Bytecode-based security detection method and system for decentralized application smart contract

Abstract

The invention relates to a bytecode-based security detection method and system for a decentralized application smart contract. The method comprises the following steps: collecting a decentralized application DApp smart contract source code from a database based on an API interface, converting the source code into a byte code, and constructing an abstract syntax tree and a contract calling graph; and extracting local data stream feature information according to the contract call graph to construct a data set, and constructing and training to obtain a UEChecker model which is used for performing security detection on the decentralized application smart contract. Information of DApp smart contracts is obtained and converted into byte codes to construct an abstract syntax tree, and a constructed contract calling graph can obtain node and side information of each smart contract, so that a trained model can better learn local and global features of the smart contract calling graph; the finally trained UEChecker model can detect whether malicious behaviors exist in the smart contract of the decentralized application, and the effect of detecting the vulnerability of the DApp smart contract is improved.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a bytecode-based decentralized application smart contract security detection method and system. Background Art

[0002] With the development of blockchain technology, decentralized applications (DApps) and cryptographic protocols have extremely high locked-in value, attracting a large number of active cryptocurrency users around the world. Specifically, by embedding established logic into smart contracts and storing them on the blockchain, these smart contracts can be automatically executed without the intervention of any centralized institution. This emerging technology allows users to independently control their personal funds, thanks to the security and transparency provided by smart contracts. With the maturity of blockchain and cryptocurrency, DApps are rapidly expanding into various fields, including finance, games, NFTs, and social media, but attacks caused by smart contracts are becoming more and more serious. For example, attackers exploited a serious vulnerability in DApp smart contracts, which was a reentry attack and price manipulation, and successfully stole valuable crypto assets; attackers exploited the incorrect handling mechanism of borrowing and collateral assets in smart contracts, allowing attackers to borrow a large amount of assets without sufficient collateral, resulting in a large amount of asset losses. Due to the complexity of DApp contracts and the rapid development of application functions, many DApps have suffered various types of attacks, and the losses incurred have become increasingly serious.

[0003] In the existing decentralized application smart contract security detection methods, different technologies are used to simulate the operating logic of DApp smart contracts, and expert knowledge is used to summarize the rules of vulnerability occurrence. Then, various detection rules are set to determine whether the DApp contract has security vulnerabilities. Traditional methods such as symbolic execution, static analysis, and formal verification can quickly detect vulnerabilities, but they rely heavily on expert knowledge, usually resulting in a large number of false positives and consuming a large amount of computing resources. For deep learning detection methods, the characteristics of vulnerabilities are automatically learned from DApp attack contracts to identify attack events. However, today's deep learning models are not accurate enough in detecting certain types of vulnerabilities, resulting in a lack of detection effect of deep learning in DApp. Summary of the invention

[0004] Based on this, in order to solve the above technical problems, a bytecode-based decentralized application smart contract security detection method and system are provided, which can utilize the function call flow information in the DApp smart contract to realize the DApp smart contract security detection.

[0005] A bytecode-based security detection method for decentralized application smart contracts, the method comprising:

[0006] Collect decentralized application DApp smart contract source code from the database based on API interface;

[0007] Convert the DApp smart contract source code into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree;

[0008] Obtaining node information and edge information of each smart contract according to the contract call graph, and extracting local data flow feature information based on the node information and edge information;

[0009] The local data stream feature information is constructed into a data set, and the data set is input into model training to construct and train a UEChecker model for security detection of decentralized application smart contracts;

[0010] The UEChecker model is used to perform vulnerability security detection on the DApp smart contract.

[0011] In one embodiment, the decentralized application DApp smart contract source code is collected from the database based on the API interface, including:

[0012] Based on the API interface, the DappRadar blockchain browser collects the source code of decentralized application DApp smart contracts in real time;

[0013] Among them, the DApp smart contract source code contains the smart contract, library functions, and DApp transaction records corresponding to the Dapp.

[0014] In one embodiment, constructing an abstract syntax tree through the bytecode, and constructing a contract call graph based on the abstract syntax tree, including:

[0015] An abstract syntax tree is constructed through the bytecode to determine functions, variables, inheritance relationships, and mutual call flows in the smart contract;

[0016] Based on the functions, variables, inheritance relationships, and mutual call flows, identify the call path and dependencies of each function, simulate the function calls and data flows within and across smart contracts, and build a contract call graph.

