A Smart Contract Code Cloning Detection Method Integrating Symbolic and Graph Representations

Abstract

This invention discloses a smart contract code clone detection method that integrates symbolic representation and graph representation, belonging to the field of code clone detection technology. The method includes: dividing the dataset into a training dataset and a dataset to be detected; grouping code file pairs using similarity calculated by a symbolic representation-based detection method; determining the most suitable threshold for the graph representation-based detection method for each group by maximizing the F1 score; and using this threshold for subsequent detection. This invention can more accurately detect semantic clone problems in smart contract code, overcoming the shortcomings of existing technologies in accurately identifying semantic clones in smart contract code, while reducing unnecessary graph detection operations and improving overall detection efficiency.

Description

Technical Field

[0001] This invention relates to the field of code clone detection technology, and specifically to a smart contract code clone detection method that integrates symbolic representation and graph representation. Background Technology

[0002] In smart contract development, developers often reuse code frequently to avoid reinventing the wheel and reduce development workload. Code reuse can help developers accelerate the API learning curve and provide rapid vulnerability fixes, but it can also lead to the propagation of vulnerabilities and defects, thereby affecting the reliability and maintainability of the codebase.

[0003] To reduce the risks associated with code reuse, researchers are dedicated to detecting code clones. Code clone detection refers to determining whether two or more programs contain identical or similar source code segments. Based on the degree of code similarity, code clones are generally classified into four categories: 1) Completely identical program code; 2) Completely reused code except for spaces, comments, variable or function renaming; 3) Code with minor additions, modifications, or deletions based on type two; 4) Code with extensive modifications based on type three, maintaining semantic similarity.

[0004] In recent years, researchers have developed numerous code clone detection technologies and tools. To support Solidity, the programming language used for developing smart contracts, recent research has either extended existing tools or proposed new detection technologies based on the characteristics of smart contracts. Existing smart contract code clone detection technologies mainly compare similarity based on code representations such as text-based, token-based, tree-based, and graph-based methods. Figure 1 This is a schematic diagram of a current symbol-based and graph-based code clone detection process, including: First, preprocessing the code to be detected, removing irrelevant information as needed. Next, extracting the code into symbol sequences and control flow graph representations. Next, comparing the similarity of the symbol sequences or control flow graphs using similarity calculation methods. Next, defining a detection threshold, marking file pairs with similarity exceeding the threshold as clones.

[0005] The symbol-based method is very effective in detecting clones of type 1, type 2 and type 3, but it is difficult to detect clones of type 4. The graph-based method can effectively detect clones of type 4, but it produces a large number of false alarms and has a low recognition accuracy.

[0006] Therefore, those skilled in the art are dedicated to developing a smart contract code clone detection method that integrates symbolic representation and graph representation to solve the aforementioned problems in existing methods. Summary of the Invention

[0007] In view of the above-mentioned deficiencies of the prior art, the technical problem to be solved by the present invention is how to discover code clones by fusing symbolic representation and graph representation, thereby overcoming the shortcomings of the prior art in the poor accuracy of identifying semantic clones in smart contract code.

[0008] To achieve the above objectives, a smart contract code clone detection method integrating symbolic representation and graph representation is characterized by comprising the following steps:

[0009] The smart contract code dataset is divided into a training dataset and a test dataset. The training dataset is manually annotated to obtain the manually annotated code clone results.

[0010] Pair the code files in the training dataset into pairs to obtain code file pairs for the training dataset.

[0011] The similarity of code file pairs in the training dataset was calculated using a symbolic representation-based code clone detection tool to obtain the symbolic representation-based similarity of each pair of code files.

[0012] The code file pairs in the training dataset are grouped using symbol-based similarity for each pair of code files;

[0013] A graph-based code clone detection tool is used to calculate the similarity of code file pairs within each group after grouping, and the graph-based similarity of each code file pair in each group is obtained.

[0014] Using the graph representation-based similarity of each code file pair in each group, combined with manually annotated code clone results, the detection threshold for each group to be subsequently used by the graph representation-based code clone detection tool is calculated.

[0015] The code file pairs in the dataset to be detected are preprocessed to obtain the first clone detection result. Then, grouping and similarity calculation are performed to obtain the similarity based on graph representation. Combined with the detection threshold of the code clone detection tool based on graph representation for each group, the second clone detection result of the code file pairs in each group is obtained.

