Ethereum Pincare contract detection method and system based on runtime behavior graph

Abstract

The invention discloses an Ethereum Pincare contract detection method and system based on a runtime behavior graph. The method comprises the following steps: firstly, collecting runtime behavior information of a smart contract when the smart contract is executed; constructing a contract runtime behavior graph CRBG according to the runtime behavior information, wherein the CRBG comprises control flow and data flow information of the contract; and finally, carrying out graph classification analysis on the CRBG to identify a potential Pincare contract. By using the runtime behavior graph and the graph neural network model, the Pincare contract can be accurately identified, and the detection precision is obviously higher than that of a traditional method based on rules and static analysis. The method does not depend on a predefined rule in a specific field, and can meet the detection requirements of various novel Pincare contracts. Through a graph optimization technology, large-scale block chain data can be efficiently processed, and the method is suitable for Ethereum main network and test network environments.

Description

Technical Field

[0001] The present invention relates to the field of security detection of blockchain technology and smart contracts, and in particular to a system based on runtime behavior graphs for detecting and identifying Ponzi contracts deployed on the Ethereum blockchain. Background Art

[0002] With the development of blockchain technology, Ethereum, as a representative of the second-generation blockchain technology, has attracted a large number of developers and enterprises with its support for smart contracts. However, due to the decentralized, tamper-proof and automatic execution characteristics of smart contracts, malicious users use smart contracts to implement various fraudulent activities, among which Ponzi schemes are particularly common. Ponzi schemes usually attract investors by promising high returns and use the funds of new investors to pay the returns of early investors. This scam often collapses when no new investors join, causing a large number of investors to suffer losses. On the Ethereum platform, this scam is automated and hidden through smart contracts, making it difficult for traditional detection methods to effectively identify it. Existing Ponzi contract detection methods are mainly based on rules or static analysis. For example, known types of Ponzi contracts are detected by predefined rules, or their behavior is judged by analyzing the bytecode of smart contracts. However, these methods rely on known Ponzi contract patterns and cannot effectively deal with new or variant Ponzi contracts. In addition, detection methods based on static information cannot fully reflect the dynamic behavior of smart contracts, resulting in insufficient accuracy and reliability of detection. Therefore, there is an urgent need for a method and system that can accurately identify Ponzi contracts based on the runtime behavior information of smart contracts to protect the property security of blockchain users. Summary of the invention

[0003] The purpose of the present invention is to provide an Ethereum Ponzi contract detection method and system based on runtime behavior graph, which can effectively detect and identify Ponzi contracts deployed on the Ethereum platform.

[0004] The technical solution adopted by the method of the present invention is: a method for detecting Ethereum Ponzi contracts based on a runtime behavior graph, comprising the following steps:

[0005] Step 1: Collect runtime behavior information of the smart contract when it is executed;

[0006] Step 2: construct a contract runtime behavior graph CRBG according to the runtime behavior information, wherein the CRBG includes the control flow and data flow information of the contract;

[0007] Step 3: Perform graph classification analysis on the CRBG to identify potential Ponzi contracts.

[0008] Preferably, in step 1, the bytecode of the smart contract is received, and a tracking code is inserted into the execution process of the contract through dynamic plugging technology; the tracking code captures each step of the contract operation, including the called function, input parameters, returned value, and state changes within the contract;

[0009] At the same time, a taint engine is designed to perform dynamic taint analysis and collect runtime details of smart contracts when the contract is executed. Dynamic taint analysis is a widely used program analysis technique that uses predefined taints to track program execution and observe runtime data flow and control flow. The taint engine marks the specified instructions, and when these instructions are executed, the taint engine records their operands and related context information, all of which are collected as runtime behavior information.

[0010] Preferably, the specific implementation of step 2 includes the following sub-steps:

[0011] Step 2.1: Node generation; Each node of the CRBG represents an operation in the contract execution, and the attributes of the node include the operation code, the contract status at the time of execution, and the related operands;

[0012] Step 2.2: Control flow edge generation; the control flow edge in the CRBG represents the execution order of the contract operations; for adjacently executed operations, a control flow edge is added between their corresponding nodes;

[0013] Step 2.3: Generate data flow edges; data flow edges are used to represent the flow path of data in the contract;

[0014] Step 2.4: Graph optimization; optimize the generated CRBG, including removing redundant nodes and edges, merging nodes with similar behavior patterns, and simplifying the graph structure; the final CRBG is a directed graph containing control flow and data flow information.

