Intelligent contract vulnerability detection method based on node feature enhanced graph convolutional network

Abstract

The embodiment of the invention discloses a smart contract vulnerability detection method based on a node feature enhanced graph convolutional network. The method comprises the following steps: constructing a smart contract graph according to a smart contract; standardizing the smart contract graph to obtain a standard smart contract graph; vectorizing the standard smart contract graph to obtain a vectorized smart contract graph; and inputting the vectorized smart contract graph into a node feature enhanced graph convolutional network model, and detecting vulnerabilities of the smart contract. According to the method, the node feature enhancement is added, so that the model can more comprehensively utilize the feature information of the nodes and can better capture the relationship and features between the nodes, and thus the prediction accuracy is improved. And through comparative learning, the model can learn more stable and reliable feature representation, so that the performance is further improved.

Description

Technical Field

[0001] The present application relates to the field of smart contract detection technology, and in particular to a smart contract vulnerability detection method based on a node feature enhanced graph convolutional network. Background Art

[0002] Smart contract is a computer program based on blockchain technology that can be automatically executed and managed. It is a contract that can run in cyberspace based on computers. When the terms of the contract are met, the smart contract will be automatically executed without the intervention of a third party. These contracts are usually stored on the blockchain to ensure their transparency and security. Commitments are defined in digital form, which include the rights and obligations agreed by the contract participants.

[0003] In traditional graph neural networks, node features are usually transmitted and aggregated through the adjacency matrix, but the mask-based smart contract graph node feature enhancement method will cover up some node features during the transmission of the smart contract graph, resulting in the loss of available information and causing the subsequent graph convolutional network to over-focus on invalid information during the learning process. Summary of the invention

[0004] In order to solve the existing technical problems, the embodiment of the present application provides a smart contract vulnerability detection method based on node feature enhanced graph convolutional network. The technical solution is as follows:

[0005] In the first aspect, a smart contract vulnerability detection method based on a node feature enhanced graph convolutional network is provided, comprising the following steps:

[0006] Build a smart contract graph based on smart contracts;

[0007] Standardizing the smart contract graph to obtain a standard smart contract graph;

[0008] Vectorize the standard smart contract graph to obtain a vectorized smart contract graph;

[0009] The vectorized smart contract graph is input into a node feature enhanced graph convolutional network model to detect vulnerabilities in the smart contract.

[0010] Optionally, constructing a smart contract graph according to the smart contract includes:

[0011] Create corresponding smart contract graph nodes according to the program elements of the smart contract;

[0012] Corresponding smart contract graph edges are created according to the grammatical and semantic relationships between the program elements.

[0013] Optionally, the creating a corresponding smart contract graph node according to the program element of the smart contract includes:

[0014] Treat reentrant and timestamp related functions as first-level nodes;

[0015] Treat all functions except the primary nodes and fallback functions as secondary nodes;

[0016] Use the fallback function as the fallback node.

[0017] Optionally, the step of standardizing the smart contract graph to obtain a standard smart contract graph includes:

[0018] Delete the smart contract Figure 2 Level nodes and fallback nodes, and pass features to nearby level one nodes;

[0019] Change the starting and ending points of the smart contract graph edges connected to the deleted node to first-level nodes;

[0020] The features of the first-level nodes and the deleted nodes are merged.

[0021] Optionally, vectorizing the standard smart contract graph includes:

[0022] Input the node information of the standard smart contract graph node into the bidirectional encoder representation algorithm model to obtain a vectorized smart contract graph node;

[0023] The attribute information of the standard smart contract graph edge is encoded using One-Hot to obtain a vectorized smart contract graph edge.

[0024] Optionally, inputting the vectorized smart contract graph into a node feature enhanced graph convolutional network model to detect vulnerabilities in the smart contract includes:

[0025] Inputting the vectorized smart contract graph into the node feature enhanced graph convolutional network model to obtain an enhanced smart contract graph;

[0026] Input the enhanced smart contract graph and the vectorized smart contract graph into the degree-free graph convolutional network model DR-GCN at the same time to perform multi-layer convolution operations;

[0027] Pool the convolutional features to reduce the feature dimension;

[0028] The pooled features are passed into the fully connected network layer to obtain the final feature description;

[0029] Determine the vulnerability of the smart contract according to the feature description.

