Block chain attack detection method and device
By converting transaction logs into transaction and complex semantics, the method effectively detects blockchain attacks in real-time, improving accuracy and reducing costs compared to existing methods.
Patent Information
- Application Number
- CN202411028353.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-29
- Publication Date
- 2025-01-03
AI Technical Summary
Existing methods for detecting blockchain attacks are either inaccurate or require costly and difficult-to-obtain high-quality labeled training samples, and they struggle to detect attacks in real-time or outside of static contract vulnerabilities.
A method that converts transaction logs into transaction semantics and complex semantics based on predefined semantic elements to identify potential blockchain attacks, allowing for real-time monitoring and reducing the need for extensive training data.
This approach enhances the detection of blockchain attacks by providing accurate, real-time monitoring and reducing data costs, capable of identifying various attack types beyond static contract vulnerabilities.
Smart Images
Figure CN119249467A_ABST
Abstract
Description
Technical Field
[0001] One or more embodiments of this specification relate to the field of blockchain technology, and more particularly, to a method and device for detecting blockchain attacks. Background Art
[0002] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. In the blockchain system, data blocks are combined into a chain data structure in a sequential manner according to time order, and a distributed ledger that cannot be tampered with or forged is guaranteed by cryptography. Due to the characteristics of blockchain such as decentralization, information cannot be tampered with, and autonomy, blockchain is also receiving more and more attention and application. Summary of the invention
[0003] One or more embodiments of this specification describe a method and device for detecting blockchain attacks, which can improve the detection effect of blockchain attacks, reduce the data cost consumed in detecting blockchain attacks, and solve the shortcomings of the existing technology.
[0004] According to a first aspect, a method for detecting a blockchain attack is provided, comprising:
[0005] Obtaining a transaction log of a target transaction on a target blockchain, and determining transaction semantics corresponding to the multiple function calls respectively according to information corresponding to the multiple function calls in the transaction log and a first semantic set including multiple preset first semantic elements, wherein the transaction semantics includes one or more of the multiple first semantic elements;
[0006] Determine, according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls, the complex semantics including one or more of the multiple second semantic elements, the second semantic elements being determined according to the first semantic elements in at least two function calls;
[0007] It is determined whether there is a risk of a predetermined attack being carried out through the target transaction according to the transaction semantics and the complex semantics.
[0008] In a possible implementation, the multiple first semantic elements include a first element, a second element, and a third element, the first element indicates a called function name, a sender and a receiver of the function call, the second element indicates a call depth corresponding to the function call, and the third element indicates an order of the function calls;
[0009] The multiple second semantic elements include a first composite element and a second composite element, wherein the first composite element indicates that there are two function calls with the same initiator, the same recipient and the same called function name, and the second composite element indicates that there are two function calls with opposite initiators and recipients.
[0010] In a possible implementation, determining the complex semantics respectively included in the multiple function calls according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements includes:
[0011] determining, according to the first element, the second element, and the third element included in the transaction semantics respectively corresponding to the multiple function calls, whether there is a first function call and a second function call in the multiple function calls, the calling order of the first function call is before the second function call, the initiator, the receiver, and the called function name of the first function call and the second function call are the same, and the calling depth of the second function call is not greater than the calling depth of the first function call;
[0012] If the first function call and the second function call exist in the multiple function calls, it is determined that the complex semantics of the second function call includes a first composite element corresponding to the first function call and the second function call.
[0013] In a possible implementation, determining the complex semantics respectively included in the multiple function calls according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements includes:
[0014] determining, according to the first element, the second element, and the third element included in the transaction semantics respectively corresponding to the multiple function calls, whether a first function call and a third function call exist in the multiple function calls, the calling order of the first function call is before the third function call, the initiator and the receiver of the first function call and the third function call are opposite, and the calling depth of the second function call is not greater than the calling depth of the first function call;
[0015] If the first function call and the third function call exist in the multiple function calls, it is determined that the complex semantics of the second function call includes a second composite element corresponding to the first function call and the third function call.
[0016] In a possible implementation, determining whether there is a risk of carrying out a predetermined attack through the target transaction according to the transaction semantics and the complex semantics includes:
[0017] Determine, according to the transaction semantics and the complex semantics, whether the first function call, the second function call, and the third function call among the multiple function calls meet a preset first rule, the complex semantics of the second function call includes a first composite element corresponding to the first function call and the second function call, the complex semantics of the third function call includes a second composite element corresponding to the first function call and the second function call, and the call depth of the second function call is greater than the call depth of the third function call;
[0018] If the first function call, the second function call, and the third function call exist in the multiple function calls, it is determined that there is a risk of a reentrancy attack being carried out through the target transaction.
[0019] In a possible implementation, the multiple first semantic elements include a third element, a fourth element, and a fifth element, the fourth element indicates a function call for token payment, and an initiator, a recipient, a token type, and a token amount of the token payment, the fifth element indicates a function call for token generation, and a liquidity pool, a recipient, a token type, and a token amount of the token generation, and the third element indicates the order of function calls;
[0020] The multiple second semantic elements include a third composite element and a fourth composite element, wherein the third composite element indicates that there are two function calls for transferring the first token into the liquidity pool through the same participating direction and obtaining the second token from the liquidity pool, and the fourth composite element indicates that there are two function calls for transferring the third token into the liquidity pool through the same participating direction and obtaining the liquidity pool token from the liquidity pool.
