Cross-chain contract vulnerability detection method and device

Abstract

The invention discloses a cross-chain contract vulnerability detection method and a cross-chain contract vulnerability detection device, which are used for solving the technical problem that the risk of economic loss is increased due to the existing cross-chain contract vulnerability detection method. The method comprises the following steps: acquiring a plurality of to-be-detected cross-chain contracts, and based on a preset expert mode, outputting an expert mode vector according to each to-be-detected cross-chain contract by adopting a preset full-connection network and a program analysis technology; constructing a cross-chain control flow diagram and a cross-chain data flow diagram corresponding to each to-be-detected cross-chain contract according to the contract byte code, the event log and the contract source code corresponding to each to-be-detected cross-chain contract; and adopting a preset cross-chain contract vulnerability detection model to detect each to-be-detected cross-chain contract according to the expert mode vector and the cross-chain control flow diagram and the cross-chain data flow diagram corresponding to each to-be-detected cross-chain contract, and outputting a vulnerability detection result corresponding to each to-be-detected cross-chain contract.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a cross-chain contract vulnerability detection method and device. Background Art

[0002] At present, various blockchain projects are heterogeneous blockchains developed based on different actual application scenarios and design concepts, using different technical frameworks, which makes a large number of blockchain projects become isolated value systems. The transaction processing capacity and scalability of blockchain technology have always limited the large-scale application of blockchain.

[0003] With the in-depth application of blockchain technology, the demand for integration between different scenarios is increasing, and the demand for cross-chain value circulation and application collaboration is becoming increasingly apparent. In order to achieve the organic integration of blockchain projects in different industries, achieve interconnection between blockchains, and then realize the purpose of inter-chain transfer of business and value, blockchain has a practical and urgent need for cross-chain interaction technology.

[0004] However, due to the complexity of cross-chain technology and the lack of standardization, and the fact that contracts cannot be changed after deployment, there have been many cases of hackers exploiting cross-chain contract vulnerabilities to carry out criminal activities. According to data analysis company ChainAnalysis, cross-chain bridge hacks accounted for 69% of all stolen cryptocurrency funds in 2022, posing a serious threat to the security of the blockchain ecosystem. Therefore, the urgency of identifying cross-chain contract vulnerabilities has become increasingly prominent.

[0005] Most existing cross-chain contract vulnerability detection methods focus only on vulnerability detection of smart contracts on a single blockchain. This process is highly dependent on the collected on-chain transaction statistics and cannot detect vulnerabilities in the code before the contract is deployed, resulting in an increased risk of economic loss. Summary of the invention

[0006] The present invention provides a cross-chain contract vulnerability detection method and device, which are used to solve the technical problem that the existing cross-chain contract vulnerability detection method leads to an increased risk of economic loss.

[0007] A first aspect of the present invention provides a cross-chain contract vulnerability detection method, comprising:

[0008] Obtain multiple cross-chain contracts to be detected, and based on a preset expert mode, use a preset fully connected network and program analysis technology to output an expert mode vector according to each of the cross-chain contracts to be detected;

[0009] According to the contract bytecode, event log and contract source code corresponding to each of the cross-chain contracts to be detected, a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected are constructed;

[0010] A preset cross-chain contract vulnerability detection model is used to detect each of the cross-chain contracts to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected, and the vulnerability detection results corresponding to each of the cross-chain contracts to be detected are output.

[0011] Optionally, based on the preset expert mode, the preset fully connected network and program analysis technology are used to output the expert mode vector according to each cross-chain contract to be detected, including:

[0012] Based on the preset expert mode, program analysis technology is used to judge the vulnerabilities of each cross-chain contract to be detected, and the cross-chain vulnerability mode corresponding to each cross-chain contract to be detected is output;

[0013] Performing one-hot encoding on the cross-chain vulnerability patterns corresponding to each of the cross-chain contracts to be detected, respectively, to generate encoding data corresponding to each of the cross-chain contracts to be detected;

[0014] The encoded data corresponding to each of the cross-chain contracts to be detected is used as the input of the preset fully connected network, and an expert mode vector is output.