[0016] The clone report is obtained by summarizing the first clone detection results and the second clone detection results of the code file pairs within each group;

[0017] According to the cloning report, when new smart contract code defects are disclosed, defective code that is reused in different smart contracts is discovered.

[0018] Furthermore, the manually annotated code cloning result is expressed as whether each pair of code files in the training dataset is a clone of the other.

[0019] Furthermore, using the similarity of each code file pair in each group, combined with the manually annotated code clone results, the detection threshold of the graph representation-based code clone detection tool for each group is calculated, including:

[0020] Using the similarity of each code file pair in each group, combined with the manually annotated code clone results, calculate the F1 score for each group under each value in the [0,1] interval with a step size of 0.01. Select the value in the [0,1] interval corresponding to the maximum F1 score in each group as the detection threshold of each group's graph representation-based code clone detection tool.

[0021] Furthermore, the code files of the dataset to be detected are preprocessed to obtain the first clone detection result, including:

[0022] The code files of the dataset to be detected are paired up to obtain code file pairs of the dataset to be detected.

[0023] The symbol-representation-based code clone detection tool is used to calculate the similarity between pairs of code files in the dataset to be detected, and the symbol-representation-based similarity S1 of each pair of code files is obtained.

[0024] The similarity S1 of each pair of code files is compared with the threshold S_token specified by the symbolic code clone detection tool. If S1 is greater than S_token, the pair of code files is determined to be cloned; otherwise, it is determined to be non-clone, and the first clone detection result is obtained.

[0025] Further, grouping and similarity calculations are then performed to obtain graph-representation-based similarity, including:

[0026] Based on the symbol-based similarity S1 of each pair of code files, the non-clone corresponding code file pairs in the first clone detection results are grouped.

[0027] The similarity of code file pairs within each group is calculated using a graph-based code clone detection tool, resulting in a graph-based similarity S2.

[0028] Furthermore, the second clone detection results for each code file pair within each group include:

[0029] If the similarity S2 based on graph representation is greater than the detection threshold of each graph representation-based code clone detection tool, it is determined to be a clone; otherwise, it is determined to be a non-clone.

[0030] A computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the smart contract code clone detection method that integrates symbolic representation and graph representation as described above.

[0031] This invention uses symbolic representation-based similarity to group code file pairs in the dataset to be detected. For each group of code file pairs, the most suitable threshold for a graph representation-based smart contract code clone detection tool is selected. Compared with existing technologies, this invention can achieve more accurate detection of semantic clones of smart contracts, while reducing unnecessary graph representation-based operations and improving overall detection efficiency. At the same time, it adaptively adjusts the detection threshold according to data characteristics to improve detection adaptability, demonstrating good foresight and reference value.

[0032] Compared with the prior art, the present invention has the following advantages:

[0033] 1. By integrating symbolic representation and graph representation, this invention can more accurately detect semantic cloning problems in smart contract code, thus overcoming the shortcomings of existing technologies in accurately identifying semantic cloning in smart contract code.

[0034] 2. By optimizing the parameters of the training dataset and using symbol similarity to guide the selection of the detection threshold, the threshold can be adaptively adjusted according to the specific data characteristics, thereby improving the adaptability of the detection.

[0035] 3. By further using graph detection methods on the basis of symbol similarity screening, unnecessary graph detection operations can be reduced and the overall detection efficiency can be improved. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of a current code clone detection process based on symbolic representation and graph representation;

[0037] Figure 2 This is a flowchart of the smart contract code clone detection method that integrates symbolic representation and graph representation according to the present invention;

[0038] Figure 3 The graph shows the improvement in accuracy, recall, and F1 score compared to a direct combination of the present invention and symbol-based and graph-based clone detection tools. Detailed Implementation