[0021] In a possible implementation, determining the complex semantics respectively included in the multiple function calls according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements includes:
[0022] According to the third element and the fourth element included in the transaction semantics respectively corresponding to the multiple function calls, determine whether there is a fourth function call for token payment and a fifth function call for token payment in the multiple function calls, the calling order of the fourth function call is before the fifth function call, the initiator and the recipient of the fourth function call and the fifth function call are opposite, the token type and the token amount are different, and the recipient of the fourth function call and the initiator of the fifth function call are the same liquidity pool;
[0023] If the fourth function call and the fifth function call exist in the multiple function calls, it is determined that the complex semantics of the fifth function call includes a third composite element corresponding to the fourth function call and the fifth function call.
[0024] In a possible implementation, determining the complex semantics respectively included in the multiple function calls according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements includes:
[0025] According to the third element, the fourth element and the fifth element included in the transaction semantics respectively corresponding to the multiple function calls, determine whether there is a sixth function call for token payment and a seventh function call for token generation in the multiple function calls, the calling order of the sixth function call is before the seventh function call, the initiator and the recipient of the sixth function call are opposite to those of the seventh function call, the recipient of the sixth function call and the initiator of the seventh function call are the same liquidity pool, and the token type of the seventh function call is the liquidity pool token of the liquidity pool;
[0026] If the sixth function call and the seventh function call exist in the multiple function calls, it is determined that the complex semantics of the seventh function call includes a fourth composite element corresponding to the sixth function call and the seventh function call.
[0027] In a possible implementation, determining whether there is a risk of carrying out a predetermined attack through the target transaction according to the transaction semantics and the complex semantics includes:
[0028] According to the transaction semantics and the complex semantics, determine whether there are a fifth function call, a seventh function call and a ninth function call in the multiple function calls, the complex semantics of the ninth function call includes a third composite element corresponding to the eighth function call and the ninth function call, the complex semantics of the fifth function call includes a fourth composite element corresponding to the fourth function call and the fifth function call, the complex semantics of the seventh function call includes a third composite element corresponding to the sixth function call and the seventh function call, the ninth function call is before the fifth function call, the fifth function call is before the seventh function call, the initiators of the fourth function call, the sixth function call and the eighth function call are the same as the initiator of the same liquidity pool, and the initiators of the fifth function call, the seventh function call and the ninth function call are the same as the liquidity pool;
[0029] If the fifth function call, the seventh function call and the ninth function call exist in the plurality of function calls, it is determined that there is a risk of an indirect control attack being carried out through the target transaction.
[0030] In a possible implementation, the multiple first semantic elements include a first element and a third element, the first element indicates a name of a called function, a sender and a receiver of the function call, the first element further indicates a parameter of the function call, and the third element indicates an order of the function calls;
[0031] The plurality of second semantic elements include a fifth compound element, wherein the fifth compound element indicates that there are two function calls, wherein a calling parameter of one function call includes a calling parameter of another function call.
[0032] In a possible implementation, determining the complex semantics respectively included in the multiple function calls according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements includes:
[0033] determining, according to the first element and the third element included in the transaction semantics respectively corresponding to the multiple function calls, whether there are a tenth function call and an eleventh function call in the multiple function calls, the calling order of the tenth function call is before the eleventh function call, and the calling parameters of the seventh function call include the calling parameters of the eighth function call;
[0034] If the tenth function call and the eleventh function call exist in the multiple function calls, it is determined that the complex semantics of the eleventh function call includes the fifth composite element corresponding to the tenth function call and the eleventh function call.
[0035] In a possible implementation, the plurality of first semantic elements further include a sixth element, and the sixth element indicates that the called function is a preset sensitive function;
[0036] Determining whether there is a risk of implementing a predetermined attack through the target transaction according to the transaction semantics and the complex semantics, including:
[0037] determining, according to the transaction semantics and the complex semantics, whether there are a tenth function call and an eleventh function call in the multiple function calls that meet a predetermined condition, wherein the predetermined condition includes that the complex semantics of the eleventh function call includes a fifth composite element corresponding to the tenth function call and the eleventh function call, and the transaction semantics of the eleventh function call includes a sixth element;
[0038] If there are a tenth function call and an eleventh function call that meet the predetermined condition among the multiple function calls, it is determined that there is a risk of a call injection attack being carried out through the target transaction.
[0039] According to a second aspect, a blockchain attack detection device is provided, the device comprising:
[0040] A transaction semantics determination unit is configured to obtain a transaction log of a target transaction on a target blockchain, and determine transaction semantics corresponding to the multiple function calls respectively according to information corresponding to the multiple function calls in the transaction log and a first semantic set including multiple preset first semantic elements, wherein the transaction semantics includes one or more of the multiple first semantic elements;
[0041] A complex semantics determination unit is configured to determine, according to the transaction semantics respectively corresponding to the multiple function calls and a second semantic set including a plurality of preset second semantic elements, the complex semantics respectively included in the multiple function calls, wherein the complex semantics includes one or more of the plurality of second semantic elements, and the second semantic elements are determined according to the first semantic elements in at least two function calls;
[0042] The risk detection unit is configured to determine whether there is a risk of a predetermined attack being carried out through the target transaction based on the transaction semantics and the complex semantics. According to a third aspect, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed in a computer, the computer executes the method described in the first aspect.
[0043] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method described in the first aspect is implemented. By using one or more of the methods, devices, computing devices, and storage media in the above aspects, the detection effect of blockchain attacks can be significantly improved, and the data cost consumed in detecting blockchain attacks can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.