[0015] Preferably, in step 3, a graph neural network is used for classification based on the behavior graph of the contract during runtime, and the classification results of Ponzi contracts and non-Ponzi contracts are output;

[0016] The graph neural network includes a graph input, a graph embedding learning module and a classifier;

[0017] The graph input module converts the constructed contract runtime behavior graph into a feature matrix; the contract runtime behavior graph includes a node set and an edge set, and the number of nodes n and the number of edges m depend on the runtime behavior of the contract;

[0018] The graph embedding learning module is used to generate a global feature representation of the graph, and is composed of a graph attention network, a linear rectifier unit, a graph attention network, and an average pooling layer connected in sequence; the graph attention network calculates the weights between nodes and edges through a learnable weight matrix based on a self-attention mechanism, so as to weight and aggregate each node according to the features of its surrounding nodes; the linear rectifier unit, as an activation function, linearly transforms the combination of feature vectors of two different nodes to obtain an attention score between the two nodes; the average pooling layer uses mean pooling to aggregate node features and obtain a global feature representation of the graph;

[0019] The classifier includes a random dropout module and a fully connected layer; the random dropout module randomly sets a part of the output of the graph embedding learning module to zero to prevent overfitting and improve the generalization ability of the model; the fully connected layer is used to learn the nonlinear combination of features in the input data; the global feature representation is input into the classifier, and the predicted classification label of the graph is obtained.

[0020] Preferably, the graph neural network is a trained network; during training, the cross entropy loss function is used to calculate the cross entropy loss between the category probability distribution predicted by the model forward propagation and the true label. Finally, the gradient of the loss function relative to the model parameters is calculated by the back-propagation chain rule, and the parameters are updated in the opposite direction of the gradient, that is, the gradient descent method, so that the value of the loss function gradually decreases.

[0021] Preferably, the specific implementation of step 3 includes the following sub-steps:

[0022] Step 3.1: Continue preprocessing the CRBG, including standardizing node attributes, converting edge weights, and batch processing the CRBG;

[0023] Step 3.2: The graph neural network first embeds each node and represents the node's features as a vector of fixed length; the vector is passed through the two graph attention network layers of the graph neural network, and a linear rectifier unit is used in the middle to perform a nonlinear transformation on the node features in order to handle the nonlinear relationship of the data and increase the performance of the network; finally, mean pooling is used to aggregate the node features and obtain the global feature representation of the graph; then the random dropout module randomly sets part of the features output by the graph embedding learning module to zero to prevent overfitting and improve the generalization ability of the model;

[0024] Step 3.3: The CRBG processed by the graph neural network is input into the classification layer. The fully connected layer learns the nonlinear combination of features in the input data, classifies the graph, and outputs the prediction result of whether the contract corresponding to the graph is a Ponzi contract.

[0025] The present invention also provides an Ethereum Ponzi contract detection system based on a runtime behavior graph, comprising:

[0026] one or more processors;

[0027] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum Ponzi contract detection method based on the runtime behavior graph.

[0028] The present invention also provides an Ethereum Ponzi contract detection product based on a runtime behavior graph, including computer program instructions. When the computer program instructions are executed on a computer, the computer executes the Ethereum Ponzi contract detection method based on a runtime behavior graph.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] (1) High-precision identification: By using runtime behavior graphs and graph neural network models, the present invention can accurately identify Ponzi contracts, and the detection accuracy is significantly higher than traditional rule-based and static analysis methods.

[0031] (2) Wide adaptability: The present invention does not rely on predefined rules in a specific field and can adapt to the detection needs of various new Ponzi contracts.

[0032] (3) Efficient processing: Through graph optimization technology, the present invention can efficiently process large-scale blockchain data and is suitable for the Ethereum mainnet and testnet environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The technical solution of the present invention is further described below using embodiments and specific implementation methods. In addition, in the process of describing the technical solution, some drawings are also used. For those skilled in the art, other drawings and the intention of the present invention can also be obtained based on these drawings without paying creative work.

[0034] Figure 1 It is a method principle diagram of an embodiment of the present invention.

[0035] Figure 2 It is a schematic diagram of a contract runtime behavior graph (CRBG) according to an embodiment of the present invention, showing how control flow and data flow edges are generated.

[0036] Figure 3 It is a workflow diagram of the graph neural network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to facilitate ordinary technicians in the field to understand and implement the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0038] Please see Figure 1 , this embodiment provides an Ethereum Ponzi contract detection method based on a runtime behavior graph, comprising the following steps:

[0039] Step 1: Collect runtime behavior information of the smart contract when it is executed;

[0040] In one embodiment, the execution of smart contracts is monitored through dynamic taint analysis technology. First, the bytecode of the smart contract is received, and tracking code is inserted into the execution process of the contract through dynamic stubbing technology. These tracking codes can capture every step of the contract, including the called functions, input parameters, returned values, and state changes within the contract.