[0015] Optionally, constructing a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected according to the contract bytecode, event log and contract source code corresponding to each of the cross-chain contracts to be detected includes:

[0016] Based on the contract bytecode corresponding to each of the cross-chain contracts to be detected, determine a plurality of control flow graph nodes corresponding to each of the cross-chain contracts to be detected;

[0017] Generate multiple control flow graph edges corresponding to each of the cross-chain contracts to be detected according to the contract bytecode and event log corresponding to each of the cross-chain contracts to be detected;

[0018] Using a plurality of control flow graph nodes and a plurality of control flow graph edges corresponding to each of the cross-chain contracts to be detected, a cross-chain control flow graph corresponding to each of the cross-chain contracts to be detected is constructed;

[0019] Based on the contract source code corresponding to each of the cross-chain contracts to be detected, determine a plurality of data flow graph nodes and a plurality of data flow graph edges corresponding to each of the cross-chain contracts to be detected;

[0020] A cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected is constructed using multiple data flow graph nodes and multiple data flow graph edges corresponding to each of the cross-chain contracts to be detected.

[0021] Optionally, the preset cross-chain contract vulnerability detection model includes a pre-trained language network, a graph neural network, a bimodal teacher network, and a unimodal student network; the preset cross-chain contract vulnerability detection model is used to detect each of the cross-chain contracts to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected, and the vulnerability detection results corresponding to each of the cross-chain contracts to be detected are output, including:

[0022] Normalize the cross-chain data flow graphs corresponding to each of the cross-chain contracts to be detected, and output the normalized cross-chain data flow graphs corresponding to each of the cross-chain contracts to be detected;

[0023] Input the normalized cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected into the graph neural network, and output the cross-chain data flow graph vector corresponding to each of the cross-chain contracts to be detected;

[0024] Using the graph neural network and the pre-trained language network to generate a cross-chain control flow graph vector corresponding to each of the cross-chain contracts to be detected according to the cross-chain control flow graph corresponding to each of the cross-chain contracts to be detected;

[0025] Perform feature splicing on the expert mode vector and the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and output the splicing vector corresponding to each cross-chain contract to be detected;

[0026] A bimodal teacher network is used to generate bytecode embedding corresponding to each of the cross-chain contracts to be detected according to the splicing vectors and cross-chain data flow graph vectors corresponding to each of the cross-chain contracts to be detected;

[0027] Through the single-modal student network, cross-chain contract vulnerability detection is performed on each of the cross-chain contracts to be detected according to the bytecode embedding and splicing vectors corresponding to each of the cross-chain contracts to be detected, and the vulnerability detection results corresponding to each of the cross-chain contracts to be detected are output.

[0028] Optionally, the bimodal teacher network includes a convolution module, an average pooling layer, a fully connected layer and an activation function layer; the bimodal teacher network is used to generate the bytecode embedding corresponding to each of the cross-chain contracts to be detected according to the splicing vectors and cross-chain data flow graph vectors corresponding to each of the cross-chain contracts to be detected, including:

[0029] Perform convolution operation on the splicing vector and the cross-chain data flow graph vector corresponding to each of the cross-chain contracts to be detected through the convolution module, and output the cross-chain data flow graph convolution feature and the first splicing convolution feature corresponding to each of the cross-chain contracts to be detected;

[0030] The average pooling layer is used to average pool the cross-chain data flow graph convolution features and the first splicing convolution features corresponding to each of the cross-chain contracts to be detected, so as to generate the cross-chain data flow graph average pooling features and the first splicing average pooling features corresponding to each of the cross-chain contracts to be detected;

[0031] The average pooling features of the cross-chain data flow graphs corresponding to the cross-chain contracts to be detected and the first spliced ​​average pooling features are respectively spliced, and the spliced ​​features corresponding to the cross-chain contracts to be detected are output;

[0032] The concatenated features corresponding to each of the cross-chain contracts to be detected are respectively used as the input of the fully connected layer, and the fully connected features corresponding to each of the cross-chain contracts to be detected are output;

[0033] An activation function layer is used to perform nonlinear mapping on the fully connected features corresponding to each of the cross-chain contracts to be detected, and a bytecode embedding corresponding to each of the cross-chain contracts to be detected is generated.

