Intelligent contract vulnerability detection method and device based on multi-source data and electronic equipment

Abstract

The present disclosure relates to the technical field of network data security, and particularly relates to a smart contract vulnerability detection method and device based on multi-source data and electronic equipment, the method comprising: obtaining vulnerability information data, the vulnerability information data comprising vulnerability source code and vulnerability bytecode; performing extraction based on the vulnerability information data, determining key features, the key features comprising source code layer features, construction layer features and bytecode layer features; determining fusion layer features based on the source code layer features, the construction layer features and the bytecode layer features; determining feature differences based on the key features, the fusion layer features and a vulnerability detection algorithm; and determining a smart contract vulnerability based on the feature differences. The present disclosure greatly improves the accuracy of smart contract vulnerability detection, reduces missed detection and false detection, thereby enhancing the safety judgment of the smart contract.

Description

Technical Field

[0001] The present disclosure relates to the field of network data security technology, and in particular to a smart contract vulnerability detection method, device, and electronic device based on multi-source data. Background Art

[0002] With the rapid development of blockchain technology, smart contracts, as a key tool for implementing decentralized applications, are being widely adopted in various fields, including finance, supply chain management, and the Internet of Things. Smart contracts automatically execute contract terms through programming code. Their tamper-proof and self-executing properties can effectively reduce transaction costs and improve efficiency. However, this also raises security concerns. Since smart contract code cannot be modified once deployed on the blockchain, vulnerabilities can lead to serious consequences such as financial loss and data leakage, posing significant risks to users and developers. Smart contract vulnerabilities primarily stem from incomplete code, logical errors, and a lack of programming standards. Common vulnerabilities include reentrancy attacks, integer overflows, and timestamp dependency. If these vulnerabilities are not discovered and addressed promptly, they can have negative social impacts and undermine user trust in blockchain technology.

[0003] In view of this, this application is filed. Summary of the Invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the embodiments of the present disclosure provide a smart contract vulnerability detection method, device and electronic device based on multi-source data, which can effectively improve the accuracy of vulnerability detection, reduce missed detections and false detections, and thus enhance the security judgment of smart contracts.

[0005] In a first aspect, embodiments of the present disclosure provide a method for detecting smart contract vulnerabilities based on multi-source data, the method comprising:

[0006] Acquire vulnerability information data, wherein the vulnerability information data includes vulnerability source code and vulnerability bytecode;

[0007] Extracting the vulnerability information data and determining key features, the key features including source code layer features, build layer features, and bytecode layer features;

[0008] Determining fusion layer features based on the source code layer features, the construction layer features, and the bytecode layer features;

[0009] Determining feature differences based on the key features, the fusion layer features, and the vulnerability detection algorithm;

[0010] Based on the characteristic differences, the smart contract vulnerability is determined.

[0011] In a second aspect, the embodiments of the present disclosure further provide a device for detecting smart contract vulnerabilities using multi-source data, the device comprising:

[0012] A first acquisition module is used to acquire vulnerability information data, wherein the vulnerability information data includes vulnerability source code and vulnerability bytecode;

[0013] A first determination module is configured to extract and determine key features based on the vulnerability information data, wherein the key features include source code layer features, build layer features, and bytecode layer features;

[0014] A second determining module determines a fusion layer feature based on the source code layer feature, the construction layer feature, and the bytecode layer feature;

[0015] A third determination module is used to determine feature differences between the key features, the fusion layer features, and the vulnerability detection algorithm;

[0016] The fourth determination module is used to determine the smart contract vulnerability based on the feature difference.

[0017] In a third aspect, an embodiment of the present disclosure further provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs; and when the one or more programs are executed by the one or more processors, the one or more processors implement the smart contract vulnerability detection method based on multi-source data as described above.

[0018] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the smart contract vulnerability detection method based on multi-source data as described above.