[0041] When the contract is executed, the dynamic taint engine marks key opcodes, such as CALL, DELEGATECALL, CALLCODE, TRANSFER and other instructions involving fund flow, as well as JUMPI instructions for control flow. When these instructions are executed, the dynamic taint engine records their operands and related context information (such as caller address, target address, amount of ETH transferred, etc.). All this information is collected as runtime behavior information and stored in a temporary data structure for further processing.

[0042] In this way, all key behaviors of the contract can be captured and complete runtime behavior information can be generated, providing basic data for subsequent behavior graph construction.

[0043] Step 2: construct a contract runtime behavior graph CRBG according to the runtime behavior information, wherein the CRBG includes the control flow and data flow information of the contract;

[0044] Please see Figure 2 In one implementation, the specific implementation of step 2 includes the following sub-steps:

[0045] Step 2.1: Node generation; Each node of the CRBG represents an operation in the contract execution, for example, a node can represent an ETH transfer operation or a function call. The properties of the node include the operation code, the contract status at the time of execution, and the related operands, etc.;

[0046] Step 2.2: Control flow edge generation; The control flow edges in the CRBG represent the execution order of contract operations; for adjacent operations, a control flow edge is added between their corresponding nodes; for example, if a function is called immediately after a transfer operation, there will be a control flow edge between the nodes of the two operations.

[0047] Step 2.3: Data flow edge generation; Data flow edges are used to represent the flow path of data in the contract; for example, if the output data of an operation is used by a subsequent operation, a data flow edge is added between the nodes corresponding to the two operations. Through the data flow information obtained by dynamic taint analysis, the behavior graph construction module can accurately draw the flow path of ETH, function parameters, return values, etc. in the contract.

[0048] Step 2.4: Graph optimization: To improve the analysis efficiency, the behavior graph construction module optimizes the generated CRBG. For example, it removes redundant nodes and edges, merges nodes with similar behavior patterns, and simplifies the graph structure. The final CRBG is a directed graph containing control flow and data flow information, which can fully characterize the runtime behavior of the contract.

[0049] Step 3: Perform graph classification analysis on the CRBG to identify potential Ponzi contracts.

[0050] Please see Figure 3 In one embodiment, a graph neural network is used to perform classification based on the behavior graph of the contract at runtime, and the classification results of Ponzi contracts and non-Ponzi contracts are output;

[0051] The graph neural network includes a graph input, a graph embedding learning module and a classifier;

[0052] The graph input module converts the constructed contract runtime behavior graph into a feature matrix. The contract runtime behavior graph contains a set of nodes and a set of edges, and the number of nodes n and the number of edges m depend on the runtime behavior of the contract. The dimension of the node feature vector is 102, and the dimension of the resulting node feature matrix is ​​(n, 102). The dimension of the edge index matrix is ​​(2, m), and the two-dimensional column vector represents the index of the two nodes connected by the edge. The dimension of the edge feature vector is 15, and the dimension of the resulting edge feature matrix is ​​(m, 15).

[0053] The graph embedding learning module is used to generate a global feature representation of the graph, and is composed of a sequentially connected graph attention network, a linear rectifier unit, a graph attention network, and an average pooling layer; the graph attention network, as a component of the convolutional layer of the graph neural network, calculates the weights between nodes and edges through a learnable weight matrix based on the self-attention mechanism, so as to weight and aggregate each node according to the features of its surrounding nodes. The linear rectifier unit is used as an activation function, which linearly transforms the combination of feature vectors of two different nodes to obtain the attention score between the two nodes. The graph embedding learning module sets two graph attention network layers, and uses a linear rectifier unit in the middle to perform nonlinear transformation on node features, so as to process the nonlinear relationship of the data and increase the performance of the network. Finally, average pooling is used to aggregate node features and obtain a global feature representation of the graph.

[0054] The classifier contains a random dropout module and a fully connected layer. The random dropout module randomly sets a small part of the output of the graph embedding learning module to zero to prevent overfitting and improve the generalization ability of the model. The fully connected layer is used to learn nonlinear combinations of features in the input data. The global feature representation is input into the classifier and the predicted classification label of the graph is obtained.