[0045] Figure 1 A blockchain architecture diagram is shown;
[0046] Figure 2 A schematic diagram showing a detection scheme for a blockchain attack;
[0047] Figure 3 A schematic diagram showing another detection scheme for blockchain attacks;
[0048] Figure 4 A schematic diagram showing a method for detecting a blockchain attack provided by an embodiment of this specification;
[0049] Figure 5 A flowchart showing a method for detecting a blockchain attack provided by an embodiment of this specification is shown;
[0050] Figure 6 A structural diagram of a blockchain attack detection device provided in an embodiment of this specification is shown. DETAILED DESCRIPTION
[0051] The solution provided in this specification is described below in conjunction with the accompanying drawings.
[0052] Figure 1 A diagram of a blockchain architecture is shown. Figure 1 As shown, the blockchain 100 includes, for example, 6 nodes. The lines between the nodes schematically represent P2P (Peer to Peer) connections. These nodes can store the full amount of ledgers, that is, store the status of all blocks and all accounts. Among them, each node in the blockchain generates the same state in the blockchain by executing the same transaction, and each node in the blockchain stores the same state database. It can be understood that Figure 1 Although it is shown that the blockchain includes 6 nodes, the embodiments of this specification are not limited to this, but may include other numbers of nodes. Specifically, the nodes included in the blockchain can meet the Byzantine Fault Tolerance (BFT) requirements. The Byzantine Fault Tolerance requirement can be understood as Byzantine nodes can exist inside the blockchain, but the blockchain does not reflect Byzantine behavior to the outside. In general, some Byzantine fault tolerance algorithms require the number of nodes to be greater than 3f+1, where f is the number of Byzantine nodes, such as the Practical Byzantine Fault Tolerance algorithm PBFT (Practical Byzantine Fault Tolerance).
[0053] Transactions in the blockchain field can refer to task units that are executed and recorded in the blockchain. Transactions usually include a send field (From), a receive field (To), and a data field (Data). Among them, in the case where the transaction is a transfer transaction, the From field indicates the account address that initiates the transaction (i.e., initiates a transfer task to another account), the To field indicates the account address that receives the transaction (i.e., receives the transfer), and the Data field includes the transfer amount. In the case where the transaction calls a smart contract in the blockchain, the From field indicates the account address that initiates the transaction, the To field indicates the account address of the contract called by the exchange, and the Data field includes the function name in the calling contract, and the incoming parameters of the function, etc., which are used to obtain the code of the function from the blockchain and execute the code of the function when the transaction is executed.
[0054] The blockchain can provide the function of smart contracts. Smart contracts on the blockchain are contracts that can be triggered and executed by transactions on the blockchain system. Smart contracts can be defined in the form of code. For example, calling a smart contract in Ethereum is to initiate a transaction pointing to the smart contract address, so that each node in the Ethereum network runs the smart contract code in a distributed manner. It should be noted that in addition to being able to create smart contracts by users, smart contracts can also be set by the system in the genesis block. This type of contract is generally called a genesis contract. Generally, some blockchain network data structures, parameters, properties and methods can be set in the genesis contract. In addition, accounts with system administrator privileges can create system-level contracts or modify system-level contracts (referred to as system contracts).
[0055] In the scenario of deploying a contract, for example, Bob sends a transaction containing information about creating a smart contract (i.e. deploying a contract) to Figure 1 In the blockchain shown, the data field of the transaction includes the code of the contract to be created (such as bytecode or machine code), and the to field of the transaction is empty to indicate that the transaction is used to deploy the contract. After the nodes reach an agreement through the consensus mechanism, the contract address "0x6f8ae93..." of the contract is determined, and each node adds a contract account corresponding to the contract address of the smart contract in the state database, allocates the state storage corresponding to the contract account, and saves the contract code in the state storage of the contract, so that the contract is successfully created.
[0056] In the scenario of calling a contract, for example, Bob sends a transaction for calling a smart contract to Figure 1 In the blockchain shown, the from field of the transaction is the address of the account of the transaction initiator (i.e. Bob), the "0x6f8ae93..." in the to field represents the address of the smart contract being called, and the data field of the transaction includes the method and parameters for calling the smart contract. After the transaction is reached in the blockchain, each node in the blockchain can execute the transaction separately, thereby executing the contract separately, and updating the status database based on the execution of the contract.
[0057] Due to the widespread use of blockchain, some attacks on blockchain (or blockchain attacks for short) have also emerged. Blockchain attacks refer to malicious actions against blockchain networks or blockchain-based applications in order to disrupt their normal operation, steal assets, or obtain illegal benefits. Therefore, blockchain users or service providers often hope to effectively identify blockchain attacks. However, existing solutions for identifying blockchain attacks either cannot accurately identify blockchain attacks during operation, or have poor identification results. Figure 2 A schematic diagram of a blockchain attack detection scheme is shown. Figure 2As shown in the figure, an existing detection scheme for blockchain attacks detects whether there are contract vulnerabilities by scanning and analyzing the static code of the blockchain contract code, and then determines whether there is a risk of blockchain attack based on the detection results of the contract vulnerabilities. However, on the one hand, this scheme can only detect blockchain attacks that are carried out by calling smart contracts. On the other hand, it only relies on scanning the static code before the contract is run, and it is difficult to detect blockchain attacks in time when the contract is running. Figure 3 A schematic diagram showing another detection scheme for blockchain attacks. Figure 3 As shown in FIG. 1 , another existing detection scheme for blockchain attacks is to input the transaction log of the blockchain into the neural network model to obtain the recognition result of the blockchain attack. However, the training of the neural network model in this scheme depends on a large number of high-quality labeled training samples. In actual production scenarios, it is difficult or costly to obtain a large number of high-quality labeled training samples. The lack of a large number of high-quality training samples often leads to poor recognition results of the neural network model.
