Security Detection Method and System for Decentralized Application Smart Contracts Based on Bytecode

Abstract

The present invention relates to a bytecode-based security detection method and system for decentralized application smart contracts. The method comprises: collecting decentralized application (DApp) smart contract source code from a database based on an API interface, converting it into bytecode, and constructing an abstract syntax tree and a contract call graph; extracting local data flow feature information from the contract call graph to construct a data set, and constructing and training a UEChecker model for security detection of decentralized application smart contracts. By obtaining DApp smart contract information and converting it into bytecode to construct an abstract syntax tree, the constructed contract call graph can obtain node and edge information for each smart contract, so that the trained model can better learn the local and global features of the smart contract call graph, so that the finally trained UEChecker model can detect whether there is malicious behavior in the decentralized application smart contract, thereby improving the effectiveness of detecting DApp smart contract vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and in particular to a security detection method and system for decentralized application smart contracts based on bytecode. Background Technology

[0002] With the development of blockchain technology, decentralized applications (DApps) and cryptographic protocols have extremely high locked value, attracting a large number of active cryptocurrency users worldwide. Specifically, by embedding established logic into smart contracts and storing them on the blockchain, these smart contracts can execute automatically without the intervention of any centralized institution. This emerging technology allows users to autonomously control their personal funds, thanks to the security and transparency provided by smart contracts. As blockchain and cryptocurrencies mature, DApps are rapidly expanding into various fields, including finance, gaming, NFTs, and social media. However, attacks on smart contracts are also becoming increasingly serious. For example, attackers have exploited a critical vulnerability in DApp smart contracts—a reentrancy attack and price manipulation vulnerability—to successfully steal valuable crypto assets. Attackers have also exploited flawed mechanisms in smart contracts regarding borrowing and collateral, allowing them to borrow large amounts of assets without sufficient collateral, resulting in significant losses. Due to the complexity of DApp contracts and the rapid development of application functions, many DApps have suffered various types of attacks, and the resulting losses are becoming increasingly severe.

[0003] Existing methods for detecting security vulnerabilities in decentralized application (DApp) smart contracts simulate the operational logic of DApp smart contracts using various technologies, leverage expert knowledge to summarize patterns in vulnerability occurrences, and then set various detection rules to determine whether the DApp contract contains security vulnerabilities. Traditional methods such as symbolic execution, static analysis, and formal verification can quickly detect vulnerabilities, but they heavily rely on expert knowledge, often resulting in a large number of false positives and consuming significant computational resources. Deep learning-based detection methods automatically learn vulnerability characteristics from DApp attack contracts to identify attack events. However, current deep learning models are not accurate enough in detecting certain types of vulnerabilities, leading to shortcomings in the detection performance of deep learning in DApps. Summary of the Invention

[0004] In order to solve the above technical problems, a security detection method and system for decentralized application smart contracts based on bytecode is provided. This method can utilize the function call flow information in DApp smart contracts to achieve DApp smart contract security detection.

[0005] A security detection method for decentralized application smart contracts based on bytecode, the method comprising:

[0006] The source code of decentralized application (DApp) smart contracts is collected from the database based on the API interface;

[0007] The source code of the DApp smart contract is converted into bytecode, an abstract syntax tree is constructed using the bytecode, and a contract call graph is constructed based on the abstract syntax tree.

[0008] Obtain the node information and edge information of each smart contract based on the contract call graph, and extract local data flow feature information based on the node information and edge information;

[0009] The local data stream feature information is used to construct a dataset, and the dataset is input into the model for training. The trained UEChecker model is then used to perform security checks on decentralized application smart contracts.

[0010] The UEChecker model is used to perform vulnerability and security checks on DApp smart contracts.

[0011] In one embodiment, the source code of decentralized application (DApp) smart contracts is collected from a database via an API interface, including:

[0012] The DappRadar blockchain explorer collects the source code of decentralized application (DApp) smart contracts in real time based on the API interface.

