Intelligent contract vulnerability detection method based on edge inactivation graph convolutional network

Abstract

The embodiment of the invention discloses a smart contract vulnerability detection method based on an edge inactivation graph convolutional network. The method comprises the following steps: constructing a smart contract graph according to a smart contract; standardizing the smart contract graph to obtain a standard smart contract graph; vectorizing the standard smart contract graph to obtain a vectorized smart contract graph; and inputting the vectorized smart contract graph into an edge inactivation graph convolutional network model, and detecting vulnerabilities of the smart contract. According to the method, the ED-GCN model is adopted, information transmission and dependency relationships in codes can be effectively captured, potential vulnerabilities can be better recognized, an edge inactivation mode is adopted, the model can learn richer and deeper feature representation, overfitting can be effectively prevented, and by introducing a contrast learning mechanism, the probability of overfitting is lowered. And the robustness and safety of the model are enhanced. The intelligent contract vulnerability detection method has higher accuracy, recall rate and precision rate in intelligent contract vulnerability detection.

Description

Technical Field

[0001] The present application relates to the field of smart contract detection technology, and in particular to a smart contract vulnerability detection method based on an edge-deactivation graph convolutional network. Background Art

[0002] Smart contract is a computer program based on blockchain technology that can be automatically executed and managed. It is a contract that can run in cyberspace based on computers. When the terms of the contract are met, the smart contract will be automatically executed without the intervention of a third party. These contracts are usually stored on the blockchain to ensure their transparency and security. Commitments are defined in digital form, which include the rights and obligations agreed by the contract participants.

[0003] In traditional graph neural networks, node features are usually transmitted and aggregated through the adjacency matrix, but the mask-based smart contract graph node feature enhancement method will cover up some node features during the transmission of the smart contract graph, resulting in the loss of available information and causing the subsequent graph convolutional network to over-focus on invalid information during the learning process. Summary of the invention

[0004] In order to solve the existing technical problems, the embodiment of the present application provides a smart contract vulnerability detection method based on edge-deactivation graph convolutional network. The technical solution is as follows:

[0005] In a first aspect, a smart contract vulnerability detection method based on an edge-deactivation graph convolutional network is provided, comprising the following steps:

[0006] Build a smart contract graph based on smart contracts;

[0007] Standardizing the smart contract graph to obtain a standard smart contract graph;

[0008] Vectorize the standard smart contract graph to obtain a vectorized smart contract graph;

[0009] The vectorized smart contract graph is input into an edge-deactivation graph convolutional network model to detect vulnerabilities in the smart contract.

[0010] Furthermore, constructing a smart contract graph according to the smart contract includes:

[0011] Create corresponding smart contract graph nodes according to the program elements of the smart contract;

[0012] Corresponding smart contract graph edges are created according to the grammatical and semantic relationships between the program elements.

[0013] Furthermore, the creating corresponding smart contract graph nodes according to the program elements of the smart contract includes:

[0014] Treat reentrant functions and timestamp functions as first-level nodes;

[0015] Treat functions other than primary nodes and fallback functions as secondary nodes;

[0016] Use the fallback function as the fallback node.

[0017] Furthermore, the smart contract graph is standardized to obtain a standard smart contract graph, including:

[0018] Delete the smart contract Figure 2 Level nodes and fallback nodes, and pass features to nearby level one nodes;

[0019] Change the starting and ending points of the smart contract graph edges connected to the deleted node to first-level nodes;

[0020] The features of the first-level node and the deleted node are merged.

[0021] Furthermore, vectorizing the standard smart contract graph includes:

[0022] Input the node information of the standard smart contract graph node into the bidirectional encoder representation algorithm model to obtain a vectorized smart contract graph node;

[0023] The attribute information of the standard smart contract graph edge is encoded using One-Hot to obtain a vectorized smart contract graph edge.