[0019] The multi-source data smart contract vulnerability detection method provided by the embodiments of the present disclosure is conducive to more accurately identifying vulnerabilities and security risks in contracts by fusing source code layer features, construction layer features and bytecode layer features from different sources. By enhancing the security of smart contracts, the smart contract vulnerability detection algorithm is used to determine the difference between key features and fusion layer features to obtain smart contract vulnerabilities. The vulnerability detection algorithm can monitor the running status of the contract in real time, promptly discover and report potential security issues, reduce the need for manual intervention, further improve the accuracy of vulnerability detection, reduce missed detections and false detections, and thus enhance the security judgment of smart contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale.

[0021] Figure 1 Flowchart of a method for detecting smart contract vulnerabilities in multi-source data in an embodiment of the present disclosure.

[0022] Figure 2 Schematic diagram of the structure of a smart contract vulnerability detection device based on multi-source data in an embodiment of the present disclosure.

[0023] Figure 3 Schematic diagram of the structure of an electronic device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0025] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0026] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0027] Currently, the main methods for detecting smart contract vulnerabilities include static analysis, dynamic analysis, and formal verification. Each of these methods has its advantages and disadvantages. Static analysis can quickly identify potential issues in the code, but is prone to false positives. Dynamic analysis can be performed while the contract is actually running, providing a more realistic picture of its operation, but requires more test cases and environment setup, collects large amounts of data, and is less efficient. Formal verification can theoretically provide higher security guarantees, but its implementation is complex and places high demands on developers. As blockchain application scenarios continue to expand, different types of data sources are also proliferating, such as transaction data, on-chain data, and user behavior data. Traditional vulnerability detection methods often focus solely on static or dynamic analysis at the code level, neglecting the integration and in-depth analysis of data from other sources.

[0028] To address the above issues, the embodiments of the present disclosure provide a smart contract vulnerability detection method based on multi-source data, which effectively improves the accuracy of smart contract vulnerability detection, reduces missed detections and false detections, thereby enhancing the security judgment of smart contracts, and can monitor the operating status of contracts in real time, promptly discover and report potential security issues, reduce the need for manual intervention, and improve development efficiency.

[0029] Figure 1 This is a flow chart of a method for detecting smart contract vulnerabilities based on multi-source data in an embodiment of the present disclosure. This method can be executed by a smart contract vulnerability detection device based on multi-source data. The device can be implemented in software and / or hardware and can be configured in an electronic device. Figure 1 As shown, the method may specifically include the following steps:

[0030] S110: Acquire vulnerability information data, where the vulnerability information data includes vulnerability source code and vulnerability bytecode.

[0031] Among them, vulnerability information data can be vulnerability source code and vulnerability bytecode data of multiple vulnerabilities corresponding to the transaction records, event logs, state changes and other information of the smart contract obtained from the blockchain network. Vulnerability source code data and vulnerability bytecode data can be used to analyze the historical behavior and usage patterns of smart contracts.

[0032] S120: Extract and determine key features based on the vulnerability information data, where the key features include source code layer features, build layer features, and bytecode layer features.

[0033] Specifically, feature extraction is performed on the vulnerability source code and vulnerability bytecode in the vulnerability information data, and data that can reflect the security and potential risks of smart contract behavior is extracted as key features. Key features include source code layer features, build layer features, and bytecode layer features. The source code layer is the initial stage of smart contract development and is written in a readable high-level programming language. Separate semantic representations of vulnerability source code and comments can generate source code layer features. ,The source code layer features reflect the high-level semantics and structure of the ,smart contract, and are a direct reflection of the developer’s intention and ,contract logic.

[0034] The expression of source code layer features is:

[0035] ,

[0036] in, Represents source code layer features, Represents a text sequence of the vulnerable source code, Encoding features representing vulnerable source code text sequences, The bias term representing the text sequence of the vulnerable source code, express The sequence length.