[0013] The DApp smart contract source code contains the smart contract, library functions, and DApp transaction records corresponding to the DApp.

[0014] In one embodiment, an abstract syntax tree is constructed using the bytecode, and a contract call graph is constructed based on the abstract syntax tree, including:

[0015] An abstract syntax tree is constructed using the bytecode to determine the functions, variables, inheritance relationships, and mutual call flows in the smart contract.

[0016] Based on the functions, variables, inheritance relationships, and mutual call flows, the call path and dependencies of each function are identified, and the internal and cross-contract function calls and data flows of the smart contract are simulated to construct the contract call graph.

[0017] In one embodiment, local data stream feature information is extracted based on the node information and edge information, including:

[0018] Extract the node information, generate an identifier ID using the node information, and create a vocabulary of nodes to IDs;

[0019] Create a multi-dimensional embedding matrix, and use the multi-dimensional embedding matrix to transform the vocabulary into a continuous numerical vector;

[0020] The structural information and node features of the contract call graph are extracted based on the multi-dimensional embedding matrix, continuous numerical vectors, and vocabulary, and used as local data flow feature information.

[0021] In one embodiment, the structural information and node features include: the adjacency dictionary, node features, node labels, adjacency matrix, and vulnerability labels of the contract call graph.

[0022] In one embodiment, the local data stream feature information is used to construct a dataset, and the dataset is input into the model for training to construct and train the UEChecker model, including:

[0023] Based on the node features, the adjacency matrix of each pair of nodes is reconstructed, and a linear layer and a batch normalization layer are constructed to predict the edges of each pair of nodes.

[0024] Define a clustering layer, and assign clustering centers to the graph nodes in the contract call graph through the clustering layer to obtain the clustering assignment of each node;

[0025] Design the Conformer layer to input the clustered contract call graph to capture global and local features;

[0026] The global and local features are input into a graph convolutional neural network for learning, and the UEChecker model is trained.

[0027] In one embodiment, cluster centers are assigned to graph nodes in the contract call graph through the clustering layer to obtain the clustering assignment for each node, including:

[0028] Calculate the Euclidean distance between each node in the contract call graph and all cluster centers;

[0029] Based on the Euclidean distance, the nearest cluster center is assigned to each node, thus obtaining the cluster assignment for each node.

[0030] In one embodiment, a Conformer layer is designed to take the clustered contract call graph as input and capture global and local features, including:

[0031] Set up a convolutional neural network, a feedforward neural network, and a self-attention mechanism in the Conformer layer;

[0032] The self-attention mechanism is used to perform dot product calculation of node positions based on the contract call graph after clustering and allocation, and to perform dynamic weighted aggregation to capture global features.

[0033] Based on the clustered contract call graph, the convolutional neural network and feedforward neural network use convolution operations to perform sliding calculations through the convolution kernel to capture local features of the contract call graph.

[0034] In one embodiment, the global features and local features are input into a graph convolutional neural network for learning, and the UEChecker model is trained, including:

[0035] Different types of adjacency matrices are identified through the graph convolutional neural network, and convolution is performed based on the global and local features. The power and weighting of the adjacency matrices are processed to learn the detailed features of the contract call graph.

[0036] Based on the detailed features, the system uses pooling and a fully connected layer to determine whether a smart contract has vulnerabilities, and then trains the UEChecker model.

[0037] A security detection system for decentralized application smart contracts based on bytecode, the system comprising:

[0038] The data acquisition module is used to collect the source code of decentralized application (DApp) smart contracts from the database based on the API interface;

[0039] The call graph construction module is used to convert the source code of the DApp smart contract into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree;

[0040] The feature extraction module is used to obtain the node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information;

[0041] The model training module is used to construct a dataset from the local data stream feature information, and input the dataset into the model training to construct the UEChecker model, which is used to perform security detection on decentralized application smart contracts.