[0017] In one embodiment, extracting local data flow feature information based on the node information and edge information includes:

[0018] Extract the node information, generate an ID through the node information, and create a vocabulary from node to ID;

[0019] Creating a multi-dimensional embedding matrix and converting the vocabulary into a continuous numerical vector through the multi-dimensional embedding matrix;

[0020] The structural information and node features of the contract call graph are extracted according to the multi-dimensional embedding matrix, the continuous numerical vector, and the vocabulary as local data flow feature information.

[0021] In one of the embodiments, the structural information and node features include: an adjacency dictionary, node features, node labels, an adjacency matrix, and vulnerability labels of the contract call graph.

[0022] In one embodiment, the local data stream feature information is constructed as a data set, and the data set is input into model training, and the UEChecker model is constructed and trained, including:

[0023] Reconstructing the adjacency matrix of each pair of nodes according to the node features, and constructing a linear layer and a batch normalization layer for predicting the edges of each pair of nodes;

[0024] Define a clustering layer, and assign cluster centers to graph nodes in the contract call graph through the clustering layer to obtain cluster assignments for each node;

[0025] Design the Conformer layer to capture global and local features by inputting the contract call graph after clustering assignment;

[0026] The global features and local features are input into the graph convolutional neural network for learning, and the UEChecker model is obtained through training.

[0027] In one embodiment, assigning cluster centers to graph nodes in the contract call graph through the clustering layer to obtain cluster assignments for each node includes:

[0028] Calculate the Euclidean distance between each node in the contract call graph and all cluster centers;

[0029] Based on the Euclidean distance, each node is assigned a cluster center with the closest distance to obtain a cluster assignment for each node.

[0030] In one embodiment, a Conformer layer is designed to capture global features and local features by inputting the contract call graph after clustering assignment, including:

[0031] Set up convolutional neural network, feedforward neural network, and self-attention mechanism in the Conformer layer;

[0032] Through the self-attention mechanism, the node position dot product calculation is performed based on the contract call graph after clustering allocation, and dynamic weighted aggregation is performed to capture global features;

[0033] The convolutional neural network and the feedforward neural network are used to capture the local features of the contract call graph based on the contract call graph after clustering allocation, and the convolution operation is used to perform sliding calculation through the convolution kernel.

[0034] In one embodiment, the global features and local features are input into a graph convolutional neural network for learning, and a UEChecker model is obtained through training, including:

[0035] Identify different types of adjacency matrices through the graph convolutional neural network, perform convolution based on the global features and local features, perform power and weighting processing on the adjacency matrix, and learn detailed features in the contract call graph;

[0036] Based on the detailed features, the pooling and fully connected layers are used to determine whether the smart contract has vulnerabilities, and the UEChecker model is trained.

[0037] A bytecode-based security detection system for decentralized application smart contracts, the system comprising:

[0038] Data collection module, used to collect decentralized application DApp smart contract source code from the database based on API interface;

[0039] A call graph construction module, used to convert the DApp smart contract source code into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree;

[0040] A feature extraction module, used to obtain node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information;

[0041] A model training module, used to construct the local data stream feature information into a data set, and input the data set into model training, so as to construct and train a UEChecker model for security detection of decentralized application smart contracts;

[0042] The security detection module is used to perform vulnerability security detection on the DApp smart contract through the UEChecker model.

[0043] The above-mentioned bytecode-based decentralized application smart contract security detection method and system obtains the information of the DApp smart contract and converts it into bytecode to construct an abstract syntax tree. The constructed contract call graph can obtain the node and edge information of each smart contract, so that the trained model can better learn the local and global features of the smart contract call graph, so that the finally trained UEChecker model can detect whether there is malicious behavior in the decentralized application smart contract, thereby improving the effect of detecting DApp smart contract vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 An application environment diagram of a bytecode-based decentralized application smart contract security detection method in one embodiment;

[0045] Figure 2 A schematic diagram of a flow chart of a security detection method for a decentralized application smart contract based on bytecode in one embodiment;

[0046] Figure 3 A visualized DApp smart contract call graph generated based on bytecode in one embodiment;

[0047] Figure 4 A flowchart of a security detection method for a decentralized application smart contract based on bytecode in one embodiment;

[0048] Figure 5 It is a structural block diagram of a security detection system for a decentralized application smart contract based on bytecode in one embodiment;

