current smart contract code clone detection method based on graph representation is to delete comments from the code file, rename variables and perform other preprocessing operations, convert the code into a control flow graph, compare the similarity between the control flow graphs, and at the same time give a threshold S_graph, mark the code pairs whose similarity between the control flow graphs is greater than the threshold S_graph as clones. This recognition method can identify type 4 clones, but the detection accuracy is low. At the same time, the detection accuracy of type 1, type 2, and type 3 clones is not as good as the smart contract code clone detection method based on symbolic representation. The two types of code clone detection methods are highly complementary. The present invention proposes a smart contract code clone detection method that integrates symbolic representation and graph representation. While accurately identifying type 1, type 2, and type 3 clones, the detection accuracy of type 4 clones is greatly improved, far exceeding the effect of directly combining the two tools.

[0041] like Figure 2 As shown, the specific technical solution provided by the present invention is as follows:

[0042] Step A: Preparation of clone detection tools and datasets;

[0043] In one embodiment, the preparation process is performed in the following manner.

[0044] Obtain the source code and bytecode of the Ethereum smart contract from the Ethereum browser to obtain the smart contract data set. The number of samples that can represent the data set is obtained by calculating the 95% confidence level and the 5% error range. The training data set is obtained by random sampling.

[0045] Manually annotate the training data set to obtain manually annotated code cloning results;

[0046] Furthermore, the manually labeled code clone results are represented by whether the code files in the training data set are clones of each other.

[0047] Select an existing smart contract code clone detection method based on symbolic representation, with a similarity threshold of S_token; select an existing smart contract code clone detection method based on graph representation;

[0048] Step B: Use the training dataset to optimize the threshold parameters of the graph-based smart contract code clone detection method;

[0049] In one embodiment, the parameter optimization process is performed in the following manner.

[0050] B1. Pair the code files in the training data set in pairs to obtain code file pairs of the training data set;

[0051] B2. For the code file pairs of the training data set obtained in step B1, the similarity is calculated using the clone detection method based on symbolic representation selected in step A to obtain the symbolic similarity S of each pair of code files. 1 ;

[0052] B3. With a step size of 0.1, sort the files according to S 1 The code files are grouped into the groups they belong to. For example, if the similarity of a code file pair based on symbolic representation is 0.55, it is classified into the 6th group.

[0053] B4. For the grouped file pairs, calculate their similarity using the graph-based smart contract code clone detection method selected in step A. Combined with the manually annotated code clone results obtained in step A, calculate the F1 score of each group at each value in the [0,1] interval with a step size of 0.01. Select the value in the [0,1] interval corresponding to the maximum F1 score in each group as the detection threshold of each group of graph-based code clone detection tools;

[0054] The F1 score is calculated as follows: F1 score = 2*accuracy + recall / (accuracy + recall); the accuracy is calculated as follows: accuracy = true positive / (true positive + false positive), recall = true positive / (true positive + false negative); true positive means that under this threshold, the detection result is judged to be a clone, and the manual judgment result is also a clone; false positive means that under this threshold, the detection result is judged to be a clone, but the manual judgment result is not a clone; false negative means that under this threshold, the detection result is judged not to be a clone, but the manual judgment result is a clone.

[0055] Step C: Combine the detection thresholds of each group of graph-based smart contract code clone detection tools obtained in the parameter optimization process to complete the smart contract code clone detection process that integrates symbolic representation and graph representation.

[0056] In one embodiment, the process of clone detection is performed in the following manner.

[0057] C1. Pair the files in the dataset to be detected into pairs, and use the symbolic representation-based clone detection method selected in step A to calculate the symbolic representation-based similarity S of each pair of code files. 1 ;

[0058] C2. Determine the similarity S based on symbolic representation 1 Is it greater than the threshold S_token of the smart contract clone detection method based on symbolic representation? If so, it is determined to be a clone; if not, it is determined to be a non-clone;

[0059] C3. Similarity S based on symbolic representation obtained in step C1 1 , group the file pairs determined as non-clone in step C2 with a step size of 0.1, and the grouping method is the same as described in step B3;

[0060] C4. For each group of code file pairs after grouping, use the graph-based code clone detection tool selected in step A to calculate the graph-based similarity S of each pair of code files 2 ;

[0061] C5. Combine the detection thresholds of each set of graph-based code clone detection tools obtained in step B to determine the graph-based similarity S 2 Is it greater than the threshold? If so, it is determined to be a clone; if not, it is determined to be a non-clone;

[0062] C6. Summarize all file pairs determined to be clones in steps C2 and C5 to obtain a clone report.