[0042] The security detection module is used to perform vulnerability security detection on DApp smart contracts through the UEChecker model.

[0043] The aforementioned bytecode-based security detection method and system for decentralized application smart contracts obtains information about DApp smart contracts and converts it into bytecode to construct an abstract syntax tree. The constructed contract call graph can obtain the node and edge information of each smart contract, enabling the trained model to better learn the local and global features of the smart contract call graph. This allows the finally trained UEChecker model to detect malicious behavior in decentralized application smart contracts, improving the effectiveness of detecting DApp smart contract vulnerabilities. Attached Figure Description

[0044] Figure 1 This is an application environment diagram of a bytecode-based security detection method for decentralized application smart contracts in one embodiment.

[0045] Figure 2 This is a flowchart illustrating a security detection method for decentralized application smart contracts based on bytecode in one embodiment.

[0046] Figure 3 This is a visual DApp smart contract call graph generated from bytecode in one embodiment;

[0047] Figure 4 This is a flowchart illustrating a security detection method for decentralized application smart contracts based on bytecode in one embodiment.

[0048] Figure 5 This is a structural block diagram of a bytecode-based decentralized application smart contract security detection system in one embodiment;

[0049] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] The bytecode-based security detection method for decentralized application smart contracts provided in this application can be applied to, for example... Figure 1 The application environment shown. For example... Figure 1As shown, the application environment includes computer device 110. Computer device 110 can collect the source code of decentralized application (DApp) smart contracts from a database via an API interface; computer device 110 can convert the DApp smart contract source code into bytecode, construct an abstract syntax tree (AST) from the bytecode, and build a contract call graph based on the AST; computer device 110 can obtain the node and edge information of each smart contract based on the contract call graph, and extract local data flow feature information based on the node and edge information; computer device 110 can construct a dataset from the local data flow feature information, and input the dataset into a model for training, constructing a trained UEChecker model for security testing of decentralized application smart contracts; computer device 110 can perform vulnerability security testing on DApp smart contracts using the UEChecker model. The computer device 110 can be, but is not limited to, various personal computers, laptops, robots, and other devices.

[0052] In one embodiment, such as Figure 2 As shown, a security detection method for decentralized application smart contracts based on bytecode is provided, including the following steps:

[0053] Step 202: Collect the source code of decentralized application (DApp) smart contracts from the database based on the API interface.

[0054] Specifically, in one embodiment, a security detection method for decentralized application smart contracts based on bytecode may further include the process of collecting DApp smart contracts through the DappRadar blockchain explorer. The specific process includes: collecting the source code of decentralized application DApp smart contracts in real time through the DappRadar blockchain explorer based on the API interface; wherein, the DApp smart contract source code contains the smart contract, library functions, and DApp transaction records corresponding to the DApp.

[0055] In this embodiment, the computer device can collect smart contracts of popular DApps in real time through the DappRadar blockchain explorer and the official API, including detailed information such as all smart contracts, library functions, and transaction details of the DApps.

[0056] Step 204: Convert the DApp smart contract source code into bytecode, construct an abstract syntax tree using the bytecode, and construct a contract call graph based on the abstract syntax tree.

[0057] After converting the source code of a DApp smart contract into bytecode, the function and variable call relationships between different contracts in the DApp can be simulated by constructing a call graph.

[0058] In one embodiment, a security detection method for decentralized application smart contracts based on bytecode may further include a process of constructing a contract call graph. The specific process includes: constructing an abstract syntax tree through bytecode to determine the functions, variables, inheritance relationships, and mutual call flows in the smart contract; identifying the call path and dependencies of each function based on the functions, variables, inheritance relationships, and mutual call flows; simulating internal and cross-contract function calls and data flows within the smart contract; and constructing a contract call graph.

[0059] Computer devices can construct contract abstract syntax trees using bytecode, analyze functions, variables, and call flows between different contracts, thereby simulating the dependencies between each function and contract, extracting the internal call relationships of the contract, and generating a contract call graph corresponding to the smart contract. The visualized DApp smart contract call graph generated by the computer device from the bytecode is shown below. Figure 3 As shown.