[0058] In order to solve the above technical problems, the embodiments of this specification provide a method for detecting blockchain attacks. Figure 4 A schematic diagram of a blockchain attack detection method provided by an embodiment of this specification is shown. Figure 4 As shown, the core idea of the method is to convert the information of multiple function calls in the transaction log of the target transaction on the blockchain into transaction semantics corresponding to the multiple function calls, and the transaction semantics include semantic elements determined according to a single function call. According to the transaction semantics corresponding to each function call, the complex semantics included in each function call is determined, and the transaction semantics include semantic elements determined according to at least two function calls. Then, based on the transaction semantics and complex semantics of the multiple function calls, it is determined whether there is a risk that the target transaction is used for a predetermined attack. In different embodiments, the predetermined attack can be different types of blockchain attacks. Furthermore, in different embodiments, the risk of the target transaction being used for different types of blockchain attacks can be determined based on the transaction semantics, complex semantics of multiple function calls, and different identification rules.
[0059] The advantages of this method are: first, compared with the static contract vulnerability detection scheme, this method can monitor transaction activities dynamically from the transaction level and quickly capture the risk of attack when the attack occurs. Furthermore, after capturing the risk of attack, countermeasures such as suspending transactions, notifying administrators or triggering emergency response can be taken. Static detection is more of a preventive measure and cannot respond immediately when an attack occurs. Static contract vulnerability detection schemes can usually only check known vulnerabilities in the code before the contract is deployed, and cannot detect dynamic transactions at runtime and dynamically capture attack risks. Second, compared with the static contract vulnerability detection scheme, this method can comprehensively monitor all transaction activities, so that not only attacks implemented through contracts can be detected, but also attacks implemented through transactions outside contracts can be detected. Static contract vulnerability detection schemes can only detect the risk of attacks implemented through contracts. Third, compared with the scheme of identifying blockchain risks through neural networks, this method does not require a large number of labeled training samples, greatly reducing data costs and training costs, and providing high-quality identification results for blockchain attacks. Fourth, first extract transaction semantics based on transaction logs, then extract complex semantics based on transaction semantics, and finally identify the mode of blockchain attack based on complex semantics. Compared with directly identifying blockchain attacks based on transaction logs, it can effectively reduce the complexity of identification and improve identification efficiency.
[0060] A method for detecting blockchain attacks provided by an embodiment of this specification will be described in detail below. Figure 5 FIG. 1 is a flowchart showing a method for scheduling a service based on a graphics processor provided by an embodiment of the present specification. Figure 5 As shown, the method comprises at least the following steps:
[0061] Step S501, obtaining a transaction log of a target transaction on a target blockchain, and determining transaction semantics corresponding to the multiple function calls respectively according to information corresponding to the multiple function calls in the transaction log and a first semantic set including multiple preset first semantic elements, wherein the transaction semantics includes one or more of the multiple first semantic elements;
[0062] Step S503, determining complex semantics respectively included in the multiple function calls according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, wherein the complex semantics includes one or more of the multiple second semantic elements, and the second semantic elements are determined according to the first semantic elements in at least two function calls;
[0063] Step S505: determining whether there is a risk of a predetermined attack being carried out through the target transaction according to the transaction semantics and the complex semantics.
[0064] First, in step S501, the transaction log of the target transaction on the target blockchain is obtained, and the transaction semantics corresponding to the multiple function calls are determined according to the information corresponding to the multiple function calls in the transaction log and the first semantic set containing the preset multiple first semantic elements. The transaction semantics may include one or more of the multiple first semantic elements. In different embodiments, the target blockchain is used for different specific businesses or purposes and different specific types of blockchains, and this specification does not limit this.
[0065] The blockchain transaction log is the detailed information of each transaction recorded on the blockchain, which can be saved in the block. The transaction log can usually include the information of each function call in the transaction, such as the initiator, receiver, function name and parameters of the function call, etc. For multiple function calls, the blockchain transaction log usually also records the association between each function call (among multiple function calls) and other function calls (among multiple function calls) triggered by it.
[0066] Thus, the transaction semantics corresponding to each function call can be determined according to the information corresponding to each function call in the transaction log, and the transaction semantics of each function call can include one or more first semantic elements in the first semantic set. The first semantic element refers to a semantic element that can be determined according to a single function call itself. In different embodiments, the multiple first semantic elements included in the first semantic set itself can be different. In one embodiment, the first semantic set can include a first element, a second element, and a third element, the first element indicating the name of the called function, the sender and the receiver of the function call, the second element indicating the call depth corresponding to the function call, and the third element indicating the order of the function call. Furthermore, the transaction semantics corresponding to each function call can be determined according to the information corresponding to each function call in the transaction log and the first semantic set. In a specific example, for example, the information corresponding to a function call in the transaction log is: {"From":"0x8exxxx","To":"0x10xxxx",…,"Value":0,"Input":"SgsMOA==","InTxs":[xxx]}. The transaction semantics of the function call can be: order(1), depth(0), call(0x8exxxx, 0x10xxxx, 4a0b0c38). Among them, call is the first element, indicating the sender of the function call (for example, determined by the "From" item in the log information), the receiver (for example, determined by the "to" item) and the function name (for example, determined after data processing according to the "Input" item). order is the third element, indicating the order of the function call. Since this function call is the first function call in the transaction, its order can be 1. depth is the second element, indicating the call depth corresponding to the function call. The call depth refers to the number of layers of nested calls between functions. Since this function call is the first function call in the transaction and is not triggered by other function calls in the transaction, its depth can be 0.
[0067] In another embodiment, the first semantic set may include a third element, a fourth element, and a fifth element, wherein the fourth element indicates a function call for token payment, as well as the initiator, recipient, token type, and token amount of the token payment, the fifth element indicates a function call for token generation, as well as the liquidity pool, recipient, token type, and token amount of the token generation, and the third element indicates the order of function calls.
[0068] In another embodiment, the first semantic set may include a first element and a third element, wherein the first element indicates the name of the called function, the sender and receiver of the function call, the first element also indicates the parameters of the function call, and the third element indicates the order of the function calls.
[0069] In one embodiment, the first semantic set may further include a sixth element, which indicates that the called function is a preset sensitive function. In different embodiments, the preset sensitive function may be different. In one example, the preset sensitive function is, for example, a function that may cause a blockchain wallet owner change or a token transfer.
[0070] After determining the transaction semantics corresponding to the multiple function calls, in step S503, complex semantics respectively included in the multiple function calls can be determined according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements. The complex semantics can include one or more of the multiple second semantic elements, and the second semantic element can be determined according to the first semantic elements in at least two function calls.
[0071] In different embodiments, the second semantic element included in the second semantic set may be different. In the embodiment in which the first semantic set includes the first element, the second element and the third element. The second semantic set may include a first composite element and a second composite element, wherein the first composite element indicates that there are two function calls with the same initiator, the same recipient and the same function name, and the second composite element indicates that there are two function calls with opposite initiators and recipients. It is possible to determine the first composite element and the second composite element in the complex semantics respectively contained in the multiple function calls based on the first element, the second element and the third element included in the transaction semantics respectively corresponding to the multiple function calls.
[0072] In a specific embodiment, it is possible to determine whether there are a first function call and a second function call in the multiple function calls based on the first element, the second element, and the third element included in the transaction semantics corresponding to the multiple function calls, the calling order of the first function call is before the second function call, the initiator, the receiver, and the called function name of the first function call and the second function call are the same, and the calling depth of the second function call is not greater than the calling depth of the first function call. Furthermore, if the first function call and the second function call exist in the multiple function calls, it is determined that the complex semantics of the second function call includes the first composite element corresponding to the first function call and the second function call. In one example, for example, the transaction semantics of multiple function calls determined based on the transaction log are:
[0073] order(1)depth(0)call(0x8exxxx,0x10xxxx,4a0b0c38)
[0074] …
[0075] order(3)depth(2)call(0xc9xxxx,0x3axxxx,18160ddd)
[0076] …
[0077] order(5)depth(2)ca ll(0xc9xxxx,0x3a xxxx,18160ddd)sameCa ll(3,5)
[0078] Among them, since the initiator, receiver, and called function name of the function call with order 3 (for the convenience of description, referred to as function call 3) and the function call with order 5 (for the convenience of description, referred to as function call 5) are the same, and the call depth of the former is not greater than that of the latter. Therefore, it can be determined that the complex semantics of function call 3 includes the first composite element. Note that when function call 3 occurs, function call 5 does not exist. Therefore, the complex semantics of function call 3 does not include the first composite element. In actual production scenarios, the complex semantics of the determined function call can be empty, that is, it does not include any second semantic elements. In this example, the complex semantics of function call 3 may not include any second semantic elements.
[0079] In another specific embodiment, according to the first element, the second element and the third element included in the transaction semantics corresponding to the multiple function calls, it is determined whether the first function call and the third function call exist in the multiple function calls, the calling order of the first function call is before the third function call, the initiator and the receiver of the first function call and the third function call are opposite, and the calling depth of the second function call is not greater than the calling depth of the first function call. Furthermore, if the first function call and the third function call exist in the multiple function calls, it is determined that the complex semantics of the second function call includes the second composite element corresponding to the first function call and the third function call.
[0080] In the embodiment in which the third element, the fourth element and the fifth element are included in the first semantic set, the second semantic set may include the third composite element and the fourth composite element, the third composite element indicating that there are two function calls for transferring the first token into the liquidity pool and obtaining the second token from the liquidity pool, and the fourth composite element indicating that there are two function calls for transferring the third token into the liquidity pool and obtaining the liquidity pool token from the liquidity pool. In a specific embodiment, it can be determined whether there is a fourth function call for token payment and a fifth function call for token payment in the multiple function calls according to the third element and the fourth element included in the transaction semantics corresponding to the multiple function calls, the calling order of the fourth function call is before the fifth function call, the initiator and the recipient of the fourth function call and the fifth function call are opposite, the token type and the token amount are different, and the recipient of the fourth function call and the initiator of the fifth function call are the same liquidity pool. Furthermore, if the fourth function call and the fifth function call exist in the multiple function calls, it is determined that the complex semantics of the fifth function call includes the third composite element corresponding to the fourth function call and the fifth function call.
[0081] In another specific embodiment, it is possible to determine whether there is a sixth function call for token payment and a seventh function call for token generation in the multiple function calls according to the third element, the fourth element and the fifth element included in the transaction semantics corresponding to the multiple function calls, the calling order of the sixth function call is before the seventh function call, the initiator and the recipient of the sixth function call are opposite to the seventh function call, the recipient of the sixth function call and the initiator of the seventh function call are the same liquidity pool, and the token type of the seventh function call is the liquidity pool token of the liquidity pool. The liquidity pool token is a token generated by the liquidity pool itself. Furthermore, if the sixth function call and the seventh function call exist in the multiple function calls, it is determined that the complex semantics of the seventh function call includes the fourth composite element corresponding to the sixth function call and the seventh function call.