[0034] Optionally, the unimodal student network includes a convolution module, an average pooling layer, a fully connected layer and an activation function layer; the unimodal student network performs cross-chain contract vulnerability detection on each of the cross-chain contracts to be detected according to the bytecode embedding and splicing vectors corresponding to each of the cross-chain contracts to be detected, and outputs the vulnerability detection results corresponding to each of the cross-chain contracts to be detected, including:

[0035] Perform convolution operation on the splicing vectors corresponding to each of the cross-chain contracts to be detected through the convolution module, and output the second splicing convolution features corresponding to each of the cross-chain contracts to be detected;

[0036] An average pooling layer is used to average pool the second concatenated convolutional features corresponding to each of the cross-chain contracts to be detected, so as to generate second concatenated average pooling features corresponding to each of the cross-chain contracts to be detected;

[0037] Reconstructing the source code information of the bytecode embedding corresponding to each of the cross-chain contracts to be detected, and generating a reconstruction vector corresponding to each of the cross-chain contracts to be detected;

[0038] Respectively perform feature splicing on the reconstruction vector corresponding to each of the cross-chain contracts to be detected and the second splicing average pooling feature, and output the reconstructed splicing vector corresponding to each of the cross-chain contracts to be detected;

[0039] The reconstructed splicing vectors corresponding to the cross-chain contracts to be detected are respectively used as the input of the fully connected layer, and the fully connected vectors corresponding to the cross-chain contracts to be detected are output;

[0040] The activation function layer is used to perform nonlinear mapping on the fully connected vectors corresponding to each cross-chain contract to be detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output.

[0041] A second aspect of the present invention provides a cross-chain contract vulnerability detection device, comprising:

[0042] An acquisition module is used to acquire multiple cross-chain contracts to be detected, and based on a preset expert mode, a preset fully connected network and program analysis technology are used to output an expert mode vector according to each of the cross-chain contracts to be detected;

[0043] A construction module, used to construct a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected according to the contract bytecode, event log and contract source code corresponding to each of the cross-chain contracts to be detected;

[0044] The detection module is used to use a preset cross-chain contract vulnerability detection model to detect each of the cross-chain contracts to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected, and output the vulnerability detection results corresponding to each of the cross-chain contracts to be detected.

[0045] A third aspect of the present invention provides a computer device, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor executes the steps of the cross-chain contract vulnerability detection method as described in any one of the above items.

[0046] A fourth aspect of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed, the steps of the cross-chain contract vulnerability detection method as described in any one of the above items are implemented.

[0047] A fifth aspect of the present invention provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, wherein when the program instructions are executed by a computer, the computer executes the steps of the cross-chain contract vulnerability detection method as described in any one of the above items.

[0048] It can be seen from the above technical solutions that the present invention has the following advantages:

[0049] The above technical solution of the present invention provides a cross-chain contract vulnerability detection method, which first obtains multiple cross-chain contracts to be detected, and based on a preset expert mode, uses a preset fully connected network and program analysis technology to output an expert mode vector according to each cross-chain contract to be detected; then, according to the contract bytecode, event log and contract source code corresponding to each cross-chain contract to be detected, a cross-chain control flow graph and a cross-chain data flow graph corresponding to each cross-chain contract to be detected are constructed; finally, a preset cross-chain contract vulnerability detection model is used to detect each cross-chain contract according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected. The cross-chain contracts to be detected are detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output; based on the above scheme, based on the preset expert mode, the preset fully connected network and program analysis technology are used according to each cross-chain contract to be detected, and the expert mode vector is output, and combined with the preset cross-chain contract vulnerability detection model, the constructed cross-chain control flow graph, cross-chain data flow graph and expert mode vector are processed to output the vulnerability detection results. The present invention combines the control flow, data flow and semantics of the cross-chain contract and other multi-level information, which can automatically identify cross-chain vulnerabilities before the contract is deployed, thereby reducing the risk of economic losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0051] Figure 1 A flowchart of a cross-chain contract vulnerability detection method provided in Example 1 of the present invention;