[0039] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0040] Traditional smart contract code clone detection methods often fail to identify type 4 semantic clones or achieve low accuracy. For example... Figure 1 As shown, current smart contract code clone detection methods based on symbolic representation convert code into symbol sequences after preprocessing operations such as deleting comments and renaming variables. They then compare the similarity between these symbol sequences and, given a threshold S_token, mark code pairs whose similarity exceeds S_token as clones. This clone detection method is highly effective for clones of types 1, 2, and 3, but struggles to identify clones of type 4. For example... Figure 1 As shown, current graph-based smart contract code clone detection methods convert code files into control flow graphs after preprocessing operations such as deleting comments and renaming variables. They then compare the similarity between these control flow graphs and, given a threshold S_graph, mark code pairs with a similarity greater than S_graph as clones. This method can identify type 4 clones, but its accuracy is low. Furthermore, its accuracy for detecting type 1, 2, and 3 clones is lower than that of symbol-based smart contract code clone detection methods. These two types of code clone detection methods are highly complementary. This invention proposes a smart contract code clone detection method that integrates symbolic and graph representations. While accurately identifying type 1, 2, and 3 clones, it significantly improves the accuracy for detecting type 4 clones, far exceeding the effect of simply combining the two tools.

[0041] like Figure 2 As shown, the specific technical solution provided by the present invention is as follows:

[0042] Step A: Preparation process for clone detection tools and datasets;

[0043] In one embodiment, the preparation process is carried out in the following manner.

[0044] Obtain the source code and bytecode of Ethereum smart contracts from the Ethereum browser to obtain the smart contract dataset. Calculate the number of samples that can represent the dataset by calculating a 95% confidence level and a 5% error range. Obtain the training dataset by random sampling.

[0045] The training dataset is manually annotated to obtain manually annotated code clones.

[0046] Furthermore, the manually annotated code cloning results are represented as whether each pair of code files in the training dataset is a clone of the other.

[0047] Existing methods for detecting smart contract code clones based on symbolic representation are selected, with a similarity threshold of S_token; existing methods for detecting smart contract code clones based on graph representation are also selected.

[0048] Step B: Optimize the threshold parameters of the graph representation-based smart contract code clone detection method using the training dataset;

[0049] In one embodiment, the parameter optimization process is performed in the following manner.

[0050] B1. Pair the code files in the training dataset to obtain code file pairs for the training dataset;

[0051] B2. For the code file pairs of the training dataset obtained in step B1, calculate the similarity using the symbolic representation-based clone detection method selected in step A, and obtain the symbolic representation-based similarity S1 for each pair of code files;

[0052] B3. Group the file pairs according to the group to which S1 belongs, with a step size of 0.1. For example, if a code file pair has a similarity of 0.55 based on symbol representation, it is classified into group 6.

[0053] B4. For the grouped file pairs, calculate their similarity using the graph representation-based smart contract code clone detection method selected in step A. Combine the manually annotated code clone results obtained in step A, calculate the F1 score for each group under each value in the [0,1] interval with a step size of 0.01. Select the value in the [0,1] interval corresponding to the maximum F1 score in each group as the detection threshold of the graph representation-based code clone detection tool for each group.

[0054] The F1 score is calculated as follows: F1 score = 2 * precision + recall / (precision + recall); precision is calculated as follows: precision = true positives / (true positives + false positives); recall is calculated as follows: true positives / (true positives + false negatives); a true positive means that at this threshold, both the test result and the manual judgment result are considered to be clones; a false positive means that at this threshold, the test result is considered to be clones, but the manual judgment result is not considered to be clones; a false negative means that at this threshold, the test result is not considered to be clones, but the manual judgment result is considered to be clones.

[0055] Step C: Combine the detection thresholds of each set of graph-based smart contract code clone detection tools obtained from the parameter optimization process to complete the smart contract code clone detection process that integrates symbolic representation and graph representation.

[0056] In one embodiment, the clone detection process is performed in the following manner.

[0057] C1. Pair the files in the dataset to be detected into file pairs, and use the symbol representation-based clone detection method selected in step A to calculate the symbol representation-based similarity S1 of each pair of code files;

[0058] C2. Determine whether the similarity S1 based on symbolic representation is greater than the threshold S_token of the smart contract clone detection method based on symbolic representation. If yes, it is determined to be a clone; otherwise, it is determined to be a non-clone.

[0059] C3. Based on the symbol-based similarity S1 obtained in step C1, the file pairs determined to be non-cloned in step C2 are grouped with a step size of 0.1, and the grouping method is the same as described in step B3.

[0060] C4. For each group of code file pairs, use the graph-based code clone detection tool selected in step A to calculate the graph-based similarity S2 of each pair of code files;

[0061] C5. Combining the detection thresholds of each group of graph representation-based code clone detection tools obtained in step B, determine whether the graph representation-based similarity S2 is greater than the threshold. If it is, it is determined to be a clone; otherwise, it is determined to be a non-clone.

[0062] C6. Summarize all file pairs identified as clones in steps C2 and C5 to obtain a clone report.

[0063] To explain the performance difference between the fusion detection method provided by this invention and the direct combination of symbol-based and graph-based detection tools, the improvement of this invention is quantified using accuracy, recall, and F1 score. The results are as follows: Figure 3 As shown. The fusion detection method provided by this invention significantly improves accuracy, from 29.5% to 46.4%; the recall rate decreases only slightly, from 89.1% to 87.7%; and the F1 score is greatly improved, from 0.4433 to 0.6070.

[0064] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention without departing from the scope of the present invention. The scope of protection of the present invention should be determined by the claims.

Claims

1. A method for detecting smart contract code clones that integrates symbolic representation and graph representation, characterized in that, Includes the following steps: S1: Divide the smart contract code dataset into a training dataset and a test dataset. Manually annotate the training dataset to obtain the code cloning result. S2: Pair the code files in the training dataset into pairs to obtain code file pairs for the training dataset; A symbol-based code clone detection tool was used to calculate the similarity between pairs of code files in the training dataset, and the similarity of each pair of code files was obtained. The code file pairs in the training dataset are grouped based on the similarity of each pair of code files; A graph-based code clone detection tool is used to calculate the similarity of code file pairs within each group after grouping, so as to obtain the similarity of each code file pair in each group. Using the similarity of each code file pair in each group, combined with the code clone results obtained in step S1, the detection threshold of the graph representation-based code clone detection tool for each group is calculated. S3: After preprocessing the code file pairs of the dataset to be detected, the first clone detection result is obtained. Then, grouping and similarity calculation are performed to obtain the similarity. Combined with the detection threshold of the graph-based code clone detection tool for each group obtained in step S2, the second clone detection result of the code file pairs in each group is obtained. The clone report is obtained by summarizing the first clone detection results and the second clone detection results of the code file pairs within each group; S4: According to the cloning report, when new smart contract code defects are disclosed, defective code that is reused in different smart contracts is discovered.

2. The smart contract code clone detection method integrating symbolic representation and graph representation according to claim 1, characterized in that, In step S1, the code cloning result is indicated by whether each pair of code files in the training dataset is a clone of the other.

3. The smart contract code clone detection method integrating symbolic representation and graph representation according to claim 1, characterized in that, In step S2, the similarity of each code file pair in each group is used, combined with the code clone results obtained in step S1, to calculate the detection threshold of each group of graph-based code clone detection tools. Specifically, this includes: Using the similarity of each code file pair in each group, combined with the code clone results obtained in step S1, calculate the F1 score of each group under each value in the [0,1] interval, and select the value in the [0,1] interval corresponding to the maximum F1 score in each group as the detection threshold of each group's graph-based code clone detection tool.

4. The smart contract code clone detection method integrating symbolic representation and graph representation according to claim 1, characterized in that, In step S3, the code file of the dataset to be detected is preprocessed to obtain the first clone detection result, specifically including: S3.1: Pair the code files of the dataset to be detected into pairs to obtain code file pairs of the dataset to be detected; S3.2: Use a symbolic representation-based code clone detection tool to calculate the similarity between pairs of code files in the dataset to be detected, and obtain the similarity of each pair of code files; S3.3: Compare the similarity of each pair of code files with the threshold specified by the symbol-based code clone detection tool. If the similarity is greater than the threshold specified by the symbol-based code clone detection tool, the pair of code files is determined to be clones; otherwise, it is determined to be non-clones, and the first clone detection result is obtained.

5. The smart contract code clone detection method integrating symbolic representation and graph representation according to claim 4, characterized in that, In step S3, grouping and similarity calculation are then performed to obtain the similarity score, specifically including: S3.4: Based on the similarity of each pair of code files obtained in step S3.2, group the non-cloned code file pairs in the first clone detection results; S3.5: Use a graph-based code clone detection tool to calculate the similarity of code file pairs within each group after grouping.

6. The smart contract code clone detection method based on the fusion of symbolic representation and graph representation according to claim 1, characterized in that, In step S3, the second clone detection results for each code file pair within a group include: If the similarity is greater than the detection threshold of the graph-based code clone detection tool obtained in step S2, it is determined to be a clone; otherwise, it is determined to be a non-clone.

Images