Intelligent contract code data dependency analysis method and system based on large language model driving

Abstract

The invention discloses an intelligent contract code data dependency analysis method and system based on large language model driving. According to the system, intelligent contract codes are input into a static code analysis unit and a large language model processing unit, data dependency relationships are generated respectively, then results of the static code analysis unit and the large language model processing unit are merged through a code analysis result merging unit, and the static code analysis unit is driven to perform enhanced security vulnerability detection. According to the method, the semantic comprehension capability of a large language model is utilized, and a traditional static analysis technology is combined, so that the accuracy of data dependence analysis is effectively improved, and missing report and false report are reduced. The system is suitable for the field of security analysis and vulnerability detection of the smart contract, and particularly has a wide application prospect in a block chain application scene.

Description

Technical Field

[0001] The present invention relates to the fields of computer program analysis, artificial intelligence and blockchain, and in particular to a data dependency analysis technology for smart contract code based on a large language model, aiming to improve the security and reliability of smart contract code by combining artificial intelligence with traditional program analysis technology. The method and system are widely used in blockchain application scenarios, especially in the automated analysis and security detection of smart contract code. Background Art

[0002] With the rapid development of blockchain technology, smart contracts, as the core components of blockchain applications, are increasingly widely used in finance, the Internet of Things, supply chain and other fields. However, the security issues of smart contract codes are becoming increasingly prominent. Once deployed on the blockchain, smart contracts cannot be tampered with, so it is crucial to discover and fix potential vulnerabilities before deployment. Since smart contracts usually directly control blockchain assets, potential security vulnerabilities in the code (such as reentrancy attacks, integer overflows, etc.) may cause significant economic losses.

[0003] Data dependency analysis is a key part of static analysis, which is used to detect the dependencies between variables in the program, especially in the process of function calling, parameter passing and return value processing. However, traditional data dependency analysis often misses dependencies in complex scenarios or incorrectly reports some non-existent dependencies because it cannot fully understand the semantics of the code. Therefore, the prior art urgently needs a solution that can improve the accuracy of data dependency analysis. Existing smart contract code security analysis technology is mainly based on static analysis methods. This type of method generates control flow graphs and data flow graphs of the code, and then analyzes the dependencies of the code and detects security vulnerabilities. However, traditional static analysis technology has the problems of high computational complexity, high underreporting and false positive rates of analysis results, especially when faced with complex data dependencies, it is often difficult to make accurate judgments.

[0004] The present invention introduces large language model-driven smart contract code analysis, combined with traditional static analysis technology, to solve the problems of underreporting and false positives in smart contract data dependency analysis in the prior art, improve the accuracy of security vulnerability detection in smart contract codes, and thus help developers more effectively fix potential programming errors. Summary of the invention

[0005] The present invention proposes a method and system for analyzing smart contract code data dependency based on a large language model, aiming to improve the accuracy and efficiency of smart contract code security analysis by combining the natural language processing capabilities of the large language model with traditional static code analysis technology. The method applies the large language model to the text analysis of smart contract code and combines it with standard static code analysis to ultimately achieve more accurate smart contract code security detection. The method of the present invention specifically includes the following steps.

[0006] S1. Code preprocessing: This step receives the smart contract code and preprocesses it. If the text length of the smart contract does not exceed the processing limit of the large language model, the entire contract is used as input; if the text length exceeds the limit, each function is divided according to the function and input and analyzed as an independent unit.

[0007] S2. Data dependency analysis of variables and functions: This step generates control flow graphs and data flow graphs based on the smart contract source code and performs standard data dependency analysis. Its main task is to detect the dependency between variables and functions in the smart contract code and generate preliminary dependency analysis results.

[0008] S3. Large language model processing: This step uses specific prompt words to drive the large language model to analyze the smart contract text, identify variables and functions in the code, and analyze their data dependencies. This unit relies on the natural language processing capabilities of the large language model to deeply understand the code semantics and supplement the dependencies that may be missed in traditional static analysis.

[0009] S4. Merging code analysis results: This step merges the analysis results output by the large language model processing unit with the analysis results of the static code analysis unit, and generates enhanced data dependencies by combining steps S2 and S3.

[0010] S5. Secondary analysis of data dependency: This step utilizes the enhanced data dependency output after step S4 is executed to repeatedly perform data dependency analysis, thereby providing a more accurate analysis result.

[0011] Based on the above steps, the present invention proposes a smart contract code data dependency analysis system driven by a large language model, and its system architecture includes a code preprocessing unit, a static code analysis unit, a large language model processing unit, and a code analysis result merging unit. Figure 2 As shown, each unit cooperates with each other to jointly implement data dependency analysis of smart contract code and enhance the detection capability of traditional static code analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1Shown is a flow chart of a method for analyzing smart contract code data dependency based on a large language model driven by an embodiment of the present invention.

[0013] Figure 2 Shown is a schematic diagram of the architecture of a smart contract code data dependency analysis system driven by a large language model disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0014] The specific implementation methods of each execution step of the present invention are:

[0015] S1. Code preprocessing: The present invention first preprocesses the input smart contract code to ensure that it can be effectively processed by the subsequent analysis steps. Specifically including: S1.1 Smart contract code parsing: For the smart contract code, first perform a syntax check to ensure that it has no syntax errors. By using solc (Solidity compiler) or hardhat tool to parse the Solidity smart contract code, extract relevant functions, variables and structure information. S1.2 Text length check and splitting: Since the large language model has an upper limit on the length of the input text, if the smart contract code is too long (such as exceeding the processing capacity of GPT-4), it needs to be split by function or module. You can use Python scripts in combination with regular expressions or ANTLR parsing libraries to identify function definitions in the code and split them.