[0060] Step 206: Obtain the node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information.

[0061] Computer equipment can extract call graph information and node characteristics from the generated contract call graph.

[0062] In one embodiment, a security detection method for decentralized application smart contracts based on bytecode may further include an information extraction process, specifically including: extracting node information and generating identifier IDs through the node information, and creating a vocabulary of nodes to IDs; creating a multi-dimensional embedding matrix and converting the vocabulary into continuous numerical vectors through the multi-dimensional embedding matrix; and extracting structural information and node features of the contract call graph based on the multi-dimensional embedding matrix, continuous numerical vectors, and vocabulary as local data flow feature information.

[0063] In this process, the computer device can define functions and variables as nodes, and the flow between nodes as edges, to obtain information about each node and edge in the call graph. Then, it extracts the full graph node information, such as function names and variable names, and creates a vocabulary of nodes to IDs by extracting the relevant information of the nodes. Next, it can initialize a multi-dimensional embedding matrix and convert the created vocabulary into vectors. Then, based on the node vocabulary, the embedding matrix, and the call graph, it constructs the call graph connectivity matrix and node features.

[0064] Computer devices can parse node IDs and labels, convert each node into an embedding vector using a vocabulary, and construct an adjacency matrix based on the edge flow information of the call graph to represent the node connection situation of the call graph.

[0065] Specifically, the structural information and node characteristics include: the adjacency dictionary of the contract call graph, node characteristics, node labels, adjacency matrix, and vulnerability labels.

[0066] Step 208: Construct a dataset from the local data stream feature information, and input the dataset into the model for training. Build the trained UEChecker model, which is used for security testing of decentralized application smart contracts.

[0067] Computer devices can construct a dataset from the collected call graph feature information and input it into the model for training.

[0068] Specifically, in one embodiment, a security detection method for decentralized application smart contracts based on bytecode may further include a model training and learning process. This process includes: reconstructing the adjacency matrix of each pair of nodes based on node features, and constructing a linear layer and a batch normalization layer to predict the edges of each pair of nodes; defining a clustering layer to assign cluster centers to graph nodes in the contract call graph, thus obtaining the clustering assignment for each node; designing a Conformer layer to input the clustered contract call graph to capture global and local features; and inputting the global and local features into a graph convolutional neural network for learning, thereby training the UEChecker model.

[0069] In one embodiment, the computer device can calculate the Euclidean distance between each node in the contract call graph and all cluster centers; based on the Euclidean distance, each node is assigned the nearest cluster center, resulting in a cluster assignment for each node. Specifically, the computer device can reconstruct the edge connection information of each pair of nodes based on the adjacency matrix and node features; then, a clustering layer is defined to cluster the nodes in the reconstructed adjacency matrix, and by calculating the Euclidean set distance between the node and the cluster center, the node is classified into the corresponding cluster center, guiding the model to learn more closely related features.

[0070] In one embodiment, the computer device can set up a convolutional neural network, a feedforward neural network, and a self-attention mechanism in the Conformer layer; the self-attention mechanism performs dot product calculation of node positions based on the clustered contract call graph, and performs dynamic weighted aggregation to capture global features; the convolutional neural network and the feedforward neural network use convolution operations to perform sliding calculations through convolution kernels based on the clustered contract call graph to capture local features of the contract call graph.

[0071] That is, a Conformer layer is designed, into which the adjacency matrix obtained after node clustering is input to learn the global and local feature information of the call graph. In this embodiment, the Conformer layer combines convolutional neural networks, feedforward neural networks, and self-attention mechanisms. The self-attention mechanism captures global features by performing positional dot product calculations and dynamically weighting aggregation based on the correlation of input features; and captures local information of the call graph by using convolution operations to slide a fixed-size convolution kernel across the input.