[0052] Figure 2 This is a detection framework diagram of the cross-chain contract vulnerability detection method provided in Example 1 of the present invention;

[0053] Figure 3 A diagram of the cross-chain interaction architecture provided in the first embodiment of the present invention;

[0054] Figure 4 A standardized flow chart of the cross-chain data flow graph provided in Example 1 of the present invention;

[0055] Figure 5 This is a structural block diagram of a cross-chain contract vulnerability detection device provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0056] The embodiments of the present invention provide a cross-chain contract vulnerability detection method and device, which are used to solve the technical problem that the existing cross-chain contract vulnerability detection method leads to an increased risk of economic loss.

[0057] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] Terminology explanation:

[0059] Graph Neural Network: Graph Neural Network (GNN) is a neural network specifically designed to process graph structured data. The basic idea of ​​​​graph neural network is to update the representation of the node by aggregating the information of neighboring nodes. It models and analyzes graph data by learning the information transmission and conversion rules between nodes, thereby processing graph data with complex topological structures, such as social networks, bioinformatics networks, and knowledge graphs.

[0060] Blockchain: Blockchain is a decentralized distributed ledger that is tamper-proof, secure and reliable. It combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography and other technologies to record transactions and information through a growing data block chain to ensure data security and transparency.

[0061] Smart contract: A smart contract is a piece of code stored on the blockchain that defines all the information about the contract terms agreed to by all parties using the contract. After entering the code that meets the requirements, the smart contract will automatically execute all the corresponding preset codes and output the corresponding expected results. The blockchain provides distributed and reliable storage, while the smart contract provides distributed and reliable computing.

[0062] Cross-chain technology: Cross-chain technology refers to the use of certain specific technical means to enable value to directly interact across the barriers between chains, thereby realizing the circulation of assets and value transfer between different blockchains. Cross-chain technology is equivalent to a trusted third-party exchange, through which different users can conduct cross-chain transactions, and the total value on any blockchain will not be changed during the cross-chain process, but only the value exchange between users of different blockchains is completed. This not only realizes the transmission of information, but also realizes the flow of value between different blockchains under the premise of ensuring the conservation of value.

[0063] Vulnerability detection: Vulnerability detection technology refers to the technology that analyzes and detects all pre-components and internal structures of existing software, networks, and systems to identify, locate, and repair various known and unknown vulnerabilities. A vulnerability refers to a defect in a system that poses a security risk due to missing or incomplete software functions or programming, or improper hardware configuration. Attackers can exploit this vulnerability to launch attacks and endanger its security.

[0064] See also Figure 1 , Figure 1 A flowchart of the steps of a cross-chain contract vulnerability detection method provided by an embodiment of the present invention.

[0065] The present invention provides a cross-chain contract vulnerability detection method, comprising:

[0066] Step 101: Obtain multiple cross-chain contracts to be tested, and based on a preset expert mode, use a preset fully connected network and program analysis technology to output an expert mode vector according to each cross-chain contract to be tested.

[0067] Please note that Figure 2 The detection framework of cross-chain contract vulnerability detection proposed in this invention includes four stages, namely, expert mode extraction, cross-chain control flow graph construction, cross-chain data flow graph construction, and cross-modal mutual learning. Figure 2 As shown. Expert pattern extraction refers to judging whether there is a cross-chain vulnerability pattern in the contract through keyword matching, syntax analysis, taint analysis technology, etc., and embedding the extracted expert pattern into a vector, and then learning the expert pattern vector through a fully connected network; cross-chain control flow graph construction refers to defining the node type and edge type of the cross-chain control flow graph based on the instruction information of the contract bytecode, and inputting the Transformer-based bidirectional encoding (BERT) model to obtain the node semantics in the graph, and then learning the graph vector through the graph sampling and aggregation (GraphSAGE) network; cross-chain data flow graph construction refers to defining the node type and edge type of the cross-chain data flow graph based on the control flow and data flow information of the contract source code, and after the graph is normalized, it is input into the GraphSAGE network (graph neural network) to pool and aggregate the features of each node to obtain a graph representation; finally, the teacher-student model (i.e., bimodal teacher network, unimodal student network) is used for cross-modal mutual learning, so that the missing source code information can be inferred in the case of only bytecode, thereby improving the detection capability of cross-chain vulnerabilities.