[0049] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0051] The bytecode-based decentralized application smart contract security detection method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1As shown, the application environment includes a computer device 110. The computer device 110 can collect the decentralized application DApp smart contract source code from the database based on the API interface; the computer device 110 can convert the DApp smart contract source code into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree; the computer device 110 can obtain the node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information; the computer device 110 can construct the local data flow feature information as a data set, and input the data set into the model training, and construct the UEChecker model for security detection of decentralized application smart contracts; the computer device 110 can perform vulnerability security detection on the DApp smart contract through the UEChecker model. Among them, the computer device 110 can be, but not limited to, various personal computers, laptops, robots and other devices.

[0052] In one embodiment, Figure 2 As shown, a security detection method for a decentralized application smart contract based on bytecode is provided, comprising the following steps:

[0053] Step 202: Collect the decentralized application DApp smart contract source code from the database based on the API interface.

[0054] Specifically, in one embodiment, a bytecode-based decentralized application smart contract security detection method may also include a process of collecting DApp smart contracts through a DappRadar blockchain browser, and the specific process includes: collecting decentralized application DApp smart contract source code in real time through the DappRadar blockchain browser based on an API interface; wherein the DApp smart contract source code includes smart contracts, library functions, and DApp transaction records corresponding to the Dapp.

[0055] That is, in this embodiment, the computer device can collect the smart contracts of popular DApps in real time through the DappRadar blockchain browser and the officially provided API, including detailed information such as all smart contracts, library functions and transaction status of DApps involved.

[0056] Step 204: convert the DApp smart contract source code into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree.

[0057] After converting the DApp smart contract source code into bytecode, the function and variable calling relationships of different contracts in the DApp can be simulated by building a call graph.

[0058] In one embodiment, a bytecode-based security detection method for a decentralized application smart contract may also include a process of constructing a contract call graph, the specific process including: constructing an abstract syntax tree through bytecode to determine the functions, variables, inheritance relationships, and mutual call flows in the smart contract; based on the functions, variables, inheritance relationships, and mutual call flows, identifying the call path and dependency relationships of each function, simulating internal and cross-contract function calls and data flows in the smart contract, and constructing a contract call graph.

[0059] Computer devices can construct the contract abstract syntax tree through bytecode, analyze the functions, variables and call flows between different contracts in the contract, thereby simulating the construction of the dependency relationship between each function and contract, extracting the call relationship within the contract, and generating the contract call graph corresponding to the smart contract. Among them, the visual DApp smart contract call graph generated by the computer device based on the bytecode is as follows Figure 3 shown.

[0060] Step 206, obtaining the node information and edge information of each smart contract according to the contract call graph, and extracting the local data flow feature information based on the node information and edge information.

[0061] The computer device can extract call graph information and node features based on the generated contract call graph.

[0062] In one embodiment, a bytecode-based decentralized application smart contract security detection method is provided that may also include a process of extracting information, the specific process including: extracting node information, generating an identification ID through the node information, and creating a node-to-ID vocabulary; creating a multi-dimensional embedding matrix, and converting the vocabulary into a continuous numerical vector through the multi-dimensional embedding matrix; extracting structural information and node features of the contract call graph based on the multi-dimensional embedding matrix, the continuous numerical vector, and the vocabulary as local data flow feature information.

[0063] Among them, the computer device can define functions and variables as nodes, and the flow between nodes as edges, and obtain the information of each node and edge in the call graph; then extract the full-graph node information of the call graph, such as function name and variable name, and create a node-to-ID vocabulary by extracting the relevant information of the node; then, a multi-dimensional embedding matrix can be initialized to convert the created vocabulary into a vector; then, based on the node vocabulary, embedding matrix and call graph, the call graph connectivity relationship matrix and node features are constructed.

[0064] The computer device can parse the node ID and label, use the vocabulary to convert each node into an embedding vector, and build an adjacency matrix based on the edge flow information of the call graph to represent the node connection status of the call graph.

[0065] Specifically, the structural information and node features include: adjacency dictionary of the contract call graph, node features, node labels, adjacency matrix, and vulnerability labels.

[0066] Step 208: construct the local data flow feature information into a data set, and input the data set into model training to construct and train a UEChecker model for security detection of decentralized application smart contracts.