[0072] In one embodiment, a computer device can identify different types of adjacency matrices through a graph convolutional neural network, and perform convolution based on global and local features, perform power and weighted processing on the adjacency matrices, and learn the detailed features of the contract call graph; based on the detailed features, it can determine whether there are vulnerabilities in the smart contract through pooling and fully connected layers, and train the UEChecker model.

[0073] Specifically, the computer device can input the obtained global and local features of the call graph into a graph convolutional neural network for learning. The graph neural network implements a multi-functional graph convolutional layer that enhances graph connectivity by convolving node information in the graph through different types of adjacency matrices and by using powers of adjacency matrices and weighted self-connections, thus learning the detailed features of nodes. Finally, the computer device can use the obtained call graph feature information to determine whether a contract has vulnerabilities through pooling and fully connected layers.

[0074] Step 210: Perform vulnerability and security checks on the DApp smart contract using the UEChecker model.

[0075] In other words, computer devices can use the UEChecker model to determine whether a DApp smart contract has vulnerabilities.

[0076] In this embodiment, the usage flow of a bytecode-based decentralized application smart contract security detection method is as follows: Figure 4 As shown, the main steps include converting the source code of DApp smart contracts into bytecode; constructing a contract call graph; obtaining node and edge information for each smart contract; building a dataset to train the UEChecker model; and performing vulnerability and security detection on DApp smart contracts using the UEChecker model.

[0077] This application provides a bytecode-based security detection method for decentralized application smart contracts. By acquiring information about DApp smart contracts and converting it into bytecode to construct an abstract syntax tree, the constructed contract call graph can obtain the node and edge information of each smart contract. This allows the trained model to better learn the local and global features of the smart contract call graph, enabling the finally trained UEChecker model to detect malicious behavior in decentralized application smart contracts and improve the effectiveness of detecting DApp smart contract vulnerabilities.

[0078] It should be understood that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart above may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0079] In one embodiment, such as Figure 5 As shown, a security detection system for decentralized application smart contracts based on bytecode is provided, including: a data acquisition module 510, a call graph construction module 520, a feature extraction module 530, a model training module 540, and a security detection module 550, wherein:

[0080] Data acquisition module 510 is used to collect the source code of decentralized application (DApp) smart contracts from the database based on the API interface;

[0081] The call graph construction module 520 is used to convert the source code of DApp smart contracts into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree;

[0082] The feature extraction module 530 is used to obtain the node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information;

[0083] The model training module 540 is used to construct a dataset from the feature information of the local data stream, and input the dataset into the model for training to build the UEChecker model, which is used to perform security detection on decentralized application smart contracts.

[0084] The security detection module 550 is used to perform vulnerability security detection on DApp smart contracts using the UEChecker model.

[0085] In one embodiment, the data acquisition module 510 is also used to collect the source code of decentralized application (DApp) smart contracts in real time through the DappRadar blockchain explorer based on the API interface; wherein, the DApp smart contract source code contains the smart contract, library functions, and DApp transaction records corresponding to the DApp.

[0086] In one embodiment, the call graph construction module 520 is further configured to construct an abstract syntax tree through bytecode, determine the functions, variables, inheritance relationships, and mutual call flows in the smart contract; based on the functions, variables, inheritance relationships, and mutual call flows, identify the call path and dependencies of each function, simulate the internal and cross-contract function calls and data flows of the smart contract, and construct the contract call graph.

[0087] In one embodiment, the feature extraction module 530 is further configured to extract node information, generate identifier IDs through the node information, create a vocabulary of nodes to IDs, create a multi-dimensional embedding matrix, and convert the vocabulary into continuous numerical vectors through the multi-dimensional embedding matrix; extract the structural information and node features of the contract call graph based on the multi-dimensional embedding matrix, the continuous numerical vectors, and the vocabulary, as local data flow feature information.