[0016] S2. Analysis of data dependencies between variables and functions: After the smart contract code is preprocessed, the analysis phase of data dependencies between variables and functions is entered. Specifically, it includes: S2.1 Control flow graph (CFG) generation: First, the control flow graph (CFG) of the smart contract code is generated through static analysis tools to analyze the calling relationship between each function and variable. You can use Mythril or Slither static analysis tools, which are specifically used for static analysis of smart contracts and can generate detailed control flow graphs and dependency graphs. S2.2 Data flow graph (DFG) generation: In addition to the control flow graph, it is also necessary to generate a data flow graph (DFG), which is used to track the use and transfer path of variables in the program and help detect data dependencies. By using tools such as Slither, data flow graphs can be effectively generated to analyze the flow of variables in smart contracts. Through this step, the dependency between function calls and variables is preliminarily determined, and basic data is further provided for the processing of large language models.

[0017] S3. Large language model processing: The large language model processing unit receives the text input of the smart contract code and analyzes the data dependencies in the code based on its semantic understanding ability: S3.1 Model selection: Select a powerful large language model (such as the large language model provided by GPT-4 or Hugging Face) to analyze the smart contract code through specific prompt words to identify functions, variables and their dependencies. S3.2 Semantic analysis: The large language model uses natural language processing technology to analyze the implicit dependencies in the code, especially for complex dependencies that may be missed by static analysis tools (such as nested function calls, recursive function dependencies, etc.). In the implementation of this step, the code can be supplemented with semantic analysis by calling the OpenAI GPT-4 API or Hugging Face Transformers to improve the accuracy of dependency analysis.

[0018] S4. Merge code analysis results: After the static code analysis and large language model processing are completed, the system needs to merge the analysis results of the two: S4.1 Result merging strategy: The system merges the control flow graph and data flow graph generated by the static analysis tool with the dependency analysis results of the large language model. Python can be used to merge and integrate data, and the analysis results from different sources can be compared and combined through libraries such as pandas and numpy to form a more comprehensive dependency graph. S4.2 Standardized data format: In order to facilitate merging, it is recommended to use a unified format (such as JSON or GraphQL) to store analysis results from different sources to ensure that the analysis results can be effectively compared and merged. Through merging, the system combines the advantages of the two analysis technologies to generate more accurate dependencies, thereby providing a more accurate basis for subsequent security vulnerability detection.

[0019] S5. Secondary analysis of data dependencies: After the dependencies are merged, the system performs secondary analysis based on the enhanced data dependencies to detect potential security vulnerabilities: S5.1 Secondary analysis and vulnerability detection: Based on the reconstructed data dependencies, the system will perform a deeper security analysis, check complex function calls and variable transfer paths, and locate potential security issues. You can use the smart contract fuzz testing tool Echidna for dynamic testing to trigger potential vulnerabilities through fuzzy input. S5.2 Vulnerability repair suggestions: After the analysis report is generated, the system will give vulnerability repair suggestions to help developers quickly locate and repair security issues in the code.

[0020] Through the above steps, the present invention realizes data dependency analysis of smart contract code, combines the semantic understanding ability of large language models and traditional static analysis technology, can effectively reduce false positives and false negatives in data dependency analysis, and improve the accuracy of smart contract security vulnerability detection.

Claims

1. A method for analyzing smart contract code data dependency based on a large language model, characterized in that: The method comprises the following steps: - S1. Code preprocessing: Preprocess the input smart contract code. When the length of the smart contract text does not exceed the processing limit of the large language model, the entire code is input into the large language model processing unit and the static code analysis unit for analysis. If the length of the smart contract text exceeds the processing limit of the large language model, it is split into functions and processed separately. - S2. Data dependency analysis of variables and functions: Generate control flow graph and data flow graph of smart contract through static code analysis tools, perform data dependency analysis on variables and functions in the code, and form preliminary data dependency relationships; - S3. Large language model processing: Analyze the functions and variables in smart contracts through large language models to identify complex data dependencies, especially implicit dependencies that are difficult to detect with static analysis tools; - S4. Code analysis result merging: Merge the output results of the large language model processing unit with the analysis results of the static code analysis unit to form an enhanced data dependency relationship; - S5. Data dependency secondary analysis: Based on the merged enhanced data dependency, re-execute security vulnerability detection to improve the vulnerability detection accuracy of smart contract code.

2. According to claim 1, a method for analyzing smart contract code data dependency based on a large language model, characterized in that: The static code analysis tool is used to generate a control flow graph (CFG) and a data flow graph (DFG) of a smart contract, and based on this, perform dependency analysis of variables and functions.

3. According to claim 1, a method for analyzing smart contract code data dependency based on a large language model, characterized in that: The large language model processing unit performs semantic analysis on the code text through natural language processing technology to identify complex data dependencies. The model used is the GPT series model or other large language models.

4. According to claim 1, a method for analyzing smart contract code data dependency based on a large language model, characterized in that: The code analysis result merging unit compares and merges the control flow graph and data flow graph of the static code analysis unit with the analysis results of the large language model to generate an enhanced data dependency set.

5. According to claim 1, a method for analyzing smart contract code data dependency based on a large language model, characterized in that: The secondary analysis of data dependencies re-executes security vulnerability detection through the comprehensive results of static code analysis tools and large language model processing units to reduce false positives and false negatives and improve detection accuracy.

6. A smart contract code data dependency analysis system driven by a large language model, characterized in that: The system comprises a code preprocessing unit, a static code analysis unit, a large language model processing unit and a code analysis result merging unit, and is used to implement the method as claimed in any one of claims 1 to 5.

Images