[0067] The computer device can construct the collected call graph feature information into a data set and input it into model training.

[0068] Specifically, in one embodiment, a bytecode-based decentralized application smart contract security detection method is provided that may also include a model training and learning process, the specific process including: reconstructing the adjacency matrix of each pair of nodes according to the node features, and constructing a linear layer and a batch normalization layer for predicting the edges of each pair of nodes; defining a clustering layer, assigning cluster centers to the graph nodes in the contract call graph through the clustering layer, and obtaining the clustering assignment of each node; designing a Conformer layer, and inputting the contract call graph after the clustering assignment to capture global features and local features; inputting the global features and local features into the graph convolutional neural network for learning, and training to obtain the UEChecker model.

[0069] In one embodiment, the computer device can calculate the Euclidean distance between each node and all cluster centers in the contract call graph; based on the Euclidean distance, the nearest cluster center is assigned to each node to obtain the cluster assignment of each node. Specifically, the computer device can reconstruct the edge connection information of each pair of nodes based on the adjacency matrix and node features; then define a clustering layer to cluster the nodes in the reconstructed adjacency matrix, and classify the nodes into corresponding cluster centers by calculating the Euclidean set distance between the nodes and the cluster centers, thereby guiding the model to learn more closely related features.

[0070] In one embodiment, a computer device may set a convolutional neural network, a feedforward neural network, and a self-attention mechanism in the Conformer layer; perform node position dot product calculations based on the contract call graph after clustering assignment through the self-attention mechanism, and perform dynamic weighted aggregation to capture global features; and capture local features of the contract call graph by sliding calculations through convolution operations using convolution kernels based on the contract call graph after clustering assignment through the convolutional neural network and the feedforward neural network.

[0071] That is, a Conformer layer is designed, and the adjacency matrix obtained after node clustering is input into the Conformer layer to learn the global and local feature information of the call graph. In this embodiment, the Conformer layer combines a convolutional neural network, a feedforward neural network, and a self-attention mechanism. The self-attention mechanism captures global features by performing position dot product calculations and performing dynamic weighted aggregation according to the correlation of input features; and uses a convolution operation to slide calculations on the input through a fixed-size convolution kernel to capture local information of the call graph.

[0072] In one embodiment, a computer device can identify different types of adjacency matrices through a graph convolutional neural network, and perform convolution based on global features and local features, perform power and weighted processing on the adjacency matrix, and learn detailed features in the contract call graph; based on the detailed features, determine whether there are vulnerabilities in the smart contract through pooling and fully connected layers, and train the UEChecker model.

[0073] Specifically, the computer device can input the obtained global and local features of the call graph into the graph convolutional neural network for learning. The graph neural network implements a multifunctional graph convolution layer, which convolves the node information in the graph by identifying different types of adjacency matrices and strengthens the connectivity of the graph through the power and weighted self-connection of the adjacency matrix, and learns the detailed features of the nodes. Finally, the computer device can use the obtained call graph feature information through the pooling and fully connected layers to determine whether the contract has vulnerabilities.

[0074] Step 210: Perform vulnerability security detection on the DApp smart contract through the UEChecker model.

[0075] That is, computer devices can use the UEChecker model to determine whether there are vulnerabilities in the DApp smart contract.

[0076] In this embodiment, the usage process of a bytecode-based decentralized application smart contract security detection method is as follows: Figure 4 As shown, it can mainly include converting the DApp smart contract source code into bytecode; building a contract call graph; obtaining the node information and edge information of each smart contract; building a data set to train the UEChecker model; and performing vulnerability security detection on the DApp smart contract through the UEChecker model.

[0077] The present application provides a bytecode-based security detection method for decentralized application smart contracts. By obtaining the information of the DApp smart contract and converting it into bytecode to construct an abstract syntax tree, the constructed contract call graph can obtain the node and edge information of each smart contract, so that the trained model can better learn the local and global features of the smart contract call graph, so that the finally trained UEChecker model can detect whether there is malicious behavior in the decentralized application smart contract, thereby improving the effect of detecting DApp smart contract vulnerabilities.