[0088] In one embodiment, the structural information and node characteristics include: an adjacency dictionary of the contract call graph, node characteristics, node labels, an adjacency matrix, and vulnerability labels.

[0089] In one embodiment, the model training module 540 is further configured to reconstruct the adjacency matrix of each pair of nodes based on node features, and construct a linear layer and a batch normalization layer to predict the edges of each pair of nodes; define a clustering layer to assign cluster centers to graph nodes in the contract call graph, thereby obtaining the clustering assignment of each node; design a Conformer layer to input the contract call graph after clustering assignment to capture global and local features; and input the global and local features into a graph convolutional neural network for learning, thereby training the UEChecker model.

[0090] In one embodiment, the model training module 540 is further configured to calculate the Euclidean distance between each node in the contract call graph and all cluster centers; based on the Euclidean distance, assign the nearest cluster center to each node to obtain the cluster assignment of each node.

[0091] In one embodiment, the model training module 540 is further configured to set up a convolutional neural network, a feedforward neural network, and a self-attention mechanism in the Conformer layer; perform dot product calculation of node positions based on the clustered contract call graph using the self-attention mechanism, and perform dynamic weighted aggregation to capture global features; and capture local features of the contract call graph by using convolution operations to perform sliding calculations through convolution kernels based on the clustered contract call graph using the convolutional neural network and the feedforward neural network.

[0092] In one embodiment, the model training module 540 is further configured to identify different types of adjacency matrices through a graph convolutional neural network, and perform convolution based on global and local features, perform power and weighting processing on the adjacency matrices, learn detailed features in the contract call graph, and determine whether there are vulnerabilities in the smart contract through pooling and fully connected layers based on the detailed features, thereby training the UEChecker model.

[0093] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a security detection method for bytecode-based decentralized application smart contracts. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0094] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0095] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement steps of a bytecode-based decentralized application smart contract security detection method.

[0096] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program implementing, when executed by a processor, the steps of a bytecode-based decentralized application smart contract security detection method.

[0097] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0098] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A security detection method for decentralized application smart contracts based on bytecode, characterized in that, The method includes: The source code of decentralized application (DApp) smart contracts is collected from the database based on the API interface; The source code of the DApp smart contract is converted into bytecode, an abstract syntax tree is constructed using the bytecode, and a contract call graph is constructed based on the abstract syntax tree. The node and edge information of each smart contract are obtained according to the contract call graph. Local data flow feature information is extracted based on the node and edge information, including: extracting the node information and generating an identifier ID through the node information, and creating a vocabulary of nodes to IDs; creating a multi-dimensional embedding matrix and converting the vocabulary into a continuous numerical vector through the multi-dimensional embedding matrix; extracting the structural information and node features of the contract call graph according to the multi-dimensional embedding matrix, the continuous numerical vector, and the vocabulary, as local data flow feature information. The local data stream feature information is used to construct a dataset, and the dataset is input into the model for training to obtain the UEChecker model, which is used for security detection of decentralized application smart contracts. This includes: reconstructing the adjacency matrix of each pair of nodes based on the node features, and constructing a linear layer and a batch normalization layer to predict the edges of each pair of nodes; defining a clustering layer to assign cluster centers to graph nodes in the contract call graph, obtaining the clustering assignment for each node; designing a Conformer layer to input the clustered contract call graph to capture global and local features; inputting the global and local features into a graph convolutional neural network for learning, and training the UEChecker model, including: identifying different types of adjacency matrices through the graph convolutional neural network, performing convolution based on the global and local features, and processing the power and weight of the adjacency matrix to learn the detailed features in the contract call graph; and judging whether the smart contract has vulnerabilities based on the detailed features through pooling and fully connected layers, thus training the UEChecker model. The UEChecker model is used to perform vulnerability and security checks on DApp smart contracts.