[0068] Furthermore, based on the preset expert mode, the process of outputting the expert mode vector according to each cross-chain contract to be detected by using the preset fully connected network and program analysis technology can be achieved by executing the following sub-steps S11 to S13:

[0069] Step S11: Based on the preset expert mode, program analysis technology is used to judge the vulnerabilities of each cross-chain contract to be detected, and the cross-chain vulnerability mode corresponding to each cross-chain contract to be detected is output;

[0070] Program analysis techniques include keyword matching, syntax analysis, and taint analysis techniques.

[0071] Please note that Figure 3 ,The cross-chain interaction consists of three parts: asset deposit and locking on the source chain, cross-chain communication of off-chain relayers, and asset authorization and withdrawal on the destination chain, e.g. Figure 3 Each part involves different cross-chain vulnerabilities, and security review is performed by defining a series of corresponding expert modes, namely, preset expert modes, which are as follows:

[0072] The asset deposit and lock on the source chain is divided into two parts: 1) Check whether the deposit operation is successful: compare the deposit amount, balance and threshold, such as checking the cross-chain bridge balance after the deposit, the deposit user balance, and the liquidity of the cross-chain bridge. 2) Check whether the deposit operation is legal: compare the logical conditions of the deposit, such as checking the declaration of the call function and user information.

[0073] There are two parts for cross-chain communication of off-chain relays: 1) Check the tokens and chains supported by the cross-chain bridge: compare the ID values ​​of the exchange tokens, the original chain and the destination chain. 2) Check the address of the external call: compare whether the address of the external call is the zero address.

[0074] The authorization and withdrawal of assets on the destination chain are divided into three parts: 1) Check whether the asset authorization is legal: compare the cross-chain interaction information and the on-chain time status, such as checking the signature, signer information and signature timestamp. 2) Check whether there are repeated withdrawal operations: find out whether the mapping variables in the list have repeated withdrawal records. 3) Check whether the withdrawal operation is legal: compare whether the withdrawal user is a specific user address or a zero address.

[0075] Furthermore, after defining the corresponding expert mode, that is, completing the setting of the preset expert mode, it is determined whether there is a cross-chain vulnerability mode in each cross-chain contract (cross-chain contract to be detected) through keyword matching, syntax analysis, taint analysis technology, etc., so as to obtain the cross-chain vulnerability mode corresponding to each cross-chain contract.

[0076] Step S12: Perform one-hot encoding on the cross-chain vulnerability patterns corresponding to each cross-chain contract to be detected, and generate encoding data corresponding to each cross-chain contract to be detected;

[0077] Step S13: Use the encoded data corresponding to each cross-chain contract to be detected as the input of the preset fully connected network, and output the expert mode vector.

[0078] It should be noted that the extracted expert pattern is embedded as One-Hot Encoding to represent each sub-pattern, that is, the cross-chain vulnerability pattern corresponding to each cross-chain contract to be detected is one-hot encoded to generate the encoding data corresponding to each cross-chain contract to be detected, and then the encoding data corresponding to all the cross-chain contracts to be detected are processed through a fully connected network to obtain the expert pattern vector.

[0079] For example, keyword matching, syntax analysis, taint analysis techniques, etc. are used to determine the vulnerabilities of cross-chain contracts. If pattern A exists, the position corresponding to pattern A in the one-hot encoding is 1, otherwise it is 0. Assuming that there is a cross-chain vulnerability pattern AE, the dimension of the output one-hot encoding is 5. Finally, all contracts are output through a fully connected network.

[0080] Step 102: Construct a cross-chain control flow graph and a cross-chain data flow graph corresponding to each cross-chain contract to be detected according to the contract bytecode, event log and contract source code corresponding to each cross-chain contract to be detected.