[0037] It should be noted that the encoding features of the source code text sequence are the conversion of the source code text sequence into numerical form. These encoding features are extracted from the source code, including the encoding of the code's keywords, structure, control flow, data flow, etc.

[0038] Then, the construction layer involves the compilation process of the smart contract, which extracts the abstract syntax tree features from the vulnerable source code. and code semantic features The abstract syntax tree is a tree-like representation of the source code, which captures the organization of the code and the complex dependencies of control flow and data flow. The construction layer features contain rich syntactic and structural information, such as node types, control flow structures, and expression types. These features reveal the inherent connections of the contract logic. The expression of the abstract syntax tree feature is:

[0039] ,

[0040] The expression of the code semantic feature is:

[0041] ,

[0042] in, Represents source code layer features, Represents a text sequence of the vulnerable source code, express Midpoint Type , Represents control flow structures , Indicates the expression type , Represents the semantic features of the code, express Medium parameter variables , express Medium Function , express Medium data type .

[0043] It should be noted that Represents a specific type of node Whether it exists in the abstract syntax tree of the source code. It is used to indicate whether a specific syntax structure appears in the code. Different types of nodes represent different syntax elements. For example, a node may represent an if statement. If this statement exists, the node is encoded as 1, otherwise it is 0. 、 、 、 as well as and If it exists in the source code, it is coded as 1, and if it does not exist, it is coded as 0.

[0044] It is understandable that the bytecode layer is a low-level representation of the compiled smart contract, usually composed of a series of opcodes, which are specific instructions that the virtual machine can execute. The bytecode of the smart contract is converted into assembly code that is easier to analyze through a disassembler to obtain the bytecode layer features. Bytecode-level features can include opcodes, control flow structures, and access modifiers. These features are low-level descriptions of smart contract behavior and are closer to the code executed by the blockchain virtual machine. A disassembler is used to convert the smart contract's vulnerable bytecode into assembly code that is easier to analyze, obtaining bytecode-level features. The expression for bytecode-level features is:

[0045] ,

[0046] in, Represents bytecode layer features, express Medium opcode , express Control flow structure , express Access modifiers .

[0047] This example constructs multi-source features for smart contracts by extracting features from these three modalities. Each layer provides a different perspective on the contract, and the key features of the smart contract provide comprehensive data support for security testing. Secondly, the specific methods and implementations for feature selection and extraction are protected to ensure their uniqueness and effectiveness, thereby enhancing the accuracy of vulnerability detection.

[0048] It's important to note that each component of the source code (such as variables, functions, control structures, and expressions) is represented as a "node." Each node type describes the node's role or type in the syntax tree. For example, a variable node represents the declaration or use of a variable. A function node represents the definition or call of a function. A control structure node represents a conditional statement (such as if, switch) or a loop (such as for, while). An expression node represents a computational expression (such as arithmetic and logical operations). Different node types reflect the structure and logic of the source code, enabling analysis tools to understand the code's intent and behavior. Control flow structures are syntactic constructs in the source code that determine the execution order of the program. These include: conditional statements such as if, else, and switch, which determine the execution of different code blocks based on a condition. Loop structures such as for, while, and do-while, which repeatedly execute a code block until a condition is no longer met. Jump statements such as break, continue, and return, which alter the normal execution flow. Control flow structures are crucial to the logical control of a program and are therefore crucial in vulnerability detection, as many vulnerabilities are related to the execution path of a program. Expression Type (ExpressionType): Describes the different types of expressions used in source code. An expression is composed of operands and operators and represents a computable value. Common expression types include: Arithmetic expressions: Calculations involving operators such as addition, subtraction, multiplication, and division. Logical expressions: Boolean operations using logical operators (such as AND, OR, and NOT). Relational expressions: Comparison operations such as less than, greater than, and greater than or equal to. Assignment expressions: Expressions used for assignment, such as a = b + c.

[0049] S130: Determine fusion layer features based on the source code layer features, the construction layer features, and the bytecode layer features.