2. The security detection method for decentralized application smart contracts based on bytecode according to claim 1, characterized in that, The source code of decentralized application (DApp) smart contracts is collected from the database based on the API interface, including: The DappRadar blockchain explorer collects the source code of decentralized application (DApp) smart contracts in real time based on the API interface. The DApp smart contract source code contains the smart contract, library functions, and DApp transaction records corresponding to the DApp.

3. The security detection method for decentralized application smart contracts based on bytecode according to claim 1, characterized in that, An abstract syntax tree is constructed using the bytecode, and a contract call graph is constructed based on the abstract syntax tree, including: An abstract syntax tree is constructed using the bytecode to determine the functions, variables, inheritance relationships, and mutual call flows in the smart contract. Based on the functions, variables, inheritance relationships, and mutual call flows, the call path and dependencies of each function are identified, and the internal and cross-contract function calls and data flows of the smart contract are simulated to construct the contract call graph.

4. The security detection method for decentralized application smart contracts based on bytecode according to claim 1, characterized in that, The structural information and node features include: the adjacency dictionary, node features, node labels, adjacency matrix, and vulnerability labels of the contract call graph.

5. The security detection method for decentralized application smart contracts based on bytecode according to claim 1, characterized in that, The clustering layer assigns cluster centers to the graph nodes in the contract call graph, resulting in the clustering assignment for each node, including: Calculate the Euclidean distance between each node in the contract call graph and all cluster centers; Based on the Euclidean distance, the nearest cluster center is assigned to each node, thus obtaining the cluster assignment for each node.

6. The security detection method for decentralized application smart contracts based on bytecode according to claim 1, characterized in that, The Conformer layer is designed to take the clustered contract call graph as input and capture global and local features, including: Set up a convolutional neural network, a feedforward neural network, and a self-attention mechanism in the Conformer layer; The self-attention mechanism is used to perform dot product calculation of node positions based on the contract call graph after clustering and allocation, and to perform dynamic weighted aggregation to capture global features. Based on the clustered contract call graph, the convolutional neural network and feedforward neural network use convolution operations to perform sliding calculations through the convolution kernel to capture local features of the contract call graph.

7. A security detection system for decentralized application smart contracts based on bytecode, characterized in that, The system includes: The data acquisition module is used to collect the source code of decentralized application (DApp) smart contracts from the database based on the API interface; The call graph construction module is used to convert the source code of the DApp smart contract into bytecode, construct an abstract syntax tree through the bytecode, and construct a contract call graph based on the abstract syntax tree; The feature extraction module is used to obtain node information and edge information of each smart contract according to the contract call graph, and extract local data flow feature information based on the node information and edge information, including: extracting the node information, generating an identifier ID through the node information, and creating a vocabulary of nodes to IDs; creating a multi-dimensional embedding matrix, and converting the vocabulary into a continuous numerical vector through the multi-dimensional embedding matrix; and extracting the structural information and node features of the contract call graph according to the multi-dimensional embedding matrix, the continuous numerical vector, and the vocabulary as local data flow feature information. The model training module is used to construct a dataset from the local data stream feature information and input the dataset into the model for training, thereby constructing and training the UEChecker model for security detection of decentralized application smart contracts. This includes: reconstructing the adjacency matrix of each pair of nodes based on the node features, and constructing a linear layer and a batch normalization layer to predict the edges of each pair of nodes; defining a clustering layer to assign cluster centers to graph nodes in the contract call graph, obtaining the cluster assignment for each node; designing a Conformer layer to input the clustered contract call graph to capture global and local features; inputting the global and local features into a graph convolutional neural network for learning, thereby training the UEChecker model, including: identifying different types of adjacency matrices through the graph convolutional neural network, performing convolution based on the global and local features, and processing the power and weight of the adjacency matrix to learn the detailed features in the contract call graph; and determining whether the smart contract has vulnerabilities based on the detailed features through pooling and fully connected layers, thereby training the UEChecker model. The security detection module is used to perform vulnerability security detection on DApp smart contracts through the UEChecker model.

Images