[0081] It should be noted that the contract bytecode corresponding to the cross-chain contract to be detected deployed at a specific address can be obtained through a blockchain browser or node interface such as eth_getCode RPC. By monitoring the contract event log of the cross-chain bridge or through the event interface provided by the blockchain node such as eth_getLogs RPC, the event log generated by the on-chain contract (the contract bytecode corresponding to the cross-chain contract to be detected) can be obtained, thereby capturing relevant event data such as deposits, withdrawals, and authorizations.

[0082] Further, step 102 may include the following sub-steps S21-S25:

[0083] Step S21: Based on the contract bytecode corresponding to each cross-chain contract to be detected, determine multiple control flow graph nodes corresponding to each cross-chain contract to be detected;

[0084] Step S22: Generate multiple control flow graph edges corresponding to each cross-chain contract to be detected according to the contract bytecode and event log corresponding to each cross-chain contract to be detected;

[0085] It should be noted that the node type of the control flow graph node and the edge type of the control flow graph edge of the cross-chain control flow graph can be defined based on the instruction information of the contract bytecode. Among them, there are three types of node types of control flow graph nodes: basic block nodes represent the basic units of program operations, relay layer nodes represent the intermediate nodes of cross-chain data transmission, and client nodes represent the user end of the cross-chain bridge. There are three types of control flow graph edges: control flow edges represent the process of building basic control flows on each side of a given cross-chain bridge, which is used to capture control flow dependencies of conditional statements or call statements; trigger edges represent the relay monitoring deposit events emitted on the source chain, or the client monitoring withdrawal events emitted on the destination chain; notification edges represent the relay notifying the contract on the destination chain of execution authorization and withdrawal events. Trigger edges and notification edges are newly added on the basis of single-chain control flow graphs.

[0086] Step S23: Use multiple control flow graph nodes and multiple control flow graph edges corresponding to each cross-chain contract to be detected to construct a cross-chain control flow graph corresponding to each cross-chain contract to be detected;

[0087] Step S24: Based on the contract source code corresponding to each cross-chain contract to be detected, determine multiple data flow graph nodes and multiple data flow graph edges corresponding to each cross-chain contract to be detected;

[0088] Step S25: Use multiple data flow graph nodes and multiple data flow graph edges corresponding to each cross-chain contract to be detected to construct a cross-chain data flow graph corresponding to each cross-chain contract to be detected.

[0089] It should be noted that the node types of the control flow graph nodes and the edge types of the control flow graph edges of the cross-chain data flow graph are defined based on the control flow and data flow information of the contract source code. Among them, there are two types of control flow graph nodes: core nodes represent key calls and variables in the function code, and normal nodes represent calls and variables that are not extracted as core nodes. There are three types of control flow graph edges: control flow edges represent control flow transfers during program execution, data flow edges represent data dependencies propagated from a data source to one or more data recipients, and fallback edges represent the transfer trajectory of the control flow falling back to the previous state or position when the condition is not met.

[0090] Step 103: Use the preset cross-chain contract vulnerability detection model to detect each cross-chain contract to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0091] The preset cross-chain contract vulnerability detection models include pre-trained language networks (BERT model, Bidirectional Encoder Representations from Transformers), graph neural networks, bimodal teacher networks, and unimodal student networks.

[0092] It should be noted that the cross-modal mutual learning strategy is adopted to collaboratively train the teacher network and the student network (bimodal teacher network, unimodal student network), propose mutual learning loss based on cross entropy, and combine the loss between bytecodes and the loss between source code and bytecode, which can realize the effective extraction and transfer of multimodal knowledge.

[0093] Further, step 103 may include the following sub-steps S31-S36:

[0094] Step S31: Normalize the cross-chain data flow graphs corresponding to each cross-chain contract to be detected, and output the normalized cross-chain data flow graphs corresponding to each cross-chain contract to be detected;

[0095] Step S32: Input the normalized cross-chain data flow graph corresponding to each cross-chain contract to be detected into the graph neural network, and output the cross-chain data flow graph vector corresponding to each cross-chain contract to be detected;

[0096] Please note that Figure 4 ,Since different functions generate cross-chain data flow graphs with different structures, and not all nodes in the cross-chain data flow graph are equally important, and most graph neural networks are essentially flat in the process of information propagation in the graph, we remove normal nodes and merge features into core nodes for graph normalization to highlight the core nodes, such as Figure 4 Then, the normalized cross-chain data flow graph is input into the GraphSAGE network (graph neural network), and the features of each node (cross-chain data flow graph vector) are pooled and aggregated to obtain Figure 4 express.