[0082] In the embodiment in which the first semantic set includes the first element and the third element. The second semantic set may also include a fifth composite element, wherein the fifth composite element indicates that there are two function calls in which the call parameters of one function call include the call parameters of another function call. In a specific embodiment, based on the first element and the third element included in the transaction semantics corresponding to the multiple function calls, it is determined whether there are a tenth function call and an eleventh function call in the multiple function calls, the call order of the tenth function call is before the eleventh function call, and the call parameters of the seventh function call include the call parameters of the eighth function call. Furthermore, if the tenth function call and the eleventh function call exist in the multiple function calls, it is determined that the complex semantics of the eleventh function call includes the fifth composite element corresponding to the tenth function call and the eleventh function call.
[0083] Thereafter, in step S505, it may be determined whether there is a risk of carrying out a predetermined attack through the target transaction based on the transaction semantics and the complex semantics.
[0084] In actual production scenarios, there are often different types of blockchain attacks, such as reentrancy (RE) attacks, indirect price manipulation (IPM) attacks, call injection (CI) attacks, direct price manipulation (DPM), sandwich attacks, etc. Therefore, in different embodiments, the predetermined attack may be a different specific attack, and the specific method of determining whether there is a risk of a predetermined attack may also be different.
[0085] A reentrancy attack is a form of blockchain attack. Specifically, when a contract makes an external call to another contract, if the called contract is able to call back the caller contract again during execution, and use the unfinished state changes of the caller contract during the callback process, there is a risk of a reentrancy attack. For example, in a smart contract involving fund transfer, the normal process should be to deduct the sender's funds first, and then complete the transfer to the receiver. However, if during the transfer process, the receiver's contract is able to immediately re-enter the sender's contract's transfer function, and the sender's contract has not yet completed the state update (such as deducting funds), then the receiver can obtain funds multiple times, causing losses to the sender.
[0086] In order to identify a reentrancy attack, in the embodiment where the second semantic set includes the first composite semantics and the second composite semantics, it is possible to determine whether the first function call, the second function call, and the third function call in the plurality of function calls meet the preset first rule according to the transaction semantics and the complex semantics, the complex semantics of the second function call includes the first composite element corresponding to the first function call and the second function call, the complex semantics of the third function call includes the second composite element corresponding to the first function call and the second function call, and the call depth of the second function call is greater than the call depth of the third function call. Furthermore, if the first function call, the second function call, and the third function call exist in the plurality of function calls, it is determined that there is a risk of a reentrancy attack through the target transaction.
[0087] Indirect price manipulation attacks are a form of blockchain attacks. Specifically, for example, the attacker first conducts a specific transaction in the liquidity pool, such as purchasing (exchanging) token B in the liquidity pool with token A, thereby raising the price of token B. In the second step, the attacker exchanges the token B with a higher price for a relatively larger number of tokens generated by the liquidity pool itself (for example, token C). In the third step, the attacker exchanges token C for more token A to gain benefits.
[0088] In order to identify indirect price manipulation attacks, in the embodiment where the second semantic set includes the third composite semantics and the fourth composite semantics, it can be determined whether there are the fifth function call, the seventh function call and the ninth function call in the multiple function calls according to the transaction semantics and the complex semantics, the complex semantics of the ninth function call includes the third composite element corresponding to the eighth function call and the ninth function call, the complex semantics of the fifth function call includes the fourth composite element corresponding to the fourth function call and the fifth function call, the complex semantics of the seventh function call includes the third composite element corresponding to the sixth function call and the seventh function call, the ninth function call is before the fifth function call, the fifth function call is before the seventh function call, the initiators of the fourth function call, the sixth function call and the eighth function call are the same as the initiator of the same liquidity pool, and the initiators of the fifth function call, the seventh function call and the ninth function call are the same as the liquidity pool. Furthermore, if the fifth function call, the seventh function call and the ninth function call exist in the multiple function calls, it is determined that there is a risk of indirect control attack through the target transaction.
[0089] Call injection attack is another form of blockchain attack. Specifically, the attacker attempts to manipulate input data to send malicious call instructions or parameters to the attacked party in order to obtain unauthorized access, perform illegal operations, or obtain sensitive information. In order to identify call injection attacks, in the embodiment where the second semantic set includes the fifth composite semantics, it can be determined whether there are tenth function calls and eleventh function calls that meet predetermined conditions in the multiple function calls based on the transaction semantics and the complex semantics. The predetermined conditions include that the complex semantics of the eleventh function call includes the fifth composite element corresponding to the tenth function call and the eleventh function call, and the transaction semantics of the eleventh function call includes the sixth element. Furthermore, if there are tenth function calls and eleventh function calls that meet the predetermined conditions in the multiple function calls, it is determined that there is a risk of implementing a call injection attack through the target transaction.
[0090] Direct price manipulation attack is a similar attack method to indirect price manipulation. The difference between them is that in the second step, the attacker usually does not obtain the tokens generated by the liquidity pool itself from the liquidity pool, but obtains other tokens. In the third step, other tokens are exchanged for the tokens paid in the first step. For example, in the above-mentioned example of indirect price manipulation attack, replacing token C, which is the token generated by the liquidity pool itself, with tokens other than tokens A and B constitutes direct price manipulation. In order to identify direct price manipulation, in the embodiment where the above-mentioned second semantic set includes the third composite semantics and the fourth composite semantics, the tokens generated by the liquidity pool itself in the judgment rules for indirect price manipulation can be replaced with other tokens for judging direct price manipulation.