[0055] In one embodiment, the graph neural network is a trained network; during training, the cross entropy loss function is used to calculate the cross entropy loss between the category probability distribution predicted by the model forward propagation and the true label. Finally, the gradient of the loss function relative to the model parameters is calculated by the back-propagation chain rule, and the parameters are updated in the opposite direction of the gradient, that is, the gradient descent method, so that the value of the loss function gradually decreases. The goal of the model is to minimize the error in the classification of Ponzi contracts and non-Ponzi contracts, thereby improving the classification accuracy.

[0056] In one implementation, the specific implementation of step 3 includes the following sub-steps:

[0057] Step 3.1: Continue preprocessing the CRBG, including standardizing node attributes, converting edge weights, and batch processing the CRBG for input into the graph neural network;

[0058] Step 3.2: The graph neural network first embeds each node and represents the node's features as a vector of fixed length; the vector is passed through the two graph attention network layers of the graph neural network, and a linear rectifier unit is used in the middle to perform a nonlinear transformation on the node features in order to handle the nonlinear relationship of the data and increase the performance of the network. Finally, mean pooling is used to aggregate the node features and obtain the global feature representation of the graph. The random dropout module then randomly sets a small part of the features output by the graph embedding learning module to zero to prevent overfitting and improve the generalization ability of the model. The fully connected layer is used to learn the nonlinear combination of features in the input data. The global feature representation is input into the classifier and the predicted classification label of the graph is obtained;

[0059] The graph attention layer can dynamically calculate the weight between each node and its neighboring nodes through the self-attention mechanism, and perform weighted summation of the node features accordingly, thereby capturing the importance of the node in the graph structure.

[0060] Step 3.3: The CRBG processed by the graph neural network is input into the classification layer, and the graph is classified by the fully connected neural network layer, and the prediction result of whether the contract corresponding to the graph is a Ponzi contract is output.

[0061] In one embodiment, an automatic update module is included to periodically update the model in the graph neural network analysis module (graph attention layer) to adapt to the detection needs of new Ponzi contracts.

[0062] In one embodiment, the trained graph neural network model can classify any input CRBG and output a prediction result, which will be passed to the early warning module for processing.

[0063] In one embodiment, the graph neural network of the present invention also includes a graph optimization unit for simplifying and optimizing the CRBG to improve the processing efficiency of the system.

[0064] This embodiment also provides an Ethereum Ponzi contract detection system based on a runtime behavior graph, including:

[0065] one or more processors;

[0066] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the Ethereum Ponzi contract detection method based on the runtime behavior graph.

[0067] This embodiment also provides an Ethereum Ponzi contract detection product based on a runtime behavior graph, including computer program instructions. When the computer program instructions are executed on a computer, the computer executes the Ethereum Ponzi contract detection method based on a runtime behavior graph.

[0068] The present invention is further described below through specific experiments.

[0069] The experimental environment consists of a server with a 16-core Intel(R) Xeon(R) Gold5218 CPU@2.30GHz, 340GB RAM, and Ubuntu 18.04LTS operating system.

[0070] The present invention experiments on the effectiveness of identifying Ponzi contracts. The dataset obtained by crawling Etherscan and manually cross-checking contains 6,498 smart contracts, of which 314 are identified as Ponzi schemes. The experiment evaluates the precision, recall and F1 score of the present invention and compares them with existing methods. The experimental results are as follows:

[0071] method Accuracy Recall F1 score OpML 89.0％ 77.8％ 83.0％ TxML 69.6％ 63.4％ 66.4％ SADPonzi 88.1％ 64.5％ 74.5％ MulCas 95.1％ 67.4％ 78.9％ SourceP 91.6％ 93.3％ 92.4％ PonziGuard (the present invention) 96.9％ 98.2％ 97.5％

[0072] The graph neural network analysis module (graph attention layer) of the present invention learns the typical behavior patterns of Ponzi contracts by training the runtime behavior graphs of multiple Ponzi contracts to improve detection accuracy.

[0073] The present invention can be applied to the main network and test network environment of the Ethereum blockchain, and can process smart contracts of different versions.

[0074] It should be understood that the embodiments described above are part of the embodiments of the present invention, rather than all of the embodiments. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. Such combination is not restricted by the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0075] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A method for detecting Ethereum Ponzi contracts based on runtime behavior graphs, characterized in that: The following steps are involved: Step 1: Collect runtime behavior information of the smart contract when it is executed; Step 2: construct a contract runtime behavior graph CRBG according to the runtime behavior information, wherein the CRBG includes the control flow and data flow information of the contract; Step 3: Perform graph classification analysis on the CRBG to identify potential Ponzi contracts.