[0030] The beneficial effects of the technical solution provided by the embodiment of the present application are as follows: the present application constructs a smart contract graph based on the smart contract; the smart contract graph is standardized to obtain a standard smart contract graph; the standard smart contract graph is vectorized to obtain a vectorized smart contract graph; the vectorized smart contract graph is input into a node feature enhanced graph convolutional network model to detect vulnerabilities in the smart contract. By adding node feature enhancement, the model can more comprehensively utilize the feature information of the nodes and better capture the relationships and features between the nodes, thereby improving the prediction accuracy. Through comparative learning, the model can learn more stable and reliable feature representations, thereby further improving performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] Figure 1 The smart contract source code provided in the embodiment of the present application is used to construct a smart contract graph;

[0033] Figure 2 It is a standardized diagram of the smart contract diagram provided in the embodiment of the present application;

[0034] Figure 3 It is a vectorized smart contract graph node feature graph provided in an embodiment of the present application;

[0035] Figure 4 It is a diagram of the NFA-GCN model architecture provided in the embodiment of the present application;

[0036] Figure 5 It is a node feature enhanced graph of the smart contract graph provided in the embodiment of the present application;

[0037] Figure 6 It is a ROC curve diagram of the NFA-GCN vulnerability detection method provided in the embodiment of the present application under the test set. DETAILED DESCRIPTION

[0038] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0039] It should be clear that the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0040] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0041] In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. In addition, in the description of the present application, unless otherwise specified, "plurality" refers to two or more.

[0042] 1. Build a smart contract graph

[0043] 1.1 Construction of Smart Contract Graph Node

[0044] When performing vulnerability detection, a large amount of program code and function calls are often encountered. However, not all program elements are necessary for vulnerability detection. Some program elements are very important in vulnerability detection, while other operations may only exist to implement specific functions or optimize code and do not directly affect the results of vulnerability detection. This application designs three types of nodes based on the impact on the results of vulnerability detection, namely, primary nodes, secondary nodes, and fallback nodes. Each node is represented by a four-tuple (Order, Limit, Call, Type), where Order indicates the calling order of the node, Limit indicates whether there is a permission modifier, Call indicates the caller, and Type indicates the node type. Example: (S1LimitedAC W1 2)

[0045] The first-level node represents the calls and variables that can directly affect the results of smart contract vulnerability detection. For the first-level node, this application uses W1, W2, ..., W n express.

[0046] (1) The first-level nodes of the reentrancy vulnerability: ① The call of the call.value built-in function; ② The function that calls the call.value function to transfer money; ③ The function that calls the transfer function; ④ The variable corresponding to the user balance; ⑤ The variable that can directly affect the user balance.

[0047] (2) The first-level nodes of the timestamp vulnerability: ① The block.timestamp variable itself; ② The variable compared with the block.timestamp variable; ③ The function that calls the block.timestamp variable to perform smart contract judgment; ④ The function that meets condition ② is called.

[0048] The second-level nodes represent functions and variables that play an auxiliary role in vulnerability detection, that is, all nodes in the function except the first-level nodes. This application uses S1, S2, ..., S n express.

[0049] The triggering of the reentrancy vulnerability is related to the fallback function. This application has designed a fallback node for the fallback function to represent the interaction with the primary node. Each smart contract has only one fallback function, which is represented by F in this application.

[0050] 1.2 Construction of Smart Contract Graph Edges

[0051] In order to express the dependency relationship between nodes, this application constructs four types of edges for the smart contract graph, each of which consists of a four-tuple (N s ,N e ,O,S). Where N s Indicates the starting point of the edge, N e represents the end point of the edge, O represents the execution order of the edge in the program, and S represents the symbolic representation of the edge. Table 1 lists the symbolic types of the edge in detail.