[0091] Sandwich attack is also an attack implemented by manipulating token prices. The difference between it and direct price manipulation is that the second step is not operated by the attacker, but by the victim, who performs an operation similar to the attacker's first step, such as exchanging token A for token B. Since the attacker's first step has increased the price of token B, the victim suffers losses by exchanging for fewer tokens B, and further pushes up the price of token B. Therefore, the attacker can use the high-priced token B to exchange for more tokens A in the third step. Therefore, in the embodiment where the second semantic set includes the third composite semantics, it can be determined, for example, whether there are three function calls with a sequence among multiple function calls, each function call has the third composite semantics, and the senders of the three function calls are the same liquidity pool, and the receivers of the first function call and the second function call are the same, and the receivers of the middle function call are different (it should be noted that the function call with composite semantics is usually the latter call in a pair (or a group) of corresponding function calls, and the receiver of the latter call is the sender of the previous call). If the above three function calls exist, it is determined that there is a risk of implementing a sandwich attack through the target transaction.
[0092] On the other hand, corresponding to the above method process, the embodiment of this specification also discloses a blockchain attack detection device. Figure 6 The following is a structural diagram of a blockchain attack detection device provided by an embodiment of this specification. Figure 6 As shown, the device 600 includes:
[0093] The transaction semantics determination unit 601 is configured to obtain a transaction log of a target transaction on a target blockchain, and determine transaction semantics corresponding to the multiple function calls respectively according to information corresponding to the multiple function calls in the transaction log and a first semantic set including multiple preset first semantic elements, wherein the transaction semantics includes one or more of the multiple first semantic elements;
[0094] The complex semantics determining unit 602 is configured to determine, according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls, the complex semantics including one or more of the multiple second semantic elements, the second semantic elements being determined according to the first semantic elements in at least two function calls;
[0095] The risk detection unit 603 is configured to determine whether there is a risk of a predetermined attack being carried out through the target transaction according to the transaction semantics and the complex semantics.
[0096] Another aspect of the embodiments of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute any one of the above methods.
[0097] On the other hand, the embodiments of the present specification provide a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, any one of the above methods is implemented.
[0098] It should be understood that the descriptions such as “first” and “second” in this article are only used to distinguish similar concepts for the sake of simplicity of description and do not have any other limiting effect.
[0099] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent a unique execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements.
[0100] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more embodiments of this specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0101] Those skilled in the art should be aware that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0102] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.
[0103] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.
[0104] The above description is only an example of one or more embodiments of this specification and is not intended to limit one or more embodiments of this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims.
Claims
1. A method for detecting blockchain attacks, comprising: Obtaining a transaction log of a target transaction on a target blockchain, and determining transaction semantics corresponding to the multiple function calls respectively according to information corresponding to the multiple function calls in the transaction log and a first semantic set including multiple preset first semantic elements, wherein the transaction semantics includes one or more of the multiple first semantic elements; Determine, according to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls, the complex semantics including one or more of the multiple second semantic elements, the second semantic elements being determined according to the first semantic elements in at least two function calls; It is determined whether there is a risk of a predetermined attack being carried out through the target transaction according to the transaction semantics and the complex semantics.
2. The method according to claim 1, wherein: The multiple first semantic elements include a first element, a second element and a third element, the first element indicates a called function name, a sender and a receiver of the function call, the second element indicates a call depth corresponding to the function call, and the third element indicates an order of the function calls; The multiple second semantic elements include a first composite element and a second composite element, wherein the first composite element indicates that there are two function calls with the same initiator, the same recipient and the same called function name, and the second composite element indicates that there are two function calls with opposite initiators and recipients.
3. The method according to claim 2, wherein: According to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls are determined, including: determining, according to the first element, the second element, and the third element included in the transaction semantics respectively corresponding to the multiple function calls, whether there is a first function call and a second function call in the multiple function calls, the calling order of the first function call is before the second function call, the initiator, the receiver, and the called function name of the first function call and the second function call are the same, and the calling depth of the second function call is not greater than the calling depth of the first function call; If the first function call and the second function call exist in the multiple function calls, it is determined that the complex semantics of the second function call includes a first composite element corresponding to the first function call and the second function call.
4. The method according to claim 2, wherein: According to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls are determined, including: determining, according to the first element, the second element, and the third element included in the transaction semantics respectively corresponding to the multiple function calls, whether a first function call and a third function call exist in the multiple function calls, the calling order of the first function call is before the third function call, the initiator and the receiver of the first function call and the third function call are opposite, and the calling depth of the second function call is not greater than the calling depth of the first function call; If the first function call and the third function call exist in the multiple function calls, it is determined that the complex semantics of the second function call includes a second composite element corresponding to the first function call and the third function call.
5. The method according to claim 2, wherein: Determining whether there is a risk of implementing a predetermined attack through the target transaction according to the transaction semantics and the complex semantics, including: Determine, according to the transaction semantics and the complex semantics, whether the first function call, the second function call, and the third function call among the multiple function calls meet a preset first rule, the complex semantics of the second function call includes a first composite element corresponding to the first function call and the second function call, the complex semantics of the third function call includes a second composite element corresponding to the first function call and the second function call, and the call depth of the second function call is greater than the call depth of the third function call; If the first function call, the second function call, and the third function call exist in the multiple function calls, it is determined that there is a risk of a reentrancy attack being carried out through the target transaction.