[0063] To explain the difference between the fusion detection method provided by the present invention and the direct combination of the detection tool based on symbolic representation and the detection tool based on graph representation, the improvement of the present invention is quantified using the accuracy, recall rate and F1 score. The results are as follows: Figure 3 The fusion detection method provided by the present invention greatly improves the accuracy rate, from 29.5% to 46.4%; the recall rate decreases slightly, from 89.1% to 87.7%; and the F1 score increases significantly, from 0.4433 to 0.6070.

[0064] The above implementation is only used to illustrate the technical solution of the present invention rather than to limit it. Ordinary technicians in this field can modify or replace the technical solution of the present invention with equivalents without departing from the scope of the present invention. The protection scope of the present invention shall be based on the claims.

Claims

1. A smart contract code clone detection method integrating symbolic representation and graph representation, characterized in that: The following steps are involved: S1: Divide the smart contract code dataset into a training dataset and a test dataset, manually annotate the training dataset, and obtain the code cloning result; S2: Pair the code files in the training data set in pairs to obtain code file pairs of the training data set; Use a code clone detection tool based on symbolic representation to calculate the similarity of code file pairs in the training data set to obtain the similarity of each pair of code files; Use the similarity of each pair of code files to group the code file pairs in the training dataset; Use a graph-based code clone detection tool to calculate the similarity of the code file pairs in each group after grouping, and obtain the similarity of each code file pair in each group; Using the similarity of each pair of code files in each group, combined with the code cloning result obtained in step S1, the detection threshold of each group of graph-based code cloning detection tools is calculated; S3: Preprocess the code file pairs of the data set to be detected to obtain the first clone detection result, then perform grouping and similarity calculation to obtain the similarity, and combine the detection threshold of each group of graph-based code clone detection tools obtained in step S2 to obtain the second clone detection result of the code file pairs in each group; Summarize the first clone detection result and the second clone detection result of the code file pair in each group and the clone detection result of the code file pair in each group to obtain a clone report; S4: According to the clone report, when new smart contract code defects are announced, defective codes are found to be reused in different smart contracts.

2. The smart contract code clone detection method integrating symbolic representation and graphical representation according to claim 1 is characterized in that: In step S1, the code cloning result is represented by whether the code files in the training data set are clones of each other.

3. The smart contract code clone detection method integrating symbolic representation and graphical representation according to claim 1 is characterized in that: In step S2, the detection threshold of each group of graph-based code clone detection tools is calculated by using the similarity of each pair of code files in each group and combining it with the code clone results obtained in step S1, which specifically includes: Using the similarity of each pair of code files in each group, combined with the code cloning results obtained in step S1, calculate the F1 score of each group at each value in the traversal [0,1] interval, and select the value in the [0,1] interval corresponding to the maximum F1 score in each group as the detection threshold of each group of graph-based code clone detection tools.

4. The smart contract code clone detection method integrating symbolic representation and graphical representation according to claim 1 is characterized in that: In step S3, the code file of the data set to be detected is preprocessed to obtain a first clone detection result, which specifically includes: S3.1: Pair the code files of the data set to be tested in pairs to obtain code file pairs of the data set to be tested; S3.2: Use the code clone detection tool based on symbolic representation to calculate the similarity of the code file pairs in the detection data set to obtain the similarity of each pair of code files; S3.3: Compare the similarity of each pair of code files with the threshold specified by the symbolic representation-based code clone detection tool. If the similarity is greater than the threshold specified by the symbolic representation-based code clone detection tool, determine that the pair of code files is a clone; otherwise, determine that they are not clones, and obtain the first clone detection result.

5. The smart contract code clone detection method integrating symbolic representation and graphical representation according to claim 4 is characterized in that: In step S3, grouping and similarity calculation are then performed to obtain similarity, which specifically includes: S3.4: grouping the code file pairs corresponding to non-clones in the first clone detection result according to the similarity of each pair of code files obtained in step S3.2; S3.5: Use a graph-based code clone detection tool to calculate the similarity of the code file pairs in each group after grouping.

6. The smart contract code clone detection method integrating symbolic representation and graphical representation according to claim 1 is characterized in that: In step S3, the second clone detection results of the code file pairs in each group include: If the similarity is greater than the detection threshold of each group of graph-based code clone detection tools obtained in step S2, it is determined to be a clone; otherwise, it is determined to be a non-clone.

Images