[0052] (1) Control flow edge: represents a directed edge from node A to node B, indicating that the program jumps from A to B during execution. It includes conditional control flow edges, loop control flow edges, execution order edges, and safety handle statements.

[0053] (2) Data flow edge: represents the transmission direction of variables in the smart contract, showing the path of variables flowing from one node to another.

[0054] (3) Fallback edge: represents the process of a node calling a fallback function and a fallback function calling back the node. This application uses two edges for construction, one of which represents the call of the node and the other represents the callback of the fallball function.

[0055] The smart contract graph is constructed as follows Figure 1 shown.

[0056] Table 1 Edge symbols, meanings and types

[0057]

[0058] 2. Smart Contract Graph Standardization

[0059] In the process of message transmission, graph neural networks usually regard the importance of each node as the same, but this application divides the nodes in the smart contract graph into primary, secondary and fallback according to their importance. Therefore, this application removes nodes from the constructed smart contract graph and reconstructs a standardized smart contract graph.

[0060] First, the secondary nodes S1, S2, ..., S n The node and fallback node are eliminated, and their features are passed to nearby first-level nodes. If there are multiple first-level nodes near a node, its features are broadcast to all first-level nodes connected to it by edges. Then, the edges connected to the deleted node are retained, and the starting and ending points of the edges connected to the deleted node are changed to the first-level nodes connected to it, that is, the first-level nodes add self-loop edges. Finally, the features of the first-level node are merged with the features of the deleted node, that is, the feature quadruple of the first-level node is spliced ​​with the feature quadruple of the deleted node. Figure 2 The following is the standardized process of smart contract diagram. This application uses V1, V2, ..., V n Represents the fused node.

[0061] 3. Vectorized representation of standard smart contract graphs

[0062] As mentioned above, the smart contract graph consists of nodes and edges, and their feature information is recorded by text. The graph convolutional network cannot directly learn text-type data, so the smart contract graph needs to be vectorized. This section uses the BERT algorithm to vectorize the node features of the smart contract graph, and uses One-Hot encoding to vectorize the edge features of the smart contract graph.

[0063] 3.1 Smart Contract Graph Node Feature Vectorization

[0064] Converting textual node features into vectorized representations is an important prerequisite for graph neural networks (GNNs) to process graph data. These vectors can capture the semantic information of the node text content, which helps GNNs better capture the associations between nodes when learning graph structures and unstructured data. This application uses a Transformer-based bidirectional encoder representation algorithm (Bidirectional Encoder Representations from Transformers, BERT) to vectorize the node features of smart contract graphs.

[0065] BERT is a pre-trained natural language processing model proposed by Google in 2018 that can convert text into BERT vectors for use in downstream vulnerability detection tasks. In the BERT model, the input text is first processed by a tokenizer to split the text into individual words or subwords. Then, these subwords are passed through the word vector embedding layer to obtain their own vectorized representations. These vectorized representations are passed as input to the next layer of the model. The BERT model contains multiple Transformer Encoder layers, each of which contains multiple self-attention mechanisms. In these layers, the input vectorized representation is processed by the self-attention mechanism to obtain a richer vectorized representation with contextual information. These representations are continuously abstracted and fused in each layer to eventually form a high-order vectorized representation. Figure 3 Shown is the vectorization process of smart contract graph node features.

[0066] 3.2 Vectorization of Smart Contract Graph Edge Features

[0067] In graph convolutional networks, One-Hot vectorized edge features are an effective representation method that can encode edge attribute information into binary vectors, thereby improving the model's ability to learn graph structures.

[0068] One-Hot encoding, also known as unique hot encoding, is an encoding method that converts a multi-classification problem into a binary classification problem. It maps the categories in the original data into binary vectors, where the element value 1 represents the corresponding category and 0 represents the non-corresponding category. Assuming there is a data set with n categories, the One-Hot encoded data will be represented as n vectors of length n.

[0069] This application uses One-Hot encoding to vectorize the edge information of the smart contract graph, converting the feature information contained therein into a binary vectorized representation, which can map the words in the text into a fixed-length binary vector. These vectors will be used as the edge information of the semantic graph to represent the relationship between nodes.

[0070] 4. Graph Convolutional Network Model Based on Node Feature Enhancement

[0071] 4.1 Overall Model Architecture

[0072] This application proposes a graph convolutional network model NFA-GCN based on node feature enhancement. On the basis of DR-GCN, a node feature enhancement process is added. The enhanced smart contract graph and the vectorized smart contract graph are simultaneously passed to DR-GCN for feature extraction. The contrast loss and cross entropy loss are calculated for the extracted results, and the losses are added for back propagation to optimize the model parameters and improve the model generalization ability. The overall architecture of the model is as follows Figure 4 shown.

[0073] 4.2 Mask-based smart contract graph node feature enhancement method

[0074] Node Feature Augmentation (NFA) is a method for optimizing and improving node features in graph structured data. In graph learning, node features refer to the attribute vector corresponding to each node, which has an important impact on tasks such as node classification, clustering, and link prediction. The purpose of node feature augmentation is to improve the performance of graph learning by processing and optimizing the original node features.

[0075] This application proposes a node feature enhancement method for smart contract graphs. For a given node attribute graph G = (A, X), where A represents the graph node and X represents the node feature matrix, a portion of the node features are masked by masking. For a given node feature matrix X, the enhanced node feature matrix X is:

[0076]

[0077] Where L is the mask position matrix L ij ∈{0, 1}; M is the mask value matrix, M ij is the replacement value for the masked position. Figure 5 The process of smart contract graph node feature enhancement is demonstrated.

[0078] 4.3 Loss Function Based on Node Feature Enhancement Difference Comparison

[0079] Contrastive learning is a technique for learning by comparing the similarities between samples. When only positive samples are used, contrastive learning can be used to find the similarities between positive samples, and this similarity information can be used to train the model. In the absence of negative samples, a model with good generalization ability can still be trained. This application uses the graph convolutional network to predict the data after data augmentation and the source data at the same time, and then compares the predicted results, learns the similarity, and calculates the contrast loss:

[0080]

[0081] Where N is the number of samples, q is the anchor sample, k + is a positive sample, k iare all samples, f is the similarity calculation function, and τ is the temperature coefficient. Contrastive loss is a loss function used to measure the similarity between two samples. During the training process, the contrastive loss compares the model's prediction results for two samples of the same category and updates the model parameters based on the similarity between them. Through contrastive loss, the model can learn how to map samples of the same category to similar spaces. The cross entropy loss is a loss function used in multi-classification models, which measures the difference between the model's prediction results for each category and the true label. By continuously reducing the cross entropy loss value, the model can better learn the differences and similarities between different categories. The cross entropy loss function calculation formula:

[0082]

[0083] In the formula, y i Represents the label of sample i, with a value of 1 for positive class and 0 for negative class. i It represents the probability value that the model predicts sample i as the positive class.

[0084] This application adds the contrast loss and the cross entropy loss to get a total loss, and then performs backpropagation:

[0085] Loss=Contrastive Loss+Cross Entropy Loss

[0086] Contrastive loss is mainly used to measure similarity, while cross entropy loss is mainly used for multi-classification problems. Therefore, during back propagation, not only the similarity between each sample is considered, but also the differences between different categories. By adding these two loss functions, the model can learn the relationship between samples more comprehensively and make predictions more accurately.

[0087] 5. Experimental Analysis

[0088] 5.1 Experimental Environment

[0089] (1) Dataset setting. This application collected a total of 40,932 solidity language smart contracts (ESC) under the Ethereum blockchain platform, and used these smart contracts in comparative experiments on reentrancy vulnerability detection. At the same time, 4,170 C language smart contracts (VSC) from VNT chain were used in comparative experiments on timestamp dependency vulnerability detection. For the ESC and VSC datasets, this application used 80% of the smart contracts as the training set to train the model, and the remaining 20% ​​of the smart contracts were used as the test set to test the performance of the model.

[0090] (2) The experimental environment of this application is shown in Table 2.