[0097] Step S33: Generate a cross-chain control flow graph vector corresponding to each cross-chain contract to be detected by using a graph neural network and a pre-trained language network according to the cross-chain control flow graph corresponding to each cross-chain contract to be detected;

[0098] It should be noted that for the constructed cross-chain control flow graph, the basic block nodes are taken as sentences and the instructions are taken as words to input the BERT model for training to obtain the semantics of the basic block nodes, and then input into the GraphSAGE network to learn the graph vector, that is, the cross-chain control flow graph vector.

[0099] Step S34: Feature splicing the expert mode vector and the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and outputting the splicing vector corresponding to each cross-chain contract to be detected;

[0100] It should be noted that after using the fully connected network to obtain the expert mode vector, and using the GraphSAGE network to obtain the graph vectors corresponding to the cross-chain control flow graph and the cross-chain data flow graph respectively, the expert mode vector and the cross-chain control flow graph vector are vector spliced ​​to obtain the instruction information, execution logic and cross-chain interaction characteristics obtained by the contract bytecode. Finally, since the bytecode can provide concise instruction information, and the source code can provide comprehensive control flow and data flow dependencies, the information of the source code and bytecode complement each other to achieve high-precision detection of cross-chain contract vulnerabilities. Therefore, in the face of the lack of cross-chain contract source code, the teacher-student model is chosen for cross-modal mutual learning, so that the missing source code information can be inferred in the case of only bytecode, thereby improving the detection ability of cross-chain vulnerabilities.

[0101] Step S35: Use the bimodal teacher network to generate bytecode embedding corresponding to each cross-chain contract to be detected according to the splicing vector and cross-chain data flow graph vector corresponding to each cross-chain contract to be detected;

[0102] The bimodal teacher network includes a convolution module, an average pooling layer, a fully connected layer and an activation function layer; the network structure of the convolution module is a convolutional neural network.

[0103] Specifically, the process of using the bimodal teacher network to generate the bytecode embedding corresponding to each cross-chain contract to be detected according to the splicing vector and the cross-chain data flow graph vector corresponding to each cross-chain contract to be detected can be achieved by executing the following sub-steps S351 to S355:

[0104] Step S351: Perform convolution operation on the splicing vector and the cross-chain data flow graph vector corresponding to each cross-chain contract to be detected through the convolution module, and output the cross-chain data flow graph convolution feature and the first splicing convolution feature corresponding to each cross-chain contract to be detected;

[0105] Step S352: Use the average pooling layer to average pool the cross-chain data flow graph convolution features and the first splicing convolution features corresponding to each cross-chain contract to be detected, and generate the cross-chain data flow graph average pooling features and the first splicing average pooling features corresponding to each cross-chain contract to be detected;

[0106] Step S353: perform feature splicing on the average pooled features of the cross-chain data flow graphs corresponding to each cross-chain contract to be detected and the first spliced ​​average pooled features, and output the spliced ​​features corresponding to each cross-chain contract to be detected;

[0107] Step S354: Use the concatenated features corresponding to each cross-chain contract to be detected as the input of the fully connected layer, and output the fully connected features corresponding to each cross-chain contract to be detected;

[0108] Step S355: Use the activation function layer to perform nonlinear mapping on the fully connected features corresponding to each cross-chain contract to be detected, and generate bytecode embedding corresponding to each cross-chain contract to be detected.

[0109] It should be noted that the bimodal teacher network takes the concatenated vector of the expert mode vector and the vector corresponding to the cross-chain control flow graph and the embedding of the cross-chain data flow graph (cross-chain data flow graph vector) as input, and after convolutional neural network, average pooling, and feature concatenation, it is input into the fully connected layer and activation layer to obtain the predicted label (bytecode embedding) output by the bimodal teacher network.

