Method for analyzing Ethereum attack and generating attack report by using large language model

Abstract

The invention discloses a method for analyzing an Ethereum attack and generating an attack report by using a large language model, and relates to the technical field of model analysis, and the method comprises the following steps: obtaining and inputting attack transactions: firstly, collecting potential attack transactions from an Ethereum network by deploying node monitoring, all new transactions and blocks on the block chain are monitored in real time, transactions similar to known attack modes are automatically identified, the transaction modes are analyzed to identify abnormal or suspicious transaction behaviors, and the efficient screening process can accurately select transactions related to malicious behaviors of the smart contract, so that the efficiency is improved. These transactions will then serve as base data for subsequent analysis processes. According to the method for analyzing the Ethereum attack and generating the attack report by using the large language model, through introduction of the large language model, the workload of manual review is greatly reduced, automation and intelligence of attack transaction analysis are realized, and the analysis efficiency is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of model analysis technology, and in particular to a method for analyzing Ethereum attacks using a large language model and generating an attack report. Background Art

[0002] As blockchain technology continues to develop, the frequency and complexity of smart contract-based attacks have increased significantly. In-depth analysis of these attacks and the generation of detailed attack reports require a lot of manual review, which consumes a lot of time and resources. Despite the increasing incidence of such incidents, there are still significant deficiencies in efficient and automated analysis methods. The rise of large language models and their enhanced reasoning capabilities provide a promising avenue for improving attack analysis.

[0003] In the existing technology, some works try to use large models to directly scan source code to find vulnerabilities in contracts. This type of method focuses on discovering potential security issues from the perspective of code static analysis; at the same time, another type of method uses large models to generate code descriptions of contracts, trying to improve the ability to understand and interpret code through descriptive analysis. However, these methods usually ignore the in-depth understanding of the attack transaction itself, and often only focus on code-level analysis. In addition, there are also individual works that use general transaction data to train large models in order to identify abnormal transactions, but they also lack detailed analysis of specific attack behaviors.

[0004] Existing research has fully demonstrated the great potential of large language models in smart contract security analysis, but its application in Ethereum attack analysis and description has not been fully developed. Current methods usually rely on specific data flow templates to understand and identify attack transactions, and then manually write attack reports, which is not only inefficient but also difficult to cope with large-scale analysis needs. As the complexity of attack transactions continues to increase, existing attack identification templates gradually lose their effectiveness. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a method for analyzing Ethereum attacks and generating attack reports using a large language model, which solves the problems mentioned in the above background technology.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: A method for analyzing Ethereum attacks and generating attack reports using a large language model, comprising:

[0007] Acquisition and input of attack transactions: First, potential attack transactions are collected from the Ethereum network by deploying node monitoring. This monitoring connects to the full node of Ethereum and monitors all new transactions and blocks on the blockchain in real time. It automatically identifies transactions similar to known attack patterns and analyzes transaction patterns to identify abnormal or suspicious transaction behaviors. This efficient screening process can accurately select transactions involving malicious behaviors of smart contracts, which will then serve as the basic data for subsequent analysis processes.

[0008] Integration of smart contracts and attack knowledge: Through a pre-built attack knowledge base, it integrates the smart contract information related to known attacks and historical attack behavior characteristics, providing rich contextual information for the large language model, enabling it to better understand and analyze complex attack scenarios and establish maintenance and update mechanisms. In addition, the system also uses machine learning algorithms to continuously learn and refine knowledge from actual attack data to ensure that the knowledge base is always at the forefront and can identify and combat the latest attack methods and vulnerabilities;

[0009] Transaction static analysis: After obtaining the attack transaction data, the first step is to conduct transaction static analysis. The main task of static analysis is to extract the function call flow information in the transaction. This step analyzes each operation in the transaction, identifies the called smart contract function and its corresponding parameters, and establishes a complete call chain. This information lays the foundation for subsequent function code extraction and large model input;

[0010] Function code extraction: After completing the static analysis of the transaction, the system further extracts the function code information related to the transaction. In this way, the system can more accurately grasp the code logic in the attack transaction and provide more detailed and reliable input data for the large language model;

[0011] Large model analysis: Function call flow information, extracted function codes, and related attack knowledge base data are input into the large language model. Combined with carefully designed prompt words, the large model can perform deep reasoning on the input data and generate corresponding attack analysis reports. The powerful reasoning ability of the large language model enables it to efficiently identify and describe complex attack behaviors and generate structured report content.

[0012] Generate attack analysis report: Finally, the attack analysis report generated by the large language model will be presented to the user in a clear and easy-to-understand format.

[0013] Preferably, the report content is divided into four main parts: background introduction, on-chain attack information, specific attack analysis, and attack summary and mitigation measures.

[0014] Preferably, the background introduction includes basic background knowledge and project background. The basic background knowledge is intended to ensure that non-professionals can fully understand the content of the report, and this goal is achieved by explaining core concepts such as Ethereum and transactions in detail. The project background provides relevant information about the attacked project to help users understand the background and context of the attack.

[0015] Preferably, the on-chain attack information details the attack transaction hash, attacker address, and victim project address involved, providing users with specific on-chain data about the attack.

[0016] Preferably, the attack specifically analyzes, displays and analyzes the key steps of the attack, including visual display and in-depth analysis of the causes of the attack, describes in detail the behavioral characteristics of the attacking transactions and the smart contract vulnerabilities involved, and emphasizes the possible security impact.

[0017] Preferably, the attack summary and mitigation measures summarize the core content and results of the attack and propose corresponding mitigation measures, aiming to provide strategies and suggestions to help prevent similar attacks in the future.

[0018] Preferably, the maintenance and update mechanism includes automatically collecting the latest attack cases and security advisories.

[0019] Preferably, during the function code extraction process, if the smart contract involved is open source, its code can be directly obtained for analysis.

[0020] Beneficial Effects

[0021] The present invention provides a method for analyzing Ethereum attacks and generating attack reports using a large language model. Compared with the prior art, it has the following beneficial effects:

[0022] (1) This method of using a large language model to analyze Ethereum attacks and generate attack reports greatly reduces the workload of manual review through the introduction of a large language model, realizes the automation and intelligence of attack transaction analysis, and significantly improves the analysis efficiency.

[0023] (2) This method of using a large language model to analyze Ethereum attacks and generate attack reports can more accurately understand complex attack behaviors and reduce false positives and negatives by utilizing a rich attack knowledge base and comprehensive function call flow information.

[0024] (3) This method of using a large language model to analyze Ethereum attacks and generate attack reports is not only applicable to existing simple attack transaction analysis, but can also cope with increasingly complex attack scenarios, thereby improving the adaptability and scalability of the overall analysis system.

[0025] In summary, the present invention proposes a method for understanding Ethereum attacks and generating attack reports using a large language model, aiming to help users analyze attacks on the Ethereum blockchain more efficiently. The method first manually analyzes existing attack reports to construct a knowledge base of Ethereum attack features, and inputs it into the large model as pre-knowledge. For the attack transaction to be analyzed, its function call information is first extracted, and then the specific called contract function and related parameter information are analyzed. For open source smart contracts, its function body code information will be further extracted. Next, the function call information, the corresponding function code information and prompt words are input into the large model together to generate a corresponding attack analysis report. This method can effectively improve the automation level of Ethereum attack analysis, reduce manual intervention, and improve the efficiency and accuracy of report generation. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A flowchart provided for the method of analyzing Ethereum attacks and generating attack reports using a large language model of the present invention;

[0027] Figure 2 This is a flow chart of the Ethereum attack transaction analysis report of the method of the present invention using a large language model to analyze Ethereum attacks and generate attack reports. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] See also Figure 1-Figure 2 The present invention provides a technical solution: a method for analyzing Ethereum attacks and generating attack reports using a large language model, comprising:

[0030] Acquisition and input of attack transactions: First, potential attack transactions are collected from the Ethereum network by deploying node monitoring. This monitoring connects to the full node of Ethereum and monitors all new transactions and blocks on the blockchain in real time. It automatically identifies transactions similar to known attack patterns and analyzes transaction patterns to identify abnormal or suspicious transaction behaviors. This efficient screening process can accurately select transactions involving malicious behaviors of smart contracts, which will then serve as the basic data for subsequent analysis processes.

[0031] Integration of smart contracts and attack knowledge: A pre-built attack knowledge base is integrated with smart contract information related to known attacks and historical attack behavior characteristics, providing rich contextual information for the large language model, enabling it to better understand and analyze complex attack scenarios. In order to ensure the real-time and accuracy of the knowledge base, a maintenance and update mechanism is established, including automatic collection of the latest attack cases and security notifications, and regular inclusion of new attack methods and vulnerabilities through manual review and contribution by security experts. In addition, the system also uses machine learning algorithms to continuously learn and refine knowledge from actual attack data to ensure that the knowledge base is always at the forefront and can identify and combat the latest attack methods and vulnerabilities;

[0032] Transaction static analysis: After obtaining the attack transaction data, the first step is to conduct transaction static analysis. The main task of static analysis is to extract the function call flow information in the transaction. This step analyzes each operation in the transaction, identifies the called smart contract function and its corresponding parameters, and establishes a complete call chain. This information lays the foundation for subsequent function code extraction and large model input;

[0033] Function code extraction: After completing the static analysis of the transaction, the system further extracts the function code information related to the transaction. If the smart contract involved is open source, its code can be directly obtained for analysis. In this way, the system can more accurately grasp the code logic in the attack transaction and provide more detailed and reliable input data for the large language model;

[0034] Large model analysis: Function call flow information, extracted function codes, and related attack knowledge base data are input into the large language model. Combined with carefully designed prompt words, the large model can perform deep reasoning on the input data and generate corresponding attack analysis reports. The powerful reasoning ability of the large language model enables it to efficiently identify and describe complex attack behaviors and generate structured report content.

[0035] Generate attack analysis report: Finally, the attack analysis report generated by the large language model will be presented to the user in a clear and easy-to-understand format;

[0036] The report is divided into four main parts:

[0037] Background: This includes basic background knowledge and project background. Basic background knowledge aims to ensure that non-professionals can fully understand the report content. This goal is achieved by explaining core concepts such as Ethereum and transactions in detail. Project background provides relevant information about the attacked project to help users understand the background and context of the attack.

[0038] On-chain attack information: details the attack transaction hash, attacker address, and victim project address involved, providing users with specific on-chain data about the attack;

[0039] Detailed analysis of the attack: Demonstrates and analyzes the key steps of the attack, including visual display and in-depth analysis of the causes of the attack, describes in detail the behavioral characteristics of the attack transaction and the smart contract vulnerabilities involved, and emphasizes the possible security impact;

[0040] Attack Summary and Mitigation Measures: Summarizes the core content and results of the attack and proposes corresponding mitigation measures, aiming to provide strategies and suggestions to help prevent similar attacks in the future.

[0041] In this technical solution, the Ethereum attack transaction analysis method based on the large language model includes the overall process of using the attack knowledge base, function call flow information and function source code to perform large model analysis; the automatic generation technology of the attack analysis report, especially the intelligent report generation method realized by the large language model; the integration technology of the construction of the attack knowledge base and the transaction function call flow information, and the application of this information in the large language model analysis; through these technical protections, the present invention aims to provide an efficient, accurate and automated solution for the field of blockchain security analysis, and promote the security research and application of Ethereum and other blockchain platforms.

[0042] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0043] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0044] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for analyzing Ethereum attacks and generating attack reports using a large language model, characterized in that: include: Acquisition and input of attack transactions: First, potential attack transactions are collected from the Ethereum network by deploying node monitoring. This monitoring connects to the full node of Ethereum and monitors all new transactions and blocks on the blockchain in real time. It automatically identifies transactions similar to known attack patterns and analyzes transaction patterns to identify abnormal or suspicious transaction behaviors. This efficient screening process can accurately select transactions involving malicious behaviors of smart contracts, which will then serve as the basic data for subsequent analysis processes. Integration of smart contracts and attack knowledge: Through a pre-built attack knowledge base, it integrates the smart contract information related to known attacks and historical attack behavior characteristics, providing rich contextual information for the large language model, enabling it to better understand and analyze complex attack scenarios and establish maintenance and update mechanisms. In addition, the system also uses machine learning algorithms to continuously learn and refine knowledge from actual attack data to ensure that the knowledge base is always at the forefront and can identify and combat the latest attack methods and vulnerabilities; Transaction static analysis: After obtaining the attack transaction data, the first step is to conduct transaction static analysis. The main task of static analysis is to extract the function call flow information in the transaction. This step analyzes each operation in the transaction, identifies the called smart contract function and its corresponding parameters, and establishes a complete call chain. This information lays the foundation for subsequent function code extraction and large model input; Function code extraction: After completing the static analysis of the transaction, the system further extracts the function code information related to the transaction. In this way, the system can more accurately grasp the code logic in the attack transaction and provide more detailed and reliable input data for the large language model; Large model analysis: Function call flow information, extracted function codes, and related attack knowledge base data are input into the large language model. Combined with carefully designed prompt words, the large model can perform deep reasoning on the input data and generate corresponding attack analysis reports. The powerful reasoning ability of the large language model enables it to efficiently identify and describe complex attack behaviors and generate structured report content. Generate attack analysis report: Finally, the attack analysis report generated by the large language model will be presented to the user in a clear and easy-to-understand format.

2. The method for analyzing Ethereum attacks and generating attack reports using a large language model according to claim 1, characterized in that: The report is divided into four main parts: background introduction, on-chain attack information, specific attack analysis, and attack summary and mitigation measures.

3. The method for analyzing Ethereum attacks and generating attack reports using a large language model according to claim 2, characterized in that: The background introduction includes basic background knowledge and project background. The basic background knowledge is intended to ensure that non-professionals can fully understand the content of the report. This goal is achieved by explaining core concepts such as Ethereum and transactions in detail. The project background provides relevant information about the attacked project to help users understand the background and context of the attack.

4. The method for analyzing Ethereum attacks and generating attack reports using a large language model according to claim 2, characterized in that: The on-chain attack information details the attack transaction hashes, attacker addresses, and victim project addresses involved, providing users with specific on-chain data about the attack.

5. The method for analyzing Ethereum attacks and generating attack reports using a large language model according to claim 2, characterized in that: The attack is specifically analyzed, showing and analyzing the key steps of the attack, including visual display and in-depth analysis of the causes of the attack, describing in detail the behavioral characteristics of the attacking transactions and the smart contract vulnerabilities involved, while emphasizing the possible security impact.

6. The method for analyzing Ethereum attacks and generating attack reports using a large language model according to claim 2, characterized in that: The attack summary and mitigation measures summarize the core content and results of the attack and propose corresponding mitigation measures, aiming to provide strategies and suggestions to help prevent similar attacks in the future.

7. The method for analyzing Ethereum attacks and generating attack reports using a large language model according to claim 1, characterized in that: The maintenance and update mechanism includes automatically collecting the latest attack cases and security advisories.

8. The method for analyzing Ethereum attacks and generating attack reports using a large language model according to claim 1, characterized in that: During the function code extraction process, if the smart contract involved is open source, its code can be directly obtained for analysis.

Images