[0091] Table 2 Experimental environment

[0092]

[0093] 5.2 Experimental evaluation indicators

[0094] In the field of neural networks, classification problems are a very common and important type of problem, and its goal is to predict the category to which the input data belongs based on the input features. In order to evaluate the performance of the classification model, some key indicators are needed to measure the quality of the model. This application uses accuracy, recall, F1-Score and precision as evaluation indicators. Among them, accuracy is regarded as a criterion for evaluating the prediction accuracy of the classification model, while precision focuses on the proportion of positive samples determined by the model that truly belong to the positive class. The recall rate focuses on the proportion that the model can correctly predict among all truly positive samples. The F1 value is the harmonic mean between precision and recall, taking into account the balance between the two, and the larger the value, the better.

[0095] (1) Accuracy is the most intuitive performance evaluation criterion, which is defined as the ratio of the number of samples accurately predicted by the model to the total number of samples. The calculation formula is as follows:

[0096]

[0097] In classification problems, TP, TN, FP, and FN are important indicators for evaluating the performance of classification models. These indicators are derived from the "Confusion Matrix", which is a table shown in Table 3 that describes the degree of match between the prediction results of the classification model and the actual situation.

[0098] Table 3 Confusion matrix

[0099]

[0100] True Positive (TP) indicates the number of positive samples accurately predicted by the model. True Negative (TN) indicates the number of negative samples accurately predicted by the model. False Positive (FP) indicates the number of samples whose true labels are negative and whose model incorrectly predicts positive samples. False Negative (FN) indicates the number of samples whose true labels are positive and whose model incorrectly predicts negative samples.

[0101] (2) Recall is a measure of the model’s ability to capture positive samples. It calculates the proportion of positive instances correctly identified by the model to all actual positive instances. The calculation formula is as follows:

[0102]

[0103] As the recall rate increases, it indicates that the model's ability to identify true positive samples becomes stronger. For application scenarios with high missed detection costs, the recall rate is a very important indicator.

[0104] (3) Precision is defined as the proportion of samples that actually belong to the positive class among all samples predicted by the model to be in the positive class. It reflects the prediction accuracy of the model. The calculation formula is:

[0105]

[0106] When FP is high, the accuracy will decrease, and the increase in precision indicates that the model has a stronger ability to distinguish negative samples. Therefore, in situations where the cost of false positives is high, such as spam filtering and disease screening, accuracy is a very critical indicator.

[0107] (4) The F1 value reflects the harmonic mean of precision and recall, aiming to achieve a balance between the two, so as to more comprehensively understand and evaluate the model. The F1 value is calculated using the following formula:

[0108]

[0109] 5.3 Comparative Experiment and Result Analysis

[0110] 5.3.1 Comparison with traditional vulnerability detection methods

[0111] By comparing NFA-GCN with traditional smart contract vulnerability detection methods Smartcheck, Oyente and Mythril in terms of detection capabilities for reentrancy vulnerabilities and timestamp dependency vulnerabilities, the experimental results are shown in Table 4. In order to verify the reliability of the experimental results, all experiments in this application have undergone 10 cross-certifications, which can more reliably evaluate the performance of the model and improve the credibility of scientific research results.

[0112] Table 4 Performance comparison of NFA-GCN in reentrancy vulnerability and timestamp dependency vulnerability detection

[0113]

[0114] As can be seen from Table 4, under the same data set environment, compared with the traditional smart contract vulnerability detection model, the NFA-GCN method can effectively improve the accuracy of vulnerability detection and obtain higher recall rate, precision rate and F1 value, indicating that neural networks can effectively improve the performance of vulnerability detection models.

[0115] Compared with traditional vulnerability detection methods, the performance of the NFA-GCN method in reentrancy vulnerability detection is 54.37% higher than Smartcheck, with an F1 value of 82.47%. The accuracy, recall, and precision also reached 87.73%, 84.06%, and 81.39%, respectively. Compared with other traditional methods, the four evaluation indicators have been improved in reentrancy vulnerability detection, which proves that the overall comprehensive performance of the NFA-GCN method is better.