[0078] It should be understood that, although the various steps in the above-mentioned flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flow chart may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0079] In one embodiment, Figure 5 As shown, a security detection system for a decentralized application smart contract based on bytecode is provided, including: a data acquisition module 510, a call graph construction module 520, a feature extraction module 530, a model training module 540 and a security detection module 550, wherein:

[0080] The data collection module 510 is used to collect the decentralized application DApp smart contract source code from the database based on the API interface;

[0081] A call graph construction module 520 is used to convert the DApp smart contract source code into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree;

[0082] A feature extraction module 530 is used to obtain node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information;

[0083] The model training module 540 is used to construct the local data flow feature information into a data set, and input the data set into the model training, so as to construct and train a UEChecker model for security detection of decentralized application smart contracts;

[0084] The security detection module 550 is used to perform vulnerability security detection on the DApp smart contract through the UEChecker model.

[0085] In one embodiment, the data collection module 510 is also used to collect the decentralized application DApp smart contract source code in real time through the DappRadar blockchain browser based on the API interface; wherein the DApp smart contract source code includes the smart contract, library function, and DApp transaction record corresponding to the Dapp.

[0086] In one embodiment, the call graph construction module 520 is also used to construct an abstract syntax tree through bytecode to determine the functions, variables, inheritance relationships and mutual call flows in the smart contract; based on the functions, variables, inheritance relationships and mutual call flows, identify the call path and dependency relationships of each function, simulate the internal and cross-contract function calls and data flows of the smart contract, and construct a contract call graph.

[0087] In one embodiment, the feature extraction module 530 is also used to extract node information, generate an identification ID through the node information, and create a node-to-ID vocabulary; create a multi-dimensional embedding matrix, and convert the vocabulary into a continuous numerical vector through the multi-dimensional embedding matrix; extract the structural information and node features of the contract call graph based on the multi-dimensional embedding matrix, the continuous numerical vector, and the vocabulary as local data flow feature information.

[0088] In one embodiment, the structural information and node features include: an adjacency dictionary, node features, node labels, an adjacency matrix, and vulnerability labels of the contract call graph.

[0089] In one embodiment, the model training module 540 is also used to reconstruct the adjacency matrix of each pair of nodes according to the node features, and construct a linear layer and a batch normalization layer to predict the edges of each pair of nodes; define a clustering layer, and assign cluster centers to the graph nodes in the contract call graph through the clustering layer to obtain the cluster assignment of each node; design a Conformer layer, and input the contract call graph after the cluster assignment to capture global features and local features; input the global features and local features into the graph convolutional neural network for learning, and train to obtain the UEChecker model.

[0090] In one embodiment, the model training module 540 is also used to calculate the Euclidean distance between each node in the contract call graph and all cluster centers; based on the Euclidean distance, the nearest cluster center is assigned to each node to obtain the cluster assignment of each node.

[0091] In one embodiment, the model training module 540 is also used to set a convolutional neural network, a feedforward neural network, and a self-attention mechanism in the Conformer layer; based on the contract call graph after clustering allocation, the self-attention mechanism is used to perform node position dot product calculations, and dynamic weighted aggregation is performed to capture global features; based on the contract call graph after clustering allocation, the convolution operation is used by the convolution kernel to perform sliding calculations through the convolution operation to capture local features of the contract call graph.

[0092] In one embodiment, the model training module 540 is also used to identify different types of adjacency matrices through a graph convolutional neural network, and perform convolution based on global features and local features, perform power and weighted processing on the adjacency matrix, and learn detailed features in the contract call graph; based on the detailed features, it is determined whether there are vulnerabilities in the smart contract through pooling and fully connected layers, and the UEChecker model is trained.

[0093] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a security detection method for a decentralized application smart contract based on bytecode is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0094] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0095] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, steps of a security detection method for a decentralized application smart contract based on bytecode are implemented.

[0096] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of a security detection method for a decentralized application smart contract based on bytecode are implemented.

[0097] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0098] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A security detection method for decentralized application smart contracts based on bytecode, characterized in that: The method comprises: Collect decentralized application DApp smart contract source code from the database based on API interface; Convert the DApp smart contract source code into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree; Obtaining node information and edge information of each smart contract according to the contract call graph, and extracting local data flow feature information based on the node information and edge information; The local data stream feature information is constructed into a data set, and the data set is input into model training to construct and train a UEChecker model for security detection of decentralized application smart contracts; The UEChecker model is used to perform vulnerability security detection on the DApp smart contract.