6. The method according to claim 1, wherein: The multiple first semantic elements include a third element, a fourth element and a fifth element, the fourth element indicating a function call for token payment, and an initiator, a recipient, a token type and a token amount of the token payment, the fifth element indicating a function call for token generation, and a liquidity pool, a recipient, a token type and a token amount of the token generation, and the third element indicating an order of function calls; The multiple second semantic elements include a third composite element and a fourth composite element, wherein the third composite element indicates that there are two function calls for transferring the first token into the liquidity pool through the same participating direction and obtaining the second token from the liquidity pool, and the fourth composite element indicates that there are two function calls for transferring the third token into the liquidity pool through the same participating direction and obtaining the liquidity pool token from the liquidity pool.
7. The method according to claim 6, wherein: According to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls are determined, including: According to the third element and the fourth element included in the transaction semantics respectively corresponding to the multiple function calls, determine whether there is a fourth function call for token payment and a fifth function call for token payment in the multiple function calls, the calling order of the fourth function call is before the fifth function call, the initiator and the recipient of the fourth function call and the fifth function call are opposite, the token type and the token amount are different, and the recipient of the fourth function call and the initiator of the fifth function call are the same liquidity pool; If the fourth function call and the fifth function call exist in the multiple function calls, it is determined that the complex semantics of the fifth function call includes a third composite element corresponding to the fourth function call and the fifth function call.
8. The method according to claim 6, wherein: According to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls are determined, including: According to the third element, the fourth element and the fifth element included in the transaction semantics respectively corresponding to the multiple function calls, determine whether there is a sixth function call for token payment and a seventh function call for token generation in the multiple function calls, the calling order of the sixth function call is before the seventh function call, the initiator and the recipient of the sixth function call are opposite to those of the seventh function call, the recipient of the sixth function call and the initiator of the seventh function call are the same liquidity pool, and the token type of the seventh function call is the liquidity pool token of the liquidity pool; If the sixth function call and the seventh function call exist in the multiple function calls, it is determined that the complex semantics of the seventh function call includes a fourth composite element corresponding to the sixth function call and the seventh function call.
9. The method according to claim 6, wherein: Determining whether there is a risk of implementing a predetermined attack through the target transaction according to the transaction semantics and the complex semantics, including: According to the transaction semantics and the complex semantics, determine whether there are a fifth function call, a seventh function call and a ninth function call in the multiple function calls, the complex semantics of the ninth function call includes a third composite element corresponding to the eighth function call and the ninth function call, the complex semantics of the fifth function call includes a fourth composite element corresponding to the fourth function call and the fifth function call, the complex semantics of the seventh function call includes a third composite element corresponding to the sixth function call and the seventh function call, the ninth function call is before the fifth function call, the fifth function call is before the seventh function call, the initiators of the fourth function call, the sixth function call and the eighth function call are the same as the initiator of the same liquidity pool, and the initiators of the fifth function call, the seventh function call and the ninth function call are the same as the liquidity pool; If the fifth function call, the seventh function call and the ninth function call exist in the plurality of function calls, it is determined that there is a risk of an indirect control attack being carried out through the target transaction.
10. The method according to claim 1, wherein: The multiple first semantic elements include a first element and a third element, the first element indicates a name of a called function, a sender and a receiver of the function call, the first element further indicates a parameter of the function call, and the third element indicates an order of the function call; The plurality of second semantic elements include a fifth compound element, which indicates that there are two function calls, wherein a call parameter of one function call includes a call parameter of another function call.
11. The method according to claim 10, wherein: According to the transaction semantics respectively corresponding to the multiple function calls and the second semantic set including the preset multiple second semantic elements, the complex semantics respectively included in the multiple function calls are determined, including: determining, according to the first element and the third element included in the transaction semantics respectively corresponding to the multiple function calls, whether there are a tenth function call and an eleventh function call in the multiple function calls, the calling order of the tenth function call is before the eleventh function call, and the calling parameters of the seventh function call include the calling parameters of the eighth function call; If the tenth function call and the eleventh function call exist in the multiple function calls, it is determined that the complex semantics of the eleventh function call includes the fifth composite element corresponding to the tenth function call and the eleventh function call.
12. The method according to claim 11, wherein: The plurality of first semantic elements further include a sixth element, wherein the sixth element indicates that the called function is a preset sensitive function; Determining whether there is a risk of implementing a predetermined attack through the target transaction according to the transaction semantics and the complex semantics, including: determining, according to the transaction semantics and the complex semantics, whether there are a tenth function call and an eleventh function call in the multiple function calls that meet a predetermined condition, wherein the predetermined condition includes that the complex semantics of the eleventh function call includes a fifth composite element corresponding to the tenth function call and the eleventh function call, and the transaction semantics of the eleventh function call includes a sixth element; If there are a tenth function call and an eleventh function call that meet the predetermined condition among the multiple function calls, it is determined that there is a risk of a call injection attack being carried out through the target transaction.
13. A blockchain attack detection device, the device comprising: A transaction semantics determination unit is configured to obtain a transaction log of a target transaction on a target blockchain, and determine transaction semantics corresponding to the multiple function calls respectively according to information corresponding to the multiple function calls in the transaction log and a first semantic set including multiple preset first semantic elements, wherein the transaction semantics includes one or more of the multiple first semantic elements; A complex semantics determination unit is configured to determine, according to the transaction semantics respectively corresponding to the multiple function calls and a second semantic set including a plurality of preset second semantic elements, the complex semantics respectively included in the multiple function calls, wherein the complex semantics includes one or more of the plurality of second semantic elements, and the second semantic elements are determined according to the first semantic elements in at least two function calls; The risk detection unit is configured to determine whether there is a risk of a predetermined attack being carried out through the target transaction according to the transaction semantics and the complex semantics.
14. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 12.
15. A computing device, comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 12 is implemented.