[0116] In timestamp-dependent vulnerability detection, traditional vulnerability detection methods have not yet achieved good results. The accuracy of Smartcheck is only 44.32%, while the accuracy of the NFA-GCN method reaches 83.63%, which is 39.31% higher than Smartcheck. Compared with the most advanced traditional method Mythril, NFA-GCN also improved by 22.55%, 38.05%, 37.25% and 36.52% in the four evaluation indicators, reaching 83.63%, 79.77%, 87.25% and 82.01% respectively. In summary, the experimental results prove the effectiveness and practicality of the NFA-GCN method proposed in this application in the task of smart contract vulnerability detection.

[0117] Through experimental analysis, the accuracy and recall of traditional methods are low, which can be attributed to the following reasons: First, traditional vulnerability detection methods are usually matched based on pre-defined vulnerability features. However, vulnerabilities in smart contracts emerge in an endless stream, and it is difficult to cover all possible attack paths. In addition, attackers often make workarounds for known detection methods to evade detection, which greatly reduces the universality and timeliness of traditional methods. Secondly, the internal structure of smart contracts is complex, involving multiple data structures and algorithms. Traditional methods often only focus on the surface phenomena of smart contract codes, while ignoring the deep data relationships and logical call relationships. This leads to many potential security issues not being discovered in time, thereby reducing the accuracy and recall of detection.

[0118] Compared with traditional methods, the neural network-based method ED-GCN can better capture the characteristics of timestamp vulnerabilities, thereby improving the effectiveness of vulnerability detection. Experiments have shown that the ED-GCN method has a higher accuracy rate, reaching 83.18% accuracy in detecting timestamp vulnerabilities. At the same time, the recall rate, precision rate and F1 value reached 83.68%, 82.78% and 82.45% respectively, which is significantly better than traditional methods such as Smartcheck, Oyente and Mythril methods.

[0119] 5.3.2 Comparison with Neural Network-based Vulnerability Detection Methods

[0120] In recent years, neural network technology has made remarkable achievements in the fields of computer vision and natural language processing. However, for specific tasks, not all methods can achieve ideal results. Therefore, it is particularly important to conduct comparative experiments to verify the effectiveness of the proposed method. This application proposes the NFA-GCN method and conducts a series of experimental comparisons with the most advanced smart contract vulnerability detection methods, such as Vanilla-RNN, LSTM, GRU, GCN and DR-GCN. The experimental results show that, to a large extent, the NFA-GCN method is superior to existing methods in performance and effect. As shown in Table 5, the method proposed in this application is superior to other neural network methods in terms of accuracy, recall, precision and F1 value. This shows that the NFA-GCN method has great potential and application value in the field of smart contract vulnerability detection.

[0121] Table 5 Performance comparison of NFA-GCN and other neural network methods in reentrancy vulnerability and timestamp dependency vulnerability detection

[0122]

[0123] Based on the four performance evaluation indicators of accuracy, recall, precision and F1 value, the test set is used to test and record on multiple classification models. From the results in Table 5, it can be seen that each row represents a vulnerability detection model based on a neural network, which represents the accuracy, recall, precision and F1 value from left to right. This application compares 6 smart contract vulnerability detection models together. In reentrant vulnerability detection and timestamp dependency vulnerability detection, NFA-GCN has achieved good detection results.

[0124] NFA-GCN achieved results of 87.73%, 84.06%, 81.39% and 82.47% in the four evaluation indicators of reentrancy vulnerability detection. The experimental results show that although recurrent neural networks such as Vanilla-RNN, LSTM and GRU have achieved remarkable achievements in many fields, their performance in reentrancy vulnerability detection is not satisfactory. The highest detection accuracy of these methods on reentrancy vulnerabilities is only 54.54%, which is even lower than traditional detection methods. Smart contracts usually contain complex logic, conditional statements and function calls, which are difficult to accurately express in time series. Although recurrent neural networks are suitable for processing sequence data, they have weak feature extraction and modeling capabilities for unstructured data. It is difficult to capture the complex logic and potential vulnerabilities in smart contracts when using recurrent neural networks for analysis.

[0125] In timestamp dependency vulnerability detection, the four evaluation indicators of the NFA-GCN method reached 83.63%, 79.77%, 87.25% and 82.01% respectively. Compared with the DR-GCN method, the four indicators increased by 4.95%, 0.86%, 15.96% and 7.1% respectively. This proves that node feature enhancement and contrastive learning effectively improve the performance of DR-GCN. First, by adding node feature enhancement, the model can better capture the relationship and features between nodes. Traditional graph convolutional network methods often only consider the connection relationship between nodes, while ignoring the feature information of the nodes themselves. After adding node feature enhancement, the model can more comprehensively utilize the feature information of the nodes, thereby improving the prediction accuracy. Secondly, contrastive learning helps the model learn more representative feature representations, thereby helping the model better distinguish the differences between different categories. Through contrastive learning, the model can learn more stable and reliable feature representations, thereby further improving performance.

[0126] Figure 6 The receiver operating characteristic curve (ROC) obtained after vulnerability detection on the test set based on the NFA-GCN vulnerability detection method is shown. The ROC curve is often used to test the performance of the classifier. It can intuitively show the performance of the classification model under different thresholds. Each curve represents the detection effect of the model on the data of this type. In the ROC curve, the horizontal axis reflects the false alarm rate, that is, the false positive rate (FPR); the vertical axis maps the sensitivity, that is, the true positive rate (TPR), which represents the efficiency of the model in correctly identifying positive samples. The area under the ROC curve, AUC (Area Under Curve), is one of the important indicators for evaluating the quality of the classification model. The value range of AUC is between 0.5 and 1. The closer the value is to 1, the better the model performance is. By analyzing the ROC curve, we can better understand the performance of the model in different situations and adjust and optimize the model.

[0127] The above is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A smart contract vulnerability detection method based on node feature enhanced graph convolutional network, characterized in that: The following steps are involved: Build a smart contract graph based on smart contracts; Standardizing the smart contract graph to obtain a standard smart contract graph; Vectorize the standard smart contract graph to obtain a vectorized smart contract graph; The vectorized smart contract graph is input into a node feature enhanced graph convolutional network model to detect vulnerabilities in the smart contract.

2. The method according to claim 1, characterized in that The step of constructing a smart contract graph according to the smart contract includes: Create corresponding smart contract graph nodes according to the program elements of the smart contract; Corresponding smart contract graph edges are created according to the grammatical and semantic relationships between the program elements.

3. The method according to claim 2, characterized in that The step of creating a corresponding smart contract graph node according to the program elements of the smart contract includes: Treat reentrant and timestamp related functions as first-level nodes; Treat all functions except the primary node and fallback function as secondary nodes; Use the fallback function as the fallback node.

4. The method according to claim 1, characterized in that: The step of standardizing the smart contract graph to obtain a standard smart contract graph includes: Delete the secondary nodes and fallback nodes of the smart contract graph, and pass the features to nearby primary nodes; Change the starting and ending points of the smart contract graph edges connected to the deleted node to first-level nodes; The features of the first-level nodes and the deleted nodes are merged.

5. The method according to claim 1, characterized in that: The vectorizing the standard smart contract graph includes: Input the node information of the standard smart contract graph node into the bidirectional encoder representation algorithm model to obtain a vectorized smart contract graph node; The attribute information of the standard smart contract graph edge is encoded using One-Hot to obtain a vectorized smart contract graph edge.

6. The method according to claim 1, characterized in that The step of inputting the vectorized smart contract graph into a node feature enhanced graph convolutional network model to detect vulnerabilities in the smart contract includes: Inputting the vectorized smart contract graph into the node feature enhanced graph convolutional network model to obtain an enhanced smart contract graph; Inputting the enhanced smart contract graph and the vectorized smart contract graph into the degree-free graph convolutional network model DR-GCN at the same time to perform multi-layer convolution operations; Pool the convolutional features to reduce the feature dimension; The pooled features are passed into the fully connected network layer to obtain the final feature description; Determine the vulnerability of the smart contract according to the feature description.

Images