2. The security detection method for decentralized application smart contracts based on bytecode according to claim 1 is characterized in that: Collect decentralized application DApp smart contract source code from the database based on the API interface, including: Based on the API interface, the DappRadar blockchain browser collects the source code of decentralized application DApp smart contracts in real time; Among them, the DApp smart contract source code contains the smart contract, library functions, and DApp transaction records corresponding to the Dapp.

3. The security detection method for decentralized application smart contracts based on bytecode according to claim 1 is characterized in that: Constructing an abstract syntax tree through the bytecode, and constructing a contract call graph based on the abstract syntax tree, including: An abstract syntax tree is constructed through the bytecode to determine functions, variables, inheritance relationships, and mutual call flows in the smart contract; Based on the functions, variables, inheritance relationships, and mutual call flows, identify the call path and dependencies of each function, simulate the function calls and data flows within and across smart contracts, and build a contract call graph.

4. The security detection method for decentralized application smart contracts based on bytecode according to claim 1 is characterized in that: Extracting local data flow feature information based on the node information and edge information includes: Extract the node information, generate an ID through the node information, and create a vocabulary from node to ID; Creating a multi-dimensional embedding matrix and converting the vocabulary into a continuous numerical vector through the multi-dimensional embedding matrix; The structural information and node features of the contract call graph are extracted according to the multi-dimensional embedding matrix, the continuous numerical vector, and the vocabulary as local data flow feature information.

5. The security detection method for decentralized application smart contracts based on bytecode according to claim 4 is characterized in that: The structural information and node features include: an adjacency dictionary, node features, node labels, an adjacency matrix, and vulnerability labels of the contract call graph.

6. The security detection method for decentralized application smart contracts based on bytecode according to claim 4 is characterized in that: The local data stream feature information is constructed as a data set, and the data set is input into model training, and the UEChecker model is constructed and trained, including: Reconstructing the adjacency matrix of each pair of nodes according to the node features, and constructing a linear layer and a batch normalization layer for predicting the edges of each pair of nodes; Define a clustering layer, and assign cluster centers to graph nodes in the contract call graph through the clustering layer to obtain cluster assignments for each node; Design the Conformer layer to capture global and local features by inputting the contract call graph after clustering assignment; The global features and local features are input into the graph convolutional neural network for learning, and the UEChecker model is obtained through training.

7. The security detection method for decentralized application smart contracts based on bytecode according to claim 6 is characterized in that: Assigning cluster centers to the graph nodes in the contract call graph through the clustering layer to obtain cluster assignments for each node, including: Calculate the Euclidean distance between each node in the contract call graph and all cluster centers; Based on the Euclidean distance, each node is assigned a cluster center with the closest distance to obtain a cluster assignment for each node.

8. The security detection method for decentralized application smart contracts based on bytecode according to claim 6 is characterized in that: The Conformer layer is designed to capture global and local features of the contract call graph after clustering assignment, including: Set up convolutional neural network, feedforward neural network, and self-attention mechanism in the Conformer layer; Through the self-attention mechanism, the node position dot product calculation is performed based on the contract call graph after clustering allocation, and dynamic weighted aggregation is performed to capture global features; The convolutional neural network and the feedforward neural network are used to capture the local features of the contract call graph based on the contract call graph after clustering allocation, and the convolution operation is used to perform sliding calculation through the convolution kernel.

9. The security detection method for decentralized application smart contracts based on bytecode according to claim 6 is characterized in that: The global features and local features are input into the graph convolutional neural network for learning, and the UEChecker model is obtained through training, including: Identify different types of adjacency matrices through the graph convolutional neural network, perform convolution based on the global features and local features, perform power and weighting processing on the adjacency matrix, and learn detailed features in the contract call graph; Based on the detailed features, the pooling and fully connected layers are used to determine whether the smart contract has vulnerabilities, and the UEChecker model is trained.

10. A security detection system for decentralized application smart contracts based on bytecode, characterized in that: The system comprises: Data collection module, used to collect decentralized application DApp smart contract source code from the database based on API interface; A call graph construction module, used to convert the DApp smart contract source code into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree; A feature extraction module, used to obtain node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information; A model training module, used to construct the local data stream feature information into a data set, and input the data set into model training, so as to construct and train a UEChecker model for security detection of decentralized application smart contracts; The security detection module is used to perform vulnerability security detection on the DApp smart contract through the UEChecker model.

Images