[0050] In one embodiment, determining the fusion layer features based on the source code layer features, the construction layer features, and the bytecode layer features includes:

[0051] Based on the source code layer feature, the abstract syntax tree feature, the code semantic feature, the bytecode layer feature and their corresponding weight factors, a fusion layer feature is determined.

[0052] On the basis of the above embodiment, after obtaining the source code layer features, the construction layer features and the bytecode layer features, the source code layer features, the construction layer features and the bytecode layer features are fused to obtain the fusion layer features. Specifically, the source code layer features and their corresponding weight factors, the abstract syntax tree features and their corresponding weight factors, the code semantic features and their corresponding weight factors, and the bytecode layer features and their corresponding weight factors are fused to obtain the fusion layer features.

[0053] The expression of the fusion layer feature is:

[0054] ,

[0055] in, represents the fusion layer features, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, represents the first fusion factor, represents the second fusion factor, Indicates feature point addition operation, Represents the feature point multiplication operation.

[0056] In this embodiment, the source code layer features, construction layer features, and bytecode layer features from different sources are integrated to more accurately identify vulnerabilities and security risks in the contract, thereby enhancing the security of the smart contract.

[0057] It should be noted that multi-source data refers to data from different sources, and the data sources can be transaction records, event logs, and status changes of smart contracts, etc.

[0058] S140: Determine feature differences based on the key features, the fusion layer features, and the vulnerability detection algorithm.

[0059] In one embodiment, before determining the feature difference based on the key feature, the fusion layer feature, and the vulnerability detection algorithm, the process includes:

[0060] A vulnerability detection algorithm is determined based on the key feature, the fusion layer feature, the feature size of the key feature, the feature size of the fusion layer feature, a first feature difference adjustment factor, a second feature difference adjustment factor, and a third feature difference adjustment factor.

[0061] In smart contract vulnerability detection, leveraging the advantages of multi-source data fusion allows for the development of more intelligent and comprehensive detection models through comprehensive analysis of on-chain transaction data, historical attack samples, user behavior patterns, and other information. For example, by integrating historical smart contract vulnerability databases, we can analyze past attack incidents against similar contracts, providing important reference for vulnerability detection in new contracts. Furthermore, with the advancement of machine learning and artificial intelligence technologies, model-based smart contract vulnerability detection methods are gaining attention. By training deep learning models, potential vulnerability patterns can be learned from a large number of contract features. Integrating multi-source data not only improves the model's detection accuracy but also significantly reduces the false positive rate. To achieve this goal, it is necessary to design a representative feature set that extracts key features related to smart contracts from multiple aspects, such as code structure, call relationships, and transaction history. The advantages of integrating multi-source data allow vulnerability detection systems to move beyond analyzing internal contract code and also incorporate external environmental factors, such as historical contract interactions and user account behavior patterns.

[0062] Exemplarily, before the key features and the fusion layer features are input into the vulnerability detection algorithm, it is necessary to construct a vulnerability detection algorithm. Specifically, the vulnerability detection algorithm is constructed based on the key features, the fusion layer features, the feature size of the key features, the feature size of the fusion layer features, the first feature difference adjustment factor, the second feature difference adjustment factor, the third feature difference adjustment factor, the feature period adjustment factor, and the Spearman rank correlation coefficient. The expression of the vulnerability detection algorithm is:

[0063] ,

[0064] in, Indicates feature differences, Represents key features, represents the first characteristic difference adjustment factor, represents the characteristic period adjustment factor, express The characteristic size of represents the second characteristic difference adjustment factor, express The characteristic size of represents the third characteristic difference adjustment factor, represents the Spearman rank correlation coefficient.