[0110] Step S36: Perform cross-chain contract vulnerability detection on each cross-chain contract to be detected through a single-modal student network according to the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0111] The unimodal student network includes a convolution module, an average pooling layer, a fully connected layer, and an activation function layer; the network structure of the convolution module is a convolutional neural network.

[0112] Specifically, the process of performing cross-chain contract vulnerability detection on each cross-chain contract to be detected according to the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be detected through the single-modal student network and outputting the vulnerability detection results corresponding to each cross-chain contract to be detected can be achieved by executing the following sub-steps S361 to S366:

[0113] Step S361: Perform convolution operation on the splicing vectors corresponding to each cross-chain contract to be detected through the convolution module, and output the second splicing convolution features corresponding to each cross-chain contract to be detected;

[0114] Step S362: Use an average pooling layer to average pool the second concatenated convolutional features corresponding to each cross-chain contract to be detected, and generate second concatenated average pooling features corresponding to each cross-chain contract to be detected;

[0115] Step S363: reconstruct the source code information of the bytecode embedding corresponding to each cross-chain contract to be detected, and generate a reconstruction vector corresponding to each cross-chain contract to be detected;

[0116] Step S364: perform feature splicing on the reconstructed vectors corresponding to each cross-chain contract to be detected and the second spliced ​​average pooling features, and output the reconstructed splicing vectors corresponding to each cross-chain contract to be detected;

[0117] Step S365: Use the reconstructed splicing vectors corresponding to each cross-chain contract to be detected as the input of the fully connected layer, and output the fully connected vectors corresponding to each cross-chain contract to be detected;

[0118] Step S366: Use the activation function layer to perform nonlinear mapping on the fully connected vectors corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0119] It should be noted that the unimodal student network uses the concatenated vector of the expert mode vector and the vector corresponding to the cross-chain control flow graph as the input of the convolutional neural network and performs average pooling. The bytecode embedding learned from the bimodal teacher network is used to supervise the learning of the student network, and the source code information of the bytecode is reconstructed. After obtaining the reconstructed vector, the bimodal teacher network source code information is used for supervised learning, and the features are concatenated and input into the fully connected layer and the activation layer to obtain the final prediction label (vulnerability detection result).

[0120] In this embodiment, the present invention solves the problem of automatically identifying cross-chain vulnerabilities before contract deployment. The present invention combines multi-level information such as control flow, data flow and semantics of cross-chain contracts. By extracting expert mode from contract bytecode and constructing a cross-chain control flow graph, the execution logic of the contract is obtained to identify the access control integrity of the contract; a cross-chain data flow graph is constructed through the contract source code to obtain rich control and data flow information of the contract to identify the cross-chain semantic consistency of the contract. At the same time, in the case of missing cross-chain contract source code, the present invention adopts a cross-modal mutual learning strategy and uses bytecode to reconstruct the source code information, thereby effectively improving the accuracy of cross-chain vulnerability detection.

[0121] As a comparison of technical effects, it can be combined with existing technologies for reference. Most existing studies only focus on vulnerability detection of smart contracts on a single blockchain, and rarely focus on cross-chain contract vulnerability detection between multiple blockchains. In addition, the cross-chain bridge is a complex mechanism. Since it navigates between two completely independent blockchain ecosystems built with different programming languages, this complexity creates opportunities for hacker attacks. The problem of how to automatically identify cross-chain vulnerabilities before contract deployment has not yet been solved. In addition, how to use bytecode to reconstruct source code information in the absence of cross-chain contract source code and improve the accuracy of cross-chain vulnerability detection is also an urgent problem to be solved. At the same time, the existing cross-chain attack detection method relies on the collected on-chain transaction statistics, and it is impossible to find vulnerabilities in the code before the contract is deployed to eliminate economic losses. In addition, since only a small number of cross-chain contracts are open source, it is difficult to recover rich control flow and data flow semantics from bytecode. Existing research has not yet solved the problem of achieving high-precision vulnerability detection in the absence of cross-chain contract source code.

[0122] In response to the above problems, the present invention proposes a cross-chain contract vulnerability detection method. