Intelligent contract library misuse detection method and system based on large language model and static analysis

Abstract

The invention relates to an intelligent contract library misuse detection method and system based on a large language model and static analysis. The method comprises the following steps: extracting library misuse information; constructing a cue word method of first generation and second selection; performing intelligent contract detection of the large language model by using a cue word method, and performing result iteration feedback optimization by taking an obtained preliminary detection result as a part of next input to obtain a target large language model; creating a static matching BCSSM structure; and performing weighted matching on the detection results of the target large language model and the static matching structure, and outputting a final detection result. According to the method, the big language model is used for intelligent contract detection through a prompt word construction method, the library misuse mode of the intelligent contract can be accurately detected through code analysis and logical reasoning ability and static matching of the big language model, the method is applied to the development and maintenance stages of the intelligent contract, and the safer intelligent contract can be achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of software engineering vulnerability detection, and in particular to a method and system for detecting misuse of a smart contract library based on a large language model and static analysis. Background Art

[0002] Blockchain technology is known for its decentralized and immutable characteristics and excellent security, and has found widespread applications in key areas such as finance and healthcare. Ethereum, as the first public blockchain platform to support smart contracts, has revolutionized the blockchain space by introducing a programmable blockchain that supports the creation of smart contracts and has become one of the most popular blockchain platforms. Smart contracts are self-executing contracts whose agreement terms are written directly in lines of code and run on the blockchain. The Ethereum platform allows developers to write smart contracts using its main language Solidity and deploy them on the Ethereum Virtual Machine (EVM). EVM is a decentralized virtual machine that uses an international network of public nodes to execute code. This approach brings a higher degree of transparency and trust because transactions and contract status are recorded immutably on the blockchain. Solidity libraries are a set of reusable functions that can be called by other contracts. Developers often encapsulate common operations or functions that solve specific problems. When other developers want to implement similar functions, they can import these libraries and use their methods to solve specific problems. Improper implementation or application of libraries during smart contract development may lead to defects in the contract. There is currently a lack of tools that can effectively detect and identify library misuse patterns in smart contracts.

[0003] Library misuse is a common problem in smart contract development, involving three key roles: developers who create libraries, contract developers who use libraries, and the community that maintains libraries. Effective collaboration between these three roles helps develop smart contracts. However, improper behavior by developers who create libraries or contract developers who use libraries is called library misuse, including but not limited to incorrect function calls, incomplete understanding of library function capabilities, or failure to update to a secure version of the library in a timely manner, thereby introducing security vulnerabilities. Therefore, traditional library misuse detection methods have the problem of inaccurate detection. Summary of the invention

[0004] Based on this, in order to solve the above technical problems, a smart contract library misuse detection method and system based on a large language model and static analysis is provided to improve the detection accuracy of library misuse.

[0005] A smart contract library misuse detection method based on large language model and static analysis, including:

[0006] Extract library misuse information corresponding to various library misuse patterns of smart contracts from the database;

[0007] Based on Auto-CoT and zero-shot-CoT, a Pre-generated-Then Selected prompt word method was constructed;

[0008] According to the library misuse information, the prompt word method is used to perform smart contract detection of a large language model to obtain preliminary detection results;

[0009] The preliminary detection result is used as part of the prompt words in the next large language model smart contract detection, the large language model is optimized by iterative feedback of the results to obtain a target large language model, and the first library misuse detection result is obtained by the target large language model;

[0010] Creating a static matching BCSSM structure based on code similarity, and obtaining a second library misuse detection result through the static matching BCSSM structure;

[0011] Weighted matching is performed on the first library misuse detection result and the second library misuse detection result, and a target library misuse detection result is output.

[0012] In one embodiment, library misuse information corresponding to various types of library misuse patterns of smart contracts is extracted from the database, including:

[0013] Finding pattern names, scenario descriptions, and code features of various types of library misuse patterns from the data, and using the pattern names, scenario descriptions, and code features as library misuse information;

[0014] The library misuse patterns include invalid wrappers in the library, unhandled exceptions in the library, abnormal library extension, abnormal use, incomplete function replacement, abnormal library capacity estimation, and abnormal library use.

[0015] In one embodiment, the prompt word method is used to perform smart contract detection of a large language model to obtain preliminary detection results, including:

[0016] Positioning the role of the large language model to determine the smart contract source code to be tested;

[0017] According to the library misuse information, code understanding and logical reasoning matching are performed on the source code of the smart contract to be detected to obtain a matching result;

[0018] Based on the matching result, determining a recognition ratio of identifying the library misuse pattern in the smart contract source code to be detected as another type of library misuse pattern;

[0019] Obtaining a preliminary detection result based on the matching result and the recognition ratio;

[0020] An output format type is determined, and the format type is applied to the output of the preliminary detection result.

[0021] In one embodiment, the preliminary detection result is used as part of the prompt words in the next large language model smart contract detection, and the large language model is optimized by iterative feedback of the result to obtain a target large language model, including:

[0022] Extracting the detection result error rate and false alarm ratio from the preliminary detection results;

[0023] The extracted error rate and false alarm ratio are subjected to information fusion, and the fused information is used as part of the prompt words in the next large language model smart contract detection, and a cyclic optimization is performed to obtain an evaluation index of the detection result;

[0024] If the evaluation index reaches the evaluation threshold, the iteration is stopped, and the last evaluation result is used as the output result of the large language model to obtain the target large language model.

[0025] In one embodiment, obtaining the second library misuse detection result by the static matching BCSSM structure includes:

[0026] The code snippet and input code of the smart contract are converted into a TF-IDF matrix using the TF-IDF technology through the static matching BCSSM structure;

[0027] Calculate the cosine similarity between the input code and each of the code fragments according to the TF-IDF matrix to obtain a calculation result;

[0028] A second library misuse detection result is obtained according to the calculation result.

[0029] In one embodiment, weighted matching is performed on the first library misuse detection result and the second library misuse detection result, including:

[0030] Comparing the first library misuse detection result and the second library misuse detection result to obtain a comparison result;

[0031] When the comparison result shows that the first library misuse detection result and the second library misuse detection result are consistent, outputting the target library misuse detection result;

[0032] When the comparison result is that the first library misuse detection result and the second library misuse detection result are inconsistent, the first library misuse detection result and the second library misuse detection result are weighted.

[0033] In one embodiment, the method further comprises:

[0034] Determine a result output format, and parse and output the target library misuse detection result according to the result output format.

[0035] A smart contract library misuse detection system based on large language model and static analysis, including:

[0036] The information extraction module is used to extract library misuse information corresponding to various library misuse patterns of smart contracts from the database;

[0037] A prompt word method construction module is used to construct a Pre-generated-Then Selected prompt word method based on the automatic thinking chain Auto-CoT and the zero-shot thinking chain zero-shot-CoT;

[0038] A preliminary detection module, used to perform smart contract detection of a large language model using the prompt word method according to the library misuse information to obtain a preliminary detection result;

[0039] A model optimization module, configured to use the preliminary detection result as part of the prompt words in the next large language model smart contract detection, perform result iterative feedback optimization on the large language model to obtain a target large language model, and obtain the first library misuse detection result through the target large language model;

[0040] A static analysis module, used for creating a static matching BCSSM structure based on code similarity, and obtaining a second library misuse detection result through the static matching BCSSM structure;

[0041] The detection module is used to perform weighted matching on the first library misuse detection result and the second library misuse detection result, and output the target library misuse detection result.

[0042] The above-mentioned smart contract library misuse detection method and system based on large language model and static analysis uses a large language model to perform smart contract detection by constructing a prompt word method, and utilizes the code parsing and logical reasoning capabilities and static matching of the large language model. It has strong generalization capabilities and can be applied to smart contract codes of different types or sizes. It can more accurately detect the library misuse patterns of smart contracts, and can be applied to the development and maintenance stages of smart contracts to achieve safer smart contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is an application environment diagram of a smart contract library misuse detection method based on a large language model and static analysis in one embodiment;

[0044] Figure 2 1 is a flow chart of a method for detecting misuse of a smart contract library based on a large language model and static analysis in one embodiment;

[0045] Figure 3 A diagram showing the analysis of prompt words used in an embodiment;

[0046] Figure 4 A schematic diagram of iterative feedback optimization of a large language model detection module result in one embodiment;

[0047] Figure 5 A schematic diagram of a static matching BCSSM based on code similarity in one embodiment;

[0048] Figure 6 This is a table of four evaluation indicators for each module in the experimental results and the final results;

[0049] Figure 7 is a structural block diagram of a smart contract library misuse detection system based on a large language model and static analysis in one embodiment;

[0050] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe library misuse detection results, but these library misuse detection results are not limited by these terms. These terms are only used to distinguish a first library misuse detection result from another library misuse detection result. For example, without departing from the scope of this application, a first library misuse detection result may be referred to as a second library misuse detection result, and similarly, a second library misuse detection result may be referred to as a first library misuse detection result. Both the first library misuse detection result and the second library misuse detection result are library misuse detection results, but are not the same library misuse detection result.

[0053] The smart contract library misuse detection method based on large language model and static analysis provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1As shown, the application environment includes a computer device 110. Manually extract library misuse information corresponding to various library misuse patterns of smart contracts from the database; the computer device 110 can construct a Pre-generated-ThenSelected prompt word method based on the automatic thinking chain Auto-CoT and the zero-shot thinking chain zero-shot-CoT; the computer device 110 can use the prompt word method to perform smart contract detection of the large language model according to the library misuse information to obtain a preliminary detection result; the computer device 110 can use the preliminary detection result as part of the prompt word in the next large language model smart contract detection, perform result iterative feedback optimization on the large language model, obtain a target large language model, and obtain a first library misuse detection result through the target large language model; the computer device 110 can create a static matching BCSSM structure based on code similarity, and obtain a second library misuse detection result through the static matching BCSSM structure; the computer device 110 can perform weighted matching on the first library misuse detection result and the second library misuse detection result, and output the target library misuse detection result. The computer device 110 may be, but is not limited to, various personal computers, laptop computers, smart phones, robots, unmanned aerial vehicles and other devices.

[0054] In one embodiment, Figure 2 As shown, a smart contract library misuse detection method based on a large language model and static analysis is provided, including the following steps:

[0055] Step 202: extract library misuse information corresponding to various types of library misuse patterns of smart contracts from the database.

[0056] Operators can manually extract library misuse information corresponding to various library misuse patterns of smart contracts from the database. After collecting the smart contract data set, the computer equipment can pre-process the data for subsequent operations.

[0057] In one embodiment, a smart contract library misuse detection method based on a large language model and static analysis is provided, which may also include a process of extracting information, the specific process including: finding the pattern name, scenario description, and code features of various types of library misuse patterns from the data, and using the pattern name, scenario description, and code features as library misuse information; library misuse patterns include invalid wrappers in the library, unhandled exceptions in the library, abnormal library extension, abnormal use, incomplete function replacement, abnormal library capacity estimation, and abnormal library usage.

[0058] Among them, the code features of each type of library misuse pattern can be manually extracted from the database, including the scenario description and code-level features of each type of library misuse pattern. Specifically, the operator can extract various types of library misuse patterns of smart contracts, including scenario descriptions and code features, that is, extract information on eight types of library misuse patterns from empirical research, including the name of each type of library misuse pattern, the scenario description of each type of library misuse pattern, and the code features of each type of library misuse pattern. In specific implementation, the information on eight types of library misuse patterns is manually extracted from the database provided by the empirical research, specifically including: the pattern name of each type of library misuse pattern, the scenario description of each type of library misuse pattern, and the code features of each type of library misuse pattern.

[0059] In this embodiment, the eight types of library misuse patterns extracted include: invalid wrapper checks in libraries, unhandled exceptions in libraries, inappropriate library extensions, inappropriate "using for" usage, incomplete function replacement, overestimation of library capabilities, underestimation of library capabilities, and unnecessary library usage.

[0060] Specifically, the eight types of library misuse patterns are as follows:

[0061] Invalid wrapper checks in libraries: The check logic implemented in library functions is flawed and cannot handle all expected scenarios, leading to security issues. For example, the SafeERC20 library is designed to protect ERC-20 token operations, but developers may fail to use the library correctly, such as failing to check return values, leading to potential risks.

[0062] Unhandled exceptions in the library: The library was not designed with all possible exceptions in mind, resulting in contract execution failures in some cases. For example, a library function might interact with other contracts during execution, but no exception responses from those contracts were handled.

[0063] Inappropriate library extension: Multiple functions are mixed in library functions, making them too complex, difficult to maintain and understand, and increasing the risk of errors. For example, a library function is responsible for calculating and verifying different business logics at the same time, increasing the possibility of errors.

[0064] Inappropriate use of 'using for': Incorrect use of the 'using for' statement in a contract binds library functions to incompatible or unnecessary data types. For example, the SafeMath library is designed for uint256 type but is incorrectly applied to int256 type.

[0065] Incomplete function replacement: In the contract, the original unsafe function is not completely replaced by the safer version provided by the library. For example, when using the SafeERC20 library, the developer failed to replace all approve calls with safeApprove, missing some replacements.

[0066] Overestimation of library capabilities: Developers mistakenly assume that library functions have certain unimplemented capabilities. For example, using a library function to check if an address is a contract, but the function does not verify the contract's deployment code.

[0067] Underestimation of library capabilities: Developers fail to fully utilize the functionality provided by library functions, resulting in redundant implementation of library functions in contracts.

[0068] Unnecessary library usage: Unnecessary libraries are included in the contract. These libraries are either not used or have been natively supported by the new version of the compiler, resulting in a waste of resources. For example, although Solidity 0.8 has built-in overflow checking, developers still introduced the SafeMath library for overflow protection, resulting in unnecessary gas consumption.

[0069] Integrating the information of eight types of library misuse patterns plays a vital role in the deep understanding of code semantics by large language models, because semantic reasoning can better understand the functions of the code and improve the accuracy of detecting misuse behavior of the target contract library.

[0070] Step 204, constructing a Pre-generated-Then Selected prompt word method based on the automatic thinking chain Auto-CoT and the zero-shot thinking chain zero-shot-CoT.

[0071] In this embodiment, the computer equipment certificate can combine the step-by-step thinking ideas of Auto-CoT and zero-shot-CoT to construct a Pre-generated-Then Selected prompt word method to reduce the interference of complex contracts on large models. The prompt words can include the description of the smart contract code, the library misuse mode, and the code features related to each mode.

[0072] Based on the step-by-step thinking of Auto-CoT and zero-shot-CoT, the "Pre-generated-Then Selected" prompt word method can greatly improve the accuracy of large language models in detecting misuse of target contract libraries. Specific steps may include:

[0073] Initial prompt generation: The initial prompt (GenerateInitialPrompt) combines the smart contract code, the description of the library misuse pattern, and the code snippets related to each pattern; the formula is expressed as: GenerateInitialPrompt(C,P,G)=C+P+G; where represents the smart contract code, represents the library misuse pattern and its attribute description, and represents the code features related to each pattern.

[0074] The prompt consists of: Smart contract code: the actual contract code input to LLM, used for pattern matching and logical reasoning; Library misuse pattern description: a detailed description of each pattern to help LLM understand the characteristics of each misuse pattern; Code snippet: a code example related to each misuse pattern, used by LLM to perform pattern matching in the contract code.

[0075] “Pre-generated-ThenSelected” prompt strategy: In order to improve the response quality of LLM and reduce the impact of complex contracts on its reasoning ability, the “Pre-generated-ThenSelected” prompt strategy is adopted; this strategy guides LLM to conduct deeper logical reasoning through a series of analytical thinking processes, and combines the reasoning results with the questions to form more guiding prompts.

[0076] Step 206: Based on the library misuse information, a prompt word method is used to perform smart contract detection on a large language model to obtain a preliminary detection result.

[0077] The computer device can use the Pre-generated-Then Selected prompt word method to perform smart contract detection on the large language model module based on the scenario description and code-level features of the library misuse pattern.

[0078] Among them, in this embodiment, when using the Pre-generated-Then Selected prompt words to perform smart contract detection on the large language model module, two models, GPT-4o and GPT-4Turbo, were used for detection, and the GPT-4Turbo model with the best effect was selected.

[0079] In one embodiment, a method for detecting misuse of a smart contract library based on a large language model and static analysis may further include a process for performing preliminary detection, the specific process including: positioning the role of the large language model to determine the smart contract source code to be detected; performing code understanding and logical reasoning matching on the smart contract source code to be detected based on the library misuse information to obtain a matching result; based on the matching result, determining a recognition ratio for identifying a library misuse pattern in the smart contract source code to be detected as another type of library misuse pattern; obtaining a preliminary detection result based on the matching result and the recognition ratio; determining an output format type, and applying the format type to the output of the preliminary detection result.

[0080] The computer device constructs a Pre-generated-Then Selected prompt word method based on the step-by-step thinking ideas of Auto-CoT and zero-shot-CoT. The prompt word analysis diagram used in this embodiment is as follows Figure 3 As shown, the prompt word structure specifically includes:

[0081] Give the large language model a role positioning. In this embodiment, the large language model role positioning is an experienced smart contract security auditor;

[0082] Determine the original code of the smart contract to be tested;

[0083] Determine the detailed information of eight types of library misuse patterns, including pattern names, scenario descriptions, and code features of each type of pattern;

[0084] Determine the functional requirements, which mainly involve code understanding and logical reasoning matching of the input smart contracts based on the scenario descriptions and code features of the eight types of library misuse patterns;

[0085] The nth test result mainly includes the proportion of misuse patterns of a certain type of library being identified as misuse patterns of another type of library;

[0086] The given json type output format includes: the library misuse pattern number of the target contract, which is divided into P1-P8 and NONE, where NONE means that the target contract does not contain any library misuse behavior; the library misuse pattern name of the target contract, the pattern name of NONE is "NONE"; the scenario description corresponding to the library misuse pattern of the target contract, the scenario description of NONE is "NONE"; the code snippet corresponding to the library misuse pattern of the target contract, the code snippet of NONE is "NONE";

[0087] It is required to perform five background tests on the target contract and select the result with the highest frequency among the five tests as the output result;

[0088] Put constraints on the output format.

[0089] In step 208, the preliminary detection result is used as part of the prompt words in the next large language model smart contract detection, and the large language model is optimized by iterative feedback of the results to obtain a target large language model, and the first library misuse detection result is obtained through the target large language model.

[0090] The schematic diagram of iterative feedback optimization of the large language model detection module is as follows Figure 4 As shown, the computer device can integrate the detection results and use them as part of the next large model detection prompt word to perform iterative feedback optimization of the results. The result R1 of the initial detection of the large language model is used as part of the new prompt word to perform the next large language model iterative detection, and this step is looped, and the analysis is repeated using the new prompt to refine the results. This process will continue until a satisfactory level of accuracy is reached.

[0091] Specifically, in one embodiment, a method for detecting misuse of a smart contract library based on a large language model and static analysis may further include a process of iterative model optimization, the specific process including: extracting the error rate and false alarm ratio of the detection result from the preliminary detection result; fusing the extracted error rate and false alarm ratio, and using the fused information as part of the prompt words in the next large language model smart contract detection, performing loop optimization, and obtaining an evaluation index of the detection result; if the evaluation index reaches an evaluation threshold, stopping the iteration, and using the last evaluation result as the output result of the large language model to obtain a target large language model.

[0092] In this embodiment, the large language model result feedback iterative optimization stage specifically includes: refining the initial detection results, extracting the error rate and false alarm ratio of the target contract detection results; fusing the extracted information into prompt words, and using the prompt words as the result of the second detection; looping the above steps to calculate the evaluation index for each result; stopping the iteration when the evaluation index reaches the accuracy threshold; using the last evaluation result as the final output result of the large language model module; using the GPT-4o and GPT-4Turbo models to perform the above steps, and finally selecting the GPT-4Turbo model with the best effect.

[0093] The results of the initial detection of the large language model are refined, and the refined results are used as part of the prompt words for the next detection. The result feedback is iteratively optimized to further reduce the interference of complex contracts on the detection of the large language model.

[0094] In each iterative analysis, a new prompt is constructed based on the preliminary result R1 of the large language model LLM. This new prompt includes the result of the preliminary analysis and any negative feedback. The formula is: GenerateFeedbackPrompt(R1)=R1+NegativeFeedback(R1). This process gradually adjusts the output of LLM through iterative optimization to improve the accuracy of detection. In each iteration, the output of LLM is used as part of the prompt for the next iteration to form a feedback loop to achieve iterative optimization of LLM output. In this way, LLM can adjust its reasoning process according to the results of the previous analysis and gradually improve the accuracy and reliability of detection.

[0095] Step 210: Create a static matching BCSSM structure based on code similarity, and obtain the second library misuse detection result through the static matching BCSSM structure.

[0096] In this embodiment, two static analysis structures, BCLSM based on character-level static matching and BCSSM based on code similarity, are developed, and the BCSSM structure is selected according to the evaluation index. This structure detects the misuse pattern of the smart contract library by calculating the cosine similarity between the input code and each code fragment.

[0097] Among them, based on character-level static matching (BCLSM), the specific steps are: comprehensively scan the input smart contract code and compare it with the characteristic code fragments of each library misuse pattern; determine the consistency between the input contract code and the code fragment of a specific pattern through quantitative matching; if the contract code has the highest match with the code fragment of a certain pattern, it is considered that the input contract exhibits the library misuse pattern.

[0098] In one embodiment, a smart contract library misuse detection method based on a large language model and static analysis is provided, which may also include a detection process through a static matching BCSSM structure. The specific process includes: using the TF-IDF technology to convert the code snippets and input codes of the smart contract into a TF-IDF matrix through the static matching BCSSM structure; calculating the cosine similarity between the input code and each code snippet according to the TF-IDF matrix to obtain a calculation result; and obtaining a second library misuse detection result according to the calculation result.

[0099] The schematic diagram of static matching BCSSM based on code similarity is as follows Figure 5 As shown in the figure, the code similarity static matching (BCSSM) is based on code similarity. The specific steps are: use TF-IDF (Term Frequency-Inverse Document Frequency) technology to convert the code snippet and the input code into a TF-IDF matrix; TF-IDF is a text representation technology that takes into account term frequency (TF) and inverse document frequency (IDF) to reduce the influence of common words and improve the recognition ability of similarity; calculate the cosine similarity between the input code and each code snippet. The cosine similarity quantifies the angular distance between two vectors. A value close to 1 indicates a high similarity.

[0100] In this embodiment, a character-level static matching BCLSM structure is developed, and pattern detection is performed by determining the consistency between the input contract code and the code fragment of a specific pattern through quantitative matching; a code similarity-based static matching BCSSM structure is developed, and the TF-IDF (Term Frequency-Inverse Document Frequency) technology is used to convert the code fragment and the input code into a TF-IDF matrix and perform pattern detection by calculating the cosine similarity between the input code and each code fragment.

[0101] In this embodiment, the evaluation indicators (including accuracy, recall value, F1 index, and precision) of the output results of the two frameworks BCLSM and BCSSM are calculated, and the BCSSM framework with better results is selected as the static analysis method.

[0102] Step 212: Perform weighted matching on the first library misuse detection result and the second library misuse detection result, and output the target library misuse detection result.

[0103] In one embodiment, a smart contract library misuse detection method based on a large language model and static analysis is provided, which may also include a weighted matching process, and the specific process includes: comparing a first library misuse detection result and a second library misuse detection result to obtain a comparison result; when the comparison result is that the first library misuse detection result and the second library misuse detection result are consistent, outputting a target library misuse detection result; when the comparison result is that the first library misuse detection result and the second library misuse detection result are inconsistent, weighting the first library misuse detection result and the second library misuse detection result.

[0104] That is, in the weight ratio allocation stage in this embodiment, the results of the large language model and the static analysis are combined to obtain the final detection results. The weights of the patterns are taken into account when the results are integrated. These weights are proportional to the frequency of occurrence in the real-world contract. When the module results are inconsistent, the consistency results are given priority, and the decision is optimized based on the weighted evaluation of the two results. The computer device can match the results of the large language model with the results of the static analysis according to the weight ratio. When matching, the weights are allocated according to the proportion of the eight library misuse patterns in the real-world smart contract, and the results of the large language model module and the results of the static analysis module are matched according to the weight ratio.

[0105] In one embodiment, a smart contract library misuse detection method based on a large language model and static analysis may also include a process of returning the detection results to the user. The specific process includes: determining the result output format, and parsing and outputting the target library misuse detection results according to the result output format.

[0106] Specifically, the computer device can use a predefined JSON format to parse the final returned result, and obtain the library misuse pattern detection result of the target contract and detailed information of the pattern.

[0107] A smart contract library misuse detection method based on a large language model and static analysis provided in this application can be applied in the development and maintenance phase of smart contracts to help developers understand and maintain potential security issues, thereby achieving safer smart contracts. Through the matching of code parsing and logical reasoning capabilities of a large language model and static analysis, library misuse patterns carried by smart contracts can be detected more accurately. This method based on a large prophecy model and static analysis has strong generalization capabilities and can be applied to smart contract codes of different types or sizes.

[0108] In one embodiment, in order to verify the effectiveness of a smart contract library misuse detection method based on a large language model and static analysis, extensive experiments were conducted using 1018 real-world smart contracts as a data set. This method comes from the smart contract data set on Etherscan and Github. This method randomly selected 183 smart contracts as the test data set according to the distribution ratio of various library misuse patterns in the real world provided in the empirical study.

[0109] This method calculates the accuracy, recall, F1 index, precision and other evaluation indicators of the above test data set to verify the ability of this method to detect misuse of smart contract libraries in the real world. The large language model detection and static analysis detection in this method and the various evaluation indicators of the final results are as follows Figure 6 As shown, Figure 3 Four evaluation indicators representing each module and the final result.

[0110] The results of large language model detection and static analysis detection are weighted and matched. Based on the analysis of 1,018 real-world smart contract source codes, the proportion of contracts with eight library misuse patterns in these contracts is selected as the weight of each library misuse pattern. When the results are inconsistent, the consistency results are given priority, and the decision is optimized based on the weighted evaluation of the two results.

[0111] like Figure 6As shown in the figure, accuracy is an indicator for evaluating the accuracy of model predictions. It is calculated as all correct predictions (true positives TP and true negatives TN) divided by the total number of all predictions, reflecting the model's ability to correctly identify positive and negative examples. Recall is an indicator for evaluating the model's ability to identify all actual positive examples. It is calculated as true positives TP divided by the sum of true positives TP and false negatives FN. The higher the recall, the fewer positive examples the model misses. The F1 index is the harmonic mean of accuracy and recall. It strikes a balance between the two and is an indicator that comprehensively considers accuracy and recall. Precision is the proportion of positive examples predicted by the evaluation model that are actually positive. It is calculated as true positives TP divided by the sum of true positives TP and false positives FP. The higher the accuracy, the more reliable the model's prediction results.

[0112] Despite the inherent challenges of detecting complex patterns, our approach still achieved promising evaluation metrics. Specifically, an accuracy of 68% was achieved, demonstrating the overall effectiveness of the model. The precision of 86% highlights the model's ability to accurately identify true positives, while the F1 score of 68% demonstrates a balance between precision and recall. Although the recall is 57%, it is critical to recognize the trade-offs involved in detecting subtly different patterns in different datasets. These results confirm the potential of our approach and provide a solid foundation for future improvements and real-world applications.

[0113] In summary, the smart contract library misuse pattern detection method based on large language model and static analysis provided by the present invention can more accurately detect library misuse behavior in smart contracts; it can be applied to the development and maintenance stages of smart contracts, thereby realizing safer smart contracts.

[0114] It should be understood that, although the various steps in the above-mentioned flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flow chart may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0115] In one embodiment, Figure 7 As shown, a smart contract library misuse detection system based on a large language model and static analysis is provided, including: an information extraction module 710, a prompt word method construction module 720, a preliminary detection module 730, a model optimization module 740, a static analysis module 750 and a detection module 760, wherein:

[0116] The information extraction module 710 is used to extract library misuse information corresponding to various types of library misuse patterns of smart contracts from the database;

[0117] A prompt word method construction module 720 is used to construct a Pre-generated-Then Selected prompt word method based on the automatic thinking chain Auto-CoT and the zero-shot thinking chain zero-shot-CoT;

[0118] A preliminary detection module 730 is used to perform smart contract detection of a large language model using a prompt word method according to the library misuse information to obtain a preliminary detection result;

[0119] The model optimization module 740 is used to use the preliminary detection result as part of the prompt words in the next large language model smart contract detection, perform result iterative feedback optimization on the large language model, obtain a target large language model, and obtain the first library misuse detection result through the target large language model;

[0120] Static analysis module 750, used to create a static matching BCSSM structure based on code similarity, and obtain a second library misuse detection result through the static matching BCSSM structure;

[0121] The detection module 760 is used to perform weighted matching on the first library misuse detection result and the second library misuse detection result, and output the target library misuse detection result.

[0122] In one embodiment, the information extraction module 710 is also used to find the pattern name, scenario description, and code features of various types of library misuse patterns from the data, and use the pattern name, scenario description, and code features as library misuse information; library misuse patterns include invalid wrappers in the library, unhandled exceptions in the library, abnormal library extensions, abnormal usage, incomplete function replacement, abnormal library capacity estimation, and abnormal library usage.

[0123] In one embodiment, the preliminary detection module 730 is also used to position the role of the large language model and determine the smart contract source code to be detected; perform code understanding and logical reasoning matching on the smart contract source code to be detected based on the library misuse information to obtain a matching result; based on the matching result, determine the recognition ratio of identifying the library misuse pattern in the smart contract source code to be detected as another type of library misuse pattern; obtain a preliminary detection result based on the matching result and the recognition ratio; determine the output format type, and apply the format type to the output of the preliminary detection result.

[0124] In one embodiment, the model optimization module 740 is also used to extract the error rate and false alarm ratio of the detection results from the preliminary detection results; perform information fusion on the extracted error rate and false alarm ratio, and use the fused information as part of the prompt words in the next large language model smart contract detection, perform loop optimization, and obtain an evaluation index of the detection result; if the evaluation index reaches the evaluation threshold, stop the iteration, use the last evaluation result as the output result of the large language model, and obtain the target large language model.

[0125] In one embodiment, the static analysis module 750 is also used to convert the code snippets and input codes of the smart contract into a TF-IDF matrix using the TF-IDF technology through a static matching BCSSM structure; calculate the cosine similarity between the input code and each code snippet according to the TF-IDF matrix to obtain a calculation result; and obtain a second library misuse detection result according to the calculation result.

[0126] In one embodiment, the detection module 760 is also used to compare the first library misuse detection result and the second library misuse detection result to obtain a comparison result; when the comparison result is that the first library misuse detection result and the second library misuse detection result are consistent, the target library misuse detection result is output; when the comparison result is that the first library misuse detection result and the second library misuse detection result are inconsistent, the first library misuse detection result and the second library misuse detection result are weighted.

[0127] In one embodiment, the detection module 760 is further used to determine a result output format, and parse and output the target library misuse detection result according to the result output format.

[0128] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a smart contract library misuse detection method based on a large language model and static analysis is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0129] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of a smart contract library misuse detection method based on a large language model and static analysis are implemented.

[0131] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of a smart contract library misuse detection method based on a large language model and static analysis are implemented.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A smart contract library misuse detection method based on large language model and static analysis, characterized in that: The method comprises: Extract library misuse information corresponding to various library misuse patterns of smart contracts from the database; Based on Auto-CoT and zero-shot-CoT, a Pre-generated-Then Selected prompt word method was constructed; According to the library misuse information, the prompt word method is used to perform smart contract detection of a large language model to obtain preliminary detection results; The preliminary detection result is used as part of the prompt words in the next large language model smart contract detection, the large language model is optimized by iterative feedback of the results to obtain a target large language model, and the first library misuse detection result is obtained by the target large language model; Creating a static matching BCSSM structure based on code similarity, and obtaining a second library misuse detection result through the static matching BCSSM structure; Weighted matching is performed on the first library misuse detection result and the second library misuse detection result, and a target library misuse detection result is output.

2. The method for detecting misuse of smart contract libraries based on large language models and static analysis according to claim 1, characterized in that: Extract library misuse information corresponding to various library misuse patterns of smart contracts from the database, including: Finding pattern names, scenario descriptions, and code features of various types of library misuse patterns from the data, and using the pattern names, scenario descriptions, and code features as library misuse information; The library misuse patterns include invalid wrappers in the library, unhandled exceptions in the library, abnormal library extension, abnormal use, incomplete function replacement, abnormal library capacity estimation, and abnormal library use.

3. The method for detecting misuse of smart contract libraries based on large language models and static analysis according to claim 1, characterized in that: The prompt word method is used to perform smart contract detection on a large language model, and preliminary detection results are obtained, including: Positioning the role of the large language model to determine the smart contract source code to be tested; According to the library misuse information, code understanding and logical reasoning matching are performed on the source code of the smart contract to be detected to obtain a matching result; Based on the matching result, determining a recognition ratio of identifying the library misuse pattern in the smart contract source code to be detected as another type of library misuse pattern; Obtaining a preliminary detection result based on the matching result and the recognition ratio; An output format type is determined, and the format type is applied to the output of the preliminary detection result.

4. The method for detecting misuse of a smart contract library based on a large language model and static analysis according to claim 1, characterized in that: The preliminary detection result is used as part of the prompt words in the next large language model smart contract detection, and the large language model is optimized by iterative feedback of the result to obtain a target large language model, including: Extracting the detection result error rate and false alarm ratio from the preliminary detection results; The extracted error rate and false alarm ratio are subjected to information fusion, and the fused information is used as part of the prompt words in the next large language model smart contract detection, and a cyclic optimization is performed to obtain an evaluation index of the detection result; If the evaluation index reaches the evaluation threshold, the iteration is stopped, and the last evaluation result is used as the output result of the large language model to obtain the target large language model.

5. The method for detecting misuse of smart contract libraries based on large language models and static analysis according to claim 1, characterized in that: Obtaining the second library misuse detection result by the static matching BCSSM structure includes: The code snippet and input code of the smart contract are converted into a TF-IDF matrix using the TF-IDF technology through the static matching BCSSM structure; Calculate the cosine similarity between the input code and each of the code fragments according to the TF-IDF matrix to obtain a calculation result; A second library misuse detection result is obtained according to the calculation result.

6. The method for detecting misuse of smart contract libraries based on large language models and static analysis according to claim 1, characterized in that: Performing weighted matching on the first library misuse detection result and the second library misuse detection result, including: Comparing the first library misuse detection result and the second library misuse detection result to obtain a comparison result; When the comparison result shows that the first library misuse detection result and the second library misuse detection result are consistent, outputting the target library misuse detection result; When the comparison result is that the first library misuse detection result and the second library misuse detection result are inconsistent, the first library misuse detection result and the second library misuse detection result are weighted.

7. The method for detecting misuse of smart contract libraries based on large language models and static analysis according to claim 1, characterized in that: The method further comprises: Determine a result output format, and parse and output the target library misuse detection result according to the result output format.

8. A smart contract library misuse detection system based on large language model and static analysis, characterized in that: The system comprises: The information extraction module is used to extract library misuse information corresponding to various library misuse patterns of smart contracts from the database; A prompt word method construction module is used to construct a Pre-generated-Then Selected prompt word method based on the automatic thinking chain Auto-CoT and the zero-shot thinking chain zero-shot-CoT; A preliminary detection module, used to perform smart contract detection of a large language model using the prompt word method according to the library misuse information to obtain a preliminary detection result; A model optimization module, configured to use the preliminary detection result as part of the prompt words in the next large language model smart contract detection, perform result iterative feedback optimization on the large language model to obtain a target large language model, and obtain the first library misuse detection result through the target large language model; A static analysis module, used for creating a static matching BCSSM structure based on code similarity, and obtaining a second library misuse detection result through the static matching BCSSM structure; The detection module is used to perform weighted matching on the first library misuse detection result and the second library misuse detection result, and output the target library misuse detection result.

9. The smart contract library misuse detection system based on large language model and static analysis according to claim 8, characterized in that: The information extraction module is also used to find the pattern name, scenario description, and code features of various library misuse patterns from the data, and use the pattern name, scenario description, and code features as library misuse information; the library misuse patterns include invalid wrappers in the library, unhandled exceptions in the library, abnormal library extensions, abnormal usage, incomplete function replacement, abnormal library capacity estimation, and abnormal library usage.

10. The smart contract library misuse detection system based on large language model and static analysis according to claim 8, characterized in that: The preliminary detection module is further used to locate the role of the large language model and determine the smart contract source code to be detected; According to the library misuse information, code understanding and logical reasoning matching are performed on the smart contract source code to be detected to obtain a matching result; based on the matching result, an identification ratio of identifying the library misuse pattern in the smart contract source code to be detected as another type of library misuse pattern is determined; a preliminary detection result is obtained according to the matching result and the identification ratio; an output format type is determined, and the format type is applied to the output of the preliminary detection result.

Images