2. The Ethereum Ponzi contract detection method based on runtime behavior graph according to claim 1 is characterized in that: In step 1, the bytecode of the smart contract is received, and the tracking code is inserted into the execution process of the contract through dynamic stubbing technology; the tracking code captures every step of the contract operation, including the called function, input parameters, returned value, and state changes within the contract; At the same time, when the contract is executed, the taint engine is used to perform dynamic taint analysis and collect runtime detailed information of the smart contract; the taint engine marks the specified instructions, and when these instructions are executed, the taint engine records their operands and related context information, all of which are collected as runtime behavior information.

3. The Ethereum Ponzi contract detection method based on runtime behavior graph according to claim 1 is characterized in that: The specific implementation of step 2 includes the following sub-steps: Step 2.1: Node generation; Each node of the CRBG represents an operation in the contract execution, and the attributes of the node include the operation code, the contract status at the time of execution, and the related operands; Step 2.2: Control flow edge generation; the control flow edge in the CRBG represents the execution order of the contract operations; for adjacently executed operations, a control flow edge is added between their corresponding nodes; Step 2.3: Data flow edge generation; Data flow edges are used to represent the flow path of data in a contract; Step 2.4: Graph optimization; optimize the generated CRBG, including removing redundant nodes and edges, merging nodes with similar behavior patterns, and simplifying the graph structure; the final CRBG is a directed graph containing control flow and data flow information.

4. The Ethereum Ponzi contract detection method based on runtime behavior graph according to claim 1 is characterized in that: In step 3, a graph neural network is used to classify the contract based on the behavior graph during its runtime, and the classification results of Ponzi contracts and non-Ponzi contracts are output; The graph neural network includes a graph input module, a graph embedding learning module and a classifier; The graph input module converts the constructed contract runtime behavior graph into a feature matrix; the contract runtime behavior graph includes a node set and an edge set; The graph embedding learning module is used to generate a global feature representation of the graph, and is composed of a graph attention network, a linear rectifier unit, a graph attention network, and an average pooling layer connected in sequence; the graph attention network calculates the weights between nodes and edges through a learnable weight matrix based on a self-attention mechanism, so as to weight and aggregate each node according to the features of its surrounding nodes; the linear rectifier unit, as an activation function, linearly transforms the combination of feature vectors of two different nodes to obtain an attention score between the two nodes; the average pooling layer uses mean pooling to aggregate node features and obtain a global feature representation of the graph; The classifier includes a random dropout module and a fully connected layer; the random dropout module randomly sets a part of the output of the graph embedding learning module to zero to prevent overfitting and improve the generalization ability of the model; the fully connected layer is used to learn the nonlinear combination of features in the input data; the global feature representation is input into the classifier, and the predicted classification label of the graph is obtained.

5. The Ethereum Ponzi contract detection method based on runtime behavior graph according to claim 4 is characterized in that: The graph neural network is a trained network; During training, the cross entropy loss function is used to calculate the cross entropy loss between the category probability distribution predicted by the model forward propagation and the true label; finally, the gradient of the loss function relative to the model parameters is calculated through the back-propagation chain rule, and the parameters are updated in the opposite direction of the gradient, that is, the gradient descent method, so that the value of the loss function gradually decreases.

6. The Ethereum Ponzi contract detection method based on runtime behavior graph according to any one of claims 1 to 5, characterized in that: The specific implementation of step 3 includes the following sub-steps: Step 3.1: Continue preprocessing the CRBG, including standardizing node attributes, converting edge weights, and batch processing the CRBG; Step 3.2: The graph neural network first embeds each node and represents the node’s features as a vector of fixed length. The vector is passed through the two graph attention network layers of the graph neural network, and a linear rectifier unit is used in the middle to perform a nonlinear transformation on the node features in order to handle the nonlinear relationship of the data and increase the performance of the network. Finally, mean pooling is used to aggregate the node features and obtain the global feature representation of the graph. The random dropout module then randomly sets a portion of the features output by the graph embedding learning module to zero to prevent overfitting and improve the generalization ability of the model; Step 3.3: The CRBG processed by the graph neural network is input into the classification layer. The fully connected layer learns the nonlinear combination of features in the input data, classifies the graph, and outputs the prediction result of whether the contract corresponding to the graph is a Ponzi contract.

7. An Ethereum Ponzi contract detection system based on runtime behavior graph, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the Ethereum Ponzi contract detection method based on a runtime behavior graph as described in any one of claims 1 to 6.

8. An Ethereum Ponzi contract detection product based on a runtime behavior graph, comprising computer program instructions, characterized in that: When the computer program instructions are executed on a computer, the computer is caused to execute the Ethereum Ponzi contract detection method based on a runtime behavior graph as described in any one of claims 1 to 6.

Images