[0024] Furthermore, inputting the vectorized smart contract graph into an edge-deactivation graph convolutional network model to detect vulnerabilities in the smart contract includes:

[0025] Inputting the vectorized smart contract graph into the edge-deactivation graph convolutional network model;

[0026] Add deactivation probability to the edges of the vectorized smart contract graph according to the Bernoulli probability distribution;

[0027] Combining the vectorized smart contract graph with the edge deactivation probability to generate a deactivated smart contract graph;

[0028] Input the deactivated smart contract graph and the vectorized smart contract graph into the degree-free graph convolutional network model DR-GCN at the same time to perform multi-layer convolution operations;

[0029] Pool the convolutional features to reduce the feature dimension;

[0030] The pooled features are passed into the fully connected network layer to obtain the final feature description;

[0031] Determine the vulnerability of the smart contract according to the feature description.

[0032] Furthermore, the method further comprises:

[0033] Use KL divergence and Manhattan distance to measure the similarity of detection results, and fuse the results with cross entropy loss;

[0034] According to the fused loss function, the parameters of the edge-loss graph convolutional network model are updated.

[0035] The beneficial effects of the technical solution provided by the embodiment of the present application are: the present application constructs a smart contract graph according to the smart contract; standardizes the smart contract graph to obtain a standard smart contract graph; vectorizes the standard smart contract graph to obtain a vectorized smart contract graph; inputs the vectorized smart contract graph into the edge-deactivated graph convolutional network model to detect the vulnerabilities of the smart contract. The present application adopts the ED-GCN model, which can effectively capture the information transfer and dependencies in the code and better identify potential vulnerabilities. It adopts the edge-deactivation method, so that the model can learn richer and deeper feature representations, which can effectively prevent overfitting. By introducing a contrastive learning mechanism, the robustness and security of the model are enhanced. The present application has higher accuracy, recall and precision in smart contract vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 The smart contract source code provided in the embodiment of the present application is used to construct a smart contract graph;

[0038] Figure 2 It is a standardized diagram of the smart contract diagram provided in the embodiment of the present application;

[0039] Figure 3 It is a vectorized smart contract graph node feature graph provided in an embodiment of the present application;

[0040] Figure 4 This is a diagram of the ED-GCN model architecture provided in an embodiment of the present application;

[0041] Figure 5 is an edge deactivation flow chart provided in an embodiment of the present application;

[0042] Figure 6It is a ROC curve diagram of the ED-GCN vulnerability detection method provided in the embodiment of the present application under the test set. DETAILED DESCRIPTION

[0043] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0044] It should be clear that the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0045] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0046] In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. In addition, in the description of the present application, unless otherwise specified, "plurality" refers to two or more.

[0047] 1. Build a smart contract graph

[0048] 1.1 Construction of Smart Contract Graph Node

[0049] When performing vulnerability detection, a large amount of program code and function calls are often encountered. However, not all program elements are necessary for vulnerability detection. Some program elements are very important in vulnerability detection, while other operations may only exist to implement specific functions or optimize code and do not directly affect the results of vulnerability detection. This application designs three types of nodes based on the impact on the results of vulnerability detection, namely, primary nodes, secondary nodes, and fallback nodes. Each node is represented by a four-tuple (Order, Limit, Call, Type), where Order indicates the calling order of the node, Limit indicates whether there is a permission modifier, Call indicates the caller, and Type indicates the node type. Example: (S1LimitedAC W1 2)

[0050] The first-level node represents the calls and variables that can directly affect the results of smart contract vulnerability detection. For the first-level node, this application uses W1, W2, ..., W n express.

[0051] (1) The first-level nodes of the reentrancy vulnerability: ① The call of the call.value built-in function; ② The function that calls the call.value function to transfer money; ③ The function that calls the transfer function; ④ The variable corresponding to the user balance; ⑤ The variable that can directly affect the user balance.

[0052] (2) The first-level nodes of the timestamp vulnerability: ① The block.timestamp variable itself; ② The variable compared with the block.timestamp variable; ③ The function that calls the block.timestamp variable to perform smart contract judgment; ④ The function that meets condition ② is called.

[0053] Secondary nodes represent functions and variables that play an auxiliary role in vulnerability detection, that is, all nodes in the function except the primary node and the fallback function. This application uses S1, S2, ..., S n express.

[0054] The triggering of the reentrancy vulnerability is related to the fallback function. This application has designed a fallback node for the fallback function to represent the interaction with the primary node. Each smart contract has only one fallback function, which is represented by F in this application.

[0055] 1.2 Construction of Smart Contract Graph Edges

[0056] In order to express the dependency relationship between nodes, this application constructs four types of edges for the smart contract graph, each of which consists of a four-tuple (N s ,N e ,O,S). Where N s Indicates the starting point of the edge, N e represents the end point of the edge, O represents the execution order of the edge in the program, and S represents the symbolic representation of the edge. Table 1 lists the symbolic types of the edge in detail.

[0057] (1) Control flow edge: represents a directed edge from node A to node B, indicating that the program jumps from A to B during execution. It includes conditional control flow edges, loop control flow edges, execution order edges, and safety handle statements.

[0058] (2) Data flow edge: represents the transmission direction of variables in the smart contract, showing the path of variables flowing from one node to another.

[0059] (3) Fallback edge: represents the process of a node calling a fallback function and a fallback function calling back the node. This application uses two edges for construction, one of which represents the call of the node and the other represents the callback of the fallball function.

[0060] The smart contract graph is constructed as follows Figure 1 shown.

[0061] Table 1 Edge symbols, meanings and types

[0062]

[0063]

[0064] 2. Smart Contract Graph Standardization

[0065] In the process of message transmission, graph neural networks usually regard the importance of each node as the same, but this application divides the nodes in the smart contract graph into primary, secondary and fallback according to their importance. Therefore, this application removes nodes from the constructed smart contract graph and reconstructs a standardized smart contract graph.

[0066] First, the secondary nodes S1, S2, ..., S n The nodes are removed and fallback nodes are eliminated, and their features are passed to nearby first-level nodes. If there are multiple first-level nodes near a node, its features are broadcast to all first-level nodes connected to it. Then, the edges connected to the deleted nodes are retained, and the starting and ending points of the edges connected to the deleted nodes are changed to the first-level nodes connected to it, that is, the first-level nodes add self-loop edges. Finally, the features of the first-level node are merged with the features of the deleted node, that is, the feature quadruple of the first-level node is spliced ​​with the feature quadruple of the deleted node. Figure 2 The following is the standardized process of smart contract diagram. This application uses V1, V2, ..., V n Represents the fused node.

[0067] 3. Vectorized representation of standard smart contract graphs

[0068] As mentioned above, the smart contract graph consists of nodes and edges, and their feature information is recorded by text. The graph convolutional network cannot directly learn text-type data, so the smart contract graph needs to be vectorized. This section uses the BERT algorithm to vectorize the node features of the smart contract graph, and uses One-Hot encoding to vectorize the edge features of the smart contract graph.

[0069] 3.1 Smart Contract Graph Node Feature Vectorization

[0070] Converting textual node features into vectorized representations is an important prerequisite for graph neural networks (GNNs) to process graph data. These vectors can capture the semantic information of the node text content, which helps GNNs better capture the associations between nodes when learning graph structures and unstructured data. This application uses a Transformer-based bidirectional encoder representation algorithm (Bidirectional Encoder Representations from Transformers, BERT) to vectorize the node features of smart contract graphs.

[0071] BERT is a pre-trained natural language processing model proposed by Google in 2018 that can convert text into BERT vectors for use in downstream vulnerability detection tasks. In the BERT model, the input text is first processed by a tokenizer to split the text into individual words or subwords. Then, these subwords are passed through the word vector embedding layer to obtain their own vectorized representations. These vectorized representations are passed as input to the next layer of the model. The BERT model contains multiple Transformer Encoder layers, each of which contains multiple self-attention mechanisms. In these layers, the input vectorized representation is processed by the self-attention mechanism to obtain a richer vectorized representation with contextual information. These representations are continuously abstracted and fused in each layer to eventually form a high-order vectorized representation. Figure 3 Shown is the vectorization process of smart contract graph node features.

[0072] 3.2 Vectorization of Smart Contract Graph Edge Features

[0073] In graph convolutional networks, One-Hot vectorized edge features are an effective representation method that can encode edge attribute information into binary vectors, thereby improving the model's ability to learn graph structures.

[0074] One-Hot encoding, also known as unique hot encoding, is an encoding method that converts a multi-classification problem into a binary classification problem. It maps the categories in the original data into binary vectors, where the element value 1 represents the corresponding category and 0 represents the non-corresponding category. Assuming there is a data set with n categories, the One-Hot encoded data will be represented as n vectors of length n.

[0075] This application uses One-Hot encoding to vectorize the edge information of the smart contract graph, converting the feature information contained therein into a binary vectorized representation, which can map the words in the text into a fixed-length binary vector. These vectors will be used as the edge information of the semantic graph to represent the relationship between nodes.

[0076] 4. Graph Convolutional Network Model Based on Edge Loss

[0077] 4.1 Overall Model Architecture

[0078] This application combines edge deactivation with the undegraded graph convolutional network model DR-GCN, and proposes a graph convolutional network model ED-GCN based on edge deactivation. On the basis of the original DR-GCN, the concept of edge deactivation is introduced. Specifically, the model will simultaneously pass the vectorized smart contract graph and the edge-deactivated smart contract graph to DR-GCN for feature extraction. In order to measure the difference in features before and after edge deactivation, this application uses indicators such as KL divergence and Manhattan distance. These indicators can help evaluate the effect of the DR-GCN model on feature extraction, thereby further optimizing the model. Finally, these evaluation indicators are fused with the cross entropy loss, and the model is back-propagated to optimize the model. The overall architecture is as follows Figure 4 As shown, the workflow and principle of the ED-GCN model are demonstrated.

[0079] The main components of the ED-GCN model are as follows:

[0080] (1) Input: Vectorized smart contract graph G = (V, E), where V represents the node set and E represents the edge set.

[0081] (2) Deactivation of edges in vectorized smart contract graphs: According to the Bernoulli probability distribution, deactivation probability is added to the edges of the vectorized smart contract graphs.

[0082] (3) Constructing the deactivated smart contract graph: The vectorized smart contract graph G is combined with the edge deactivation probability to generate the edge deactivated smart contract graph G'.

[0083] (4) Convolutional layer: The edge-deactivated smart contract graph G’ and the vectorized smart contract graph G are simultaneously input into DR-GCN for multi-layer convolution operations.

[0084] (5) Pooling layer: Pool the convolutional features to reduce the feature dimension.

[0085] (6) Fully connected network layer: The pooled features are passed into the fully connected network layer to obtain the final feature description.

[0086] (7) Output: KL divergence and Manhattan distance are used to measure the similarity of the detection results, and the results are fused with the cross entropy loss.

[0087] (8) Back propagation: Update the model parameters based on the fused loss function.

[0088] 4.2 Smart Contract Graph Edge Deactivation Method Based on Bernoulli Probability Distribution

[0089] In graph data structures, edge deactivation usually refers to the operation of removing an edge from a graph or marking it invalid. This can be achieved by deleting the edge or modifying its state. When an edge is deactivated, it is no longer considered part of the graph structure and does not participate in any graph algorithms or graph traversal processes.

[0090] The significance of edge dropout is that it can simulate the phenomenon of missing data in the real world and help the model better generalize and adapt to unknown situations. Through edge dropout, the model can learn a more robust and robust representation, rather than relying solely on complete data. Edge dropout is similar to introducing noise during the training process, which can effectively reduce the risk of overfitting of the model. In addition, edge dropout can also help the model better discover hidden patterns and potential relationships in the data. By deliberately deleting some edge information, the model is forced to learn to use other features for prediction, thereby stimulating it to learn more information and transformation methods. Finally, edge dropout can increase the diversity of graph data, enrich training samples, and help improve the robustness and generalization ability of the model, making it perform better when facing unknown data.

[0091] This application proposes a smart contract graph edge deactivation method based on Bernoulli probability distribution. For a given input graph G = (A, X), A represents the adjacency matrix, where the rows and columns of the matrix represent the nodes in the graph, and the elements in the matrix represent whether there is a connection between the nodes. Usually, if there is a connection between node i and node j, the values ​​of the positions (i, j) and (j, i) in the adjacency matrix will be set to 1, otherwise it will be 0. For the edge deactivation operation, you only need to change the value of the corresponding position to 0. For the adjacency matrix A, the adjacency matrix after the edge deactivation operation is for:

[0092]

[0093] Where L is the position matrix, that is, the position where the edge is deactivated is 1, otherwise it is 0. The edge deactivation process of the smart contract graph based on Bernoulli probability distribution is as follows: Figure 5 shown.

[0094] The position matrix L is determined by Bernoulli distribution. For each edge in the graph, a random number from 0 to 1 is generated. If this number is less than the set inactivation probability p, then the edge will be inactivated, that is, the matrix element value is 1.

[0095] 4.3 Loss Function Based on Edge Loss Similarity Comparison

[0096] KL divergence (Kullback-Leibler Divergence, KLD), first proposed by Solomon Kullback and Richard Leibler in 1951, is also known as relative entropy. It is a statistical tool to quantify the difference between two probability distributions. Suppose there are two probability distributions, denoted as P and Q, and their corresponding probability mass functions are p(x) and q(x) respectively. KL divergence can be defined as:

[0097]

[0098] Where X is the range of values ​​of the random variable x. In neural networks, KL divergence is usually used to evaluate the closeness between the probability distribution of model-generated data and the distribution of real data. This application uses KL divergence to compare the difference between the edge-deactivated smart contract graph and the original smart contract graph.

[0099] Manhattan distance is also a commonly used distance measurement method. In the field of graphics processing, Manhattan distance can be used to compare the similarity or distinction between two images; in neural networks, Manhattan distance can be used to evaluate the similarity between samples, so as to perform tasks such as clustering or classification. Suppose there are two vectors, denoted as A and B, represented as (A1, A2, ..., A n ) and (B1, B2, …, B n ), the Manhattan distance between them can be expressed by the following equation:

[0100] d(A,B)=|A1-B1|+|A2-B2|+...+|A n -B n |

[0101] This application combines KL divergence, Manhattan distance and cross entropy loss function for back propagation. Cross entropy is a loss function used for multi-classification problems. KL divergence and Manhattan distance are proportionally fused to measure the difference between the edge-deactivated smart contract graph and the original smart contract graph. The ED-GCN model better simulates the diversity of smart contracts in the real world, enhances the model's ability to detect unknown smart contracts, improves the model's generalization ability, and better applies the model to actual detection work. The loss function calculation formula is:

[0102] Loss = (α × D KL +β×d)+Cross Entropy Loss

[0103] Among them, α and β represent the proportion of KL divergence and Manhattan distance in the loss function, respectively, and are two hyperparameters.

[0104] 5. Comparative experiment and result analysis

[0105] 5.1 Experimental Environment

[0106] (1) Dataset setting. This application collected a total of 40,932 solidity language smart contracts (ESC) under the Ethereum blockchain platform, and used these smart contracts in comparative experiments on reentrancy vulnerability detection. At the same time, 4,170 C language smart contracts (VSC) from VNT chain were used in comparative experiments on timestamp dependency vulnerability detection. For the ESC and VSC datasets, this application used 80% of the smart contracts as the training set to train the model, and the remaining 20% ​​of the smart contracts were used as the test set to test the performance of the model.

[0107] (2) The experimental environment of this application is shown in Table 2.

[0108] Table 2 Experimental environment

[0109]

[0110] 5.2 Experimental evaluation indicators

[0111] In the field of neural networks, classification problems are a very common and important type of problem, and its goal is to predict the category to which the input data belongs based on the input features. In order to evaluate the performance of the classification model, some key indicators are needed to measure the quality of the model. This application uses accuracy, recall, F1-Score and precision as evaluation indicators. Among them, accuracy is regarded as a criterion for evaluating the prediction accuracy of the classification model, while precision focuses on the proportion of positive samples determined by the model that truly belong to the positive class. The recall rate focuses on the proportion that the model can correctly predict among all truly positive samples. The F1 value is the harmonic mean between precision and recall, taking into account the balance between the two, and the larger the value, the better.

[0112] (1) Accuracy is the most intuitive performance evaluation criterion, which is defined as the ratio of the number of samples accurately predicted by the model to the total number of samples. The calculation formula is as follows:

[0113]

[0114] In classification problems, TP, TN, FP, and FN are important indicators for evaluating the performance of classification models. These indicators are derived from the "Confusion Matrix", which is a table shown in Table 3 that describes the degree of match between the prediction results of the classification model and the actual situation.

[0115] Table 3 Confusion matrix

[0116]

[0117]

[0118] True Positive (TP) indicates the number of positive samples accurately predicted by the model. True Negative (TN) indicates the number of negative samples accurately predicted by the model. False Positive (FP) indicates the number of samples whose true labels are negative and whose model incorrectly predicts positive samples. False Negative (FN) indicates the number of samples whose true labels are positive and whose model incorrectly predicts negative samples.

[0119] (2) Recall is a measure of the model’s ability to capture positive samples. It calculates the proportion of positive instances correctly identified by the model to all actual positive instances. The calculation formula is as follows:

[0120]

[0121] As the recall rate increases, it indicates that the model's ability to identify true positive samples becomes stronger. For application scenarios with high missed detection costs, the recall rate is a very important indicator.

[0122] (3) Precision is defined as the proportion of samples that actually belong to the positive class among all samples predicted by the model to be in the positive class. It reflects the prediction accuracy of the model. The calculation formula is:

[0123]

[0124] When FP is high, the accuracy will decrease, and the increase in precision indicates that the model has a stronger ability to distinguish negative samples. Therefore, in situations where the cost of false positives is high, such as spam filtering and disease screening, accuracy is a very critical indicator.

[0125] (4) The F1 value reflects the harmonic mean of precision and recall, aiming to achieve a balance between the two, so as to more comprehensively understand and evaluate the model. The F1 value is calculated using the following formula:

[0126]

[0127] 5.3 Comparative Experiment and Result Analysis

[0128] 5.3.1 Comparison with traditional vulnerability detection methods

[0129] The effectiveness of the ED-GCN detection method is verified by comparing and analyzing with existing traditional vulnerability detection methods. Experimental results show that the performance of ED-GCN in vulnerability detection tasks is significantly better than other comparison methods. Specifically, ED-GCN has achieved high scores in accuracy, recall, precision, and F1 score. Table 4 shows the comparison of the vulnerability detection performance evaluation results of ED-GCN and different traditional models. All experiments in this application have undergone 10 cross-certifications. The multiple rounds of re-verification help reduce the possibility of interference from accidental factors, thereby improving the accuracy and credibility of the evaluation results.

[0130] Table 4 Performance comparison of ED-GCN and traditional vulnerability detection methods in reentrant vulnerability and timestamp dependent vulnerability detection tasks

[0131]

[0132] Experimental results show that for reentrant vulnerabilities, the ED-GCN method has achieved good performance in all four indicators, and has significantly improved compared to the most advanced Mythril method. In terms of vulnerability detection accuracy, the accuracy of the ED-GCN method reached 89.91%, while the accuracy of the Mythril method was only 60.54%. The ED-GCN method has higher accuracy in identifying real vulnerabilities and reduces the false alarm rate. In terms of recall rate, precision rate and F1 value, the ED-GCN method achieved excellent results of 86.62%, 84.21% and 84.58% respectively, significantly exceeding other comparison methods.

[0133] Compared with traditional methods, the neural network-based method ED-GCN can better capture the characteristics of timestamp vulnerabilities, thereby improving the effectiveness of vulnerability detection. Experiments have shown that the ED-GCN method has a higher accuracy rate, reaching 83.18% accuracy in detecting timestamp vulnerabilities. At the same time, the recall rate, precision rate and F1 value reached 83.68%, 82.78% and 82.45% respectively, which is significantly better than traditional methods such as Smartcheck, Oyente and Mythril methods.

[0134] 5.3.2 Comparison with Neural Network-based Vulnerability Detection Methods

[0135] This application verifies the performance of the proposed ED-GCN method in smart contract vulnerability detection through comparative analysis, and evaluates it horizontally with other deep learning detection technologies. The experimental data shown in Table 5 show that in the field of smart contract vulnerability detection, the ED-GCN method demonstrates excellent performance and achieves high accuracy and recall. This application carried out experimental work based on the real Ethereum smart contract dataset. The comparison methods include traditional neural network methods Vanilla-RNN, LSTM and graph neural network-based methods GRU, GCN, DR-GCN, etc. The results show that compared with other methods, the ED-GCN method has higher detection accuracy and recall.

[0136] Table 5 Performance comparison of ED-GCN and neural network detection methods in reentrancy vulnerability and timestamp dependency vulnerability detection tasks

[0137]

[0138] For reentrancy vulnerabilities, the ED-GCN method achieved 90.52%, 86.76%, 85.72% and 85.46% in accuracy, recall, precision and F1 value respectively. In the detection of timestamp-dependent vulnerabilities, it also achieved 85.50%, 83.73%, 88.01% and 85.29% respectively. Compared with other neural network methods for smart contract vulnerability detection, ED-GCN has the following advantages:

[0139] (1) Efficiency: ED-GCN uses graph convolutional networks (GCN) to model smart contracts, which can effectively capture the information transfer and dependencies in the code, thereby better identifying potential vulnerabilities.

[0140] (2) Multi-level feature extraction: ED-GCN adopts edge loss, which enables the model to learn richer and deeper feature representations and effectively prevent overfitting.

[0141] (3) Adversarial training: ED-GCN introduces a contrastive learning mechanism to enhance the robustness and security of the model.

[0142] The ROC curve is used to measure the performance of the ED-GCN method in smart contract vulnerability detection. The ROC curve is a commonly used indicator for evaluating the performance of a binary classification model. It can be used to judge the performance of the model at different thresholds and select the best threshold to balance the sensitivity and specificity of the model. The experimental results show that the ED-GCN method exhibits high accuracy and robustness in smart contract vulnerability detection. Figure 6The ROC curve analysis shown in the figure shows that this method can achieve good performance at different thresholds, and has a good effect when sensitivity and specificity are taken into consideration. This proves that the ED-GCN method has great potential in smart contract vulnerability detection and can effectively improve the security of smart contracts.

[0143] The above is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A smart contract vulnerability detection method based on edge-deactivation graph convolutional network, characterized in that: The following steps are involved: Build a smart contract graph based on smart contracts; Standardizing the smart contract graph to obtain a standard smart contract graph; Vectorize the standard smart contract graph to obtain a vectorized smart contract graph; The vectorized smart contract graph is input into an edge-deactivation graph convolutional network model to detect vulnerabilities in the smart contract.

2. The method according to claim 1, characterized in that The step of constructing a smart contract graph according to the smart contract includes: Create corresponding smart contract graph nodes according to the program elements of the smart contract; Corresponding smart contract graph edges are created according to the grammatical and semantic relationships between the program elements.

3. The method according to claim 2, characterized in that The step of creating a corresponding smart contract graph node according to the program elements of the smart contract includes: Treat reentrant functions and timestamp functions as first-level nodes; Treat functions other than primary nodes and fallback functions as secondary nodes; Use the fallback function as the fallback node.

4. The method according to claim 1, characterized in that: The step of standardizing the smart contract graph to obtain a standard smart contract graph includes: Delete the secondary nodes and fallback nodes of the smart contract graph, and pass the features to nearby primary nodes; Change the starting and ending points of the smart contract graph edges connected to the deleted node to first-level nodes; The features of the first-level node and the deleted node are merged.

5. The method according to claim 1, characterized in that The vectorizing the standard smart contract graph includes: Input the node information of the standard smart contract graph node into the bidirectional encoder representation algorithm model to obtain a vectorized smart contract graph node; The attribute information of the standard smart contract graph edge is encoded using One-Hot to obtain a vectorized smart contract graph edge.

6. The method according to claim 1, characterized in that The step of inputting the vectorized smart contract graph into an edge-deactivation graph convolutional network model to detect vulnerabilities in the smart contract includes: Inputting the vectorized smart contract graph into the edge-deactivation graph convolutional network model; Add deactivation probability to the edges of the vectorized smart contract graph according to the Bernoulli probability distribution; Combining the vectorized smart contract graph with the edge deactivation probability to generate a deactivated smart contract graph; Input the deactivated smart contract graph and the vectorized smart contract graph into the degree-free graph convolutional network model DR-GCN at the same time to perform multi-layer convolution operations; Pool the convolutional features to reduce the feature dimension; The pooled features are passed into the fully connected network layer to obtain the final feature description; Determine the vulnerability of the smart contract according to the feature description.

7. The method according to claim 6, characterized in that The method further comprises: Use KL divergence and Manhattan distance to measure the similarity of detection results, and fuse the results with cross entropy loss; According to the fused loss function, the parameters of the edge-loss graph convolutional network model are updated.

Images