[0065] It should be noted that the key features used to construct and train the vulnerability detection algorithm are the key features extracted from the vulnerability information data in the aforementioned embodiments. These key features belong to different time periods, and the vulnerability detection algorithm is constructed using key features corresponding to historical time periods. The feature period adjustment factor affects the periodic nature of the feature difference calculation. The cosine and sine functions in the formula are two trigonometric functions that are very sensitive to changes in period. By varying the feature period adjustment factor, the difference between the key features and the fusion layer features can be "amplified" or "reduced" at different frequencies.

[0066] The vulnerability detection algorithm in this embodiment can automatically detect vulnerabilities in existing smart contracts, identifying potential security vulnerabilities and risks. This effectively improves vulnerability detection accuracy, reduces missed detections and false positives, and thus enhances the security assessment of smart contracts. It also combines the periodic cosine and sine functions with correlation metrics to assess differences. Vulnerability detection is performed based on the differences between fused features and key features, identifying smart contract vulnerabilities. This algorithm can monitor the operating status of contracts in real time, promptly discovering and reporting potential security issues, reducing the need for manual intervention and improving development efficiency.

[0067] S150. Determine the smart contract vulnerability based on the feature differences.

[0068] Based on the above embodiments, the vulnerability detection algorithm can determine the differences between key features and fusion layer features, namely feature differences. The feature differences of different features are then aggregated to identify significant feature differences. These differences are then further analyzed for their specific role in the smart contract and potential security impact to determine whether a vulnerability exists. For example, when the feature difference exceeds a set threshold, it is determined to be a significant difference, indicating a vulnerability in the smart contract.

[0069] The multi-source data-based smart contract vulnerability detection method provided in this embodiment is conducive to more accurately identifying vulnerabilities and security risks in contracts by fusing source code layer features, construction layer features, and bytecode layer features from different sources. By enhancing the security of smart contracts, the smart contract vulnerability detection algorithm is used to determine the differences between key features and fusion layer features to obtain smart contract vulnerabilities. The vulnerability detection algorithm can monitor the running status of the contract in real time, promptly discover and report potential security issues, reduce the need for manual intervention, further improve the accuracy of vulnerability detection, reduce missed detections and false detections, and thus enhance the security judgment of smart contracts.

[0070] Figure 2 Schematic diagram of the structure of the smart contract vulnerability detection device based on multi-source data in the embodiment of the present disclosure. Figure 2As shown, the device includes: a first acquisition module 210, a first determination module 220, a second determination module 230, a third determination module 240 and a fourth determination module 250.

[0071] A first acquisition module 210 is configured to extract and determine key features based on the vulnerability information data, wherein the key features include source code layer features, build layer features, and bytecode layer features;

[0072] A first determination module 220 is configured to extract and determine key features based on the vulnerability information data, wherein the key features include source code layer features, build layer features, and bytecode layer features;

[0073] A second determining module 230 determines a fusion layer feature based on the source code layer feature, the construction layer feature, and the bytecode layer feature;

[0074] A third determination module 240 is configured to determine feature differences based on the key features, the fusion layer features, and the vulnerability detection algorithm;

[0075] The fourth determination module 250 is configured to determine a smart contract vulnerability based on the feature difference.

[0076] The expression of the source code layer feature is:

[0077] ,

[0078] in, Represents source code layer features, Represents a text sequence of the vulnerable source code, Encoding features representing vulnerable source code text sequences, The bias term representing the text sequence of the vulnerable source code, express The sequence length.

[0079] The construction layer features include abstract syntax tree features and code semantic features, wherein the expression of the abstract syntax tree features is:

[0080] ,

[0081] The expression of the code semantic feature is:

[0082] ,

[0083] in, Represents source code layer features, Represents a text sequence of the vulnerable source code, express Midpoint Type , Represents control flow structures , Indicates the expression type , Represents the semantic features of the code, express Medium parameter variables , express Medium Function , express Medium data type .

[0084] The expression of the bytecode layer feature is:

[0085] ,

[0086] in, Represents bytecode layer features, express Medium opcode , express Control flow structure , express Access modifiers .

[0087] Optionally, the second determination module is further configured to determine fusion layer features based on the source code layer features, the abstract syntax tree features, the code semantic features, the bytecode layer features and their corresponding weight factors.

[0088] Among them, the expression of the fusion layer feature is:

[0089] ,

[0090] in, represents the fusion layer features, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, represents the first fusion factor, represents the second fusion factor, Indicates feature point addition operation, Represents the feature point multiplication operation.

[0091] The device also includes a fifth determination module, which is used to determine a vulnerability detection algorithm based on the key feature, the fusion layer feature, the feature size of the key feature, the feature size of the fusion layer feature, the first feature difference adjustment factor, the second feature difference adjustment factor and the third feature difference adjustment factor.

[0092] Among them, the expression of the vulnerability detection algorithm is:

[0093] ,

[0094] in, Indicates feature differences, Represents key features, represents the first characteristic difference adjustment factor, represents the characteristic period adjustment factor, express The characteristic size of represents the second characteristic difference adjustment factor, express The characteristic size of represents the third characteristic difference adjustment factor, represents the Spearman rank correlation coefficient.

[0095] The multi-source data-based smart contract vulnerability detection device provided in the embodiment of the present disclosure can execute the steps of the multi-source data-based smart contract vulnerability detection method provided in the embodiment of the method of the present disclosure. The execution steps and beneficial effects are not repeated here.

[0096] Figure 3 This is a schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 3 , which shows a structural diagram of an electronic device 500 suitable for implementing the embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0097] like Figure 3As shown, electronic device 500 may include a processing device 501, ROM 502, RAM 503, a bus 504, an input / output (I / O) interface 505, an input device 506, an output device 507, a storage device 508, and a communication device 509. The processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501 can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 502 or loaded from storage device 508 into random access memory (RAM) 503 to implement the multi-source data-based smart contract vulnerability detection method described in the embodiments of the present disclosure. RAM 503 also stores various programs and data required for the operation of electronic device 500. The processing device 501, ROM 502, and RAM 503 are interconnected via bus 504. An input / output (I / O) interface 505 is also connected to bus 504.

[0098] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart, thereby implementing the smart contract vulnerability detection method based on multi-source data as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0099] It should be noted that the computer-readable medium described above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable storage media may include, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or components, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wire, optical cable, RF (radio frequency), or any suitable combination thereof.

[0100] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device. The computer-readable medium carries one or more programs. When executed by the electronic device, the electronic device: obtains vulnerability information data, including vulnerability source code and vulnerability bytecode; extracts and determines key features based on the vulnerability information data, including source code layer features, build layer features, and bytecode layer features; determines fusion layer features based on the source code layer features, build layer features, and bytecode layer features; determines feature differences based on the key features, fusion layer features, and vulnerability detection algorithms; and determines smart contract vulnerabilities based on the feature differences.

[0101] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0102] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the foregoing.

[0103] The above description is only preferred embodiments of the present disclosure and a description of the principles of the technology used. It should be understood by those skilled in the art that the scope of the disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with each other to form technical solutions with similar functions disclosed in the present disclosure (but not limited to).

Claims

1. A smart contract vulnerability detection method based on multi-source data, characterized in that: The method comprises: Acquire vulnerability information data, wherein the vulnerability information data includes vulnerability source code and vulnerability bytecode; Extracting the vulnerability information data and determining key features, the key features including source code layer features, build layer features, and bytecode layer features; Determining fusion layer features based on the source code layer features, the construction layer features, and the bytecode layer features; Determining feature differences based on the key features, the fusion layer features, and the vulnerability detection algorithm; Based on the differences in the characteristics, the smart contract vulnerabilities are determined. The expression of the source code layer feature is: ， in, Represents source code layer features, Represents a text sequence of the vulnerable source code, Encoding features representing vulnerable source code text sequences, The bias term representing the text sequence of the vulnerable source code, express The sequence length, The construction layer features include abstract syntax tree features and code semantic features, wherein the expression of the abstract syntax tree features is: ， The expression of the code semantic feature is: ， in, Represents the abstract syntax tree feature, express Midpoint Type , Represents control flow structures , Indicates the expression type , Represents the semantic features of the code, express Medium parameter variables , express Medium Function , express Medium data type , The expression of the bytecode layer feature is: ， in, Represents bytecode layer features, express Medium opcode , express Control flow structure , express Access modifiers , The step of determining the fusion layer features based on the source code layer features, the construction layer features, and the bytecode layer features includes: Determine fusion layer features based on the source code layer features, the abstract syntax tree features, the code semantic features, the bytecode layer features and corresponding weight factors, Among them, the expression of the fusion layer feature is: ， in, represents the fusion layer features, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, represents the first fusion factor, represents the second fusion factor, Indicates feature point addition operation, Represents the feature point multiplication operation.

2. The smart contract vulnerability detection method based on multi-source data according to claim 1 is characterized in that: Before determining the feature difference based on the key feature, the fusion layer feature, and the vulnerability detection algorithm, the method includes: A vulnerability detection algorithm is determined based on the key feature, the fusion layer feature, the feature size of the key feature, the feature size of the fusion layer feature, a first feature difference adjustment factor, a second feature difference adjustment factor, and a third feature difference adjustment factor.

3. The smart contract vulnerability detection method based on multi-source data according to claim 2 is characterized in that: The expression of the vulnerability detection algorithm is: ， in, Indicates feature differences, Represents key features, represents the first characteristic difference adjustment factor, represents the characteristic period adjustment factor, express The characteristic size of represents the second characteristic difference adjustment factor, express The characteristic size of represents the third characteristic difference adjustment factor, represents the Spearman rank correlation coefficient.

4. A smart contract vulnerability detection device based on multi-source data, characterized in that: The device comprises: A first acquisition module is used to acquire vulnerability information data, wherein the vulnerability information data includes vulnerability source code and vulnerability bytecode; A first determination module is configured to extract and determine key features based on the vulnerability information data, wherein the key features include source code layer features, build layer features, and bytecode layer features; A second determining module determines a fusion layer feature based on the source code layer feature, the construction layer feature, and the bytecode layer feature; a third determining module, configured to determine feature differences based on the key features, the fusion layer features, and a vulnerability detection algorithm; The fourth determination module is used to determine the smart contract vulnerability based on the feature difference, The expression of the source code layer feature is: ， in, Represents source code layer features, Represents a text sequence of the vulnerable source code, Encoding features representing vulnerable source code text sequences, The bias term representing the text sequence of the vulnerable source code, express The sequence length, The construction layer features include abstract syntax tree features and code semantic features, wherein the expression of the abstract syntax tree features is: ， The expression of the code semantic feature is: ， in, Represents the abstract syntax tree feature, express Midpoint Type , Represents control flow structures , Indicates the expression type , Represents the semantic features of the code, express Medium parameter variables , express Medium Function , express Medium data type , The expression of the bytecode layer feature is: ， in, Represents bytecode layer features, express Medium opcode , express Control flow structure , express Access modifiers , The step of determining the fusion layer features based on the source code layer features, the construction layer features, and the bytecode layer features includes: Determine fusion layer features based on the source code layer features, the abstract syntax tree features, the code semantic features, the bytecode layer features and corresponding weight factors, Among them, the expression of the fusion layer feature is: ， in, represents the fusion layer features, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, express The corresponding weight factor, represents the first fusion factor, represents the second fusion factor, Indicates feature point addition operation, Represents the feature point multiplication operation.

5. An electronic device, characterized in that The electronic device comprises: one or more processors; A storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the smart contract vulnerability detection method based on multi-source data as described in any one of claims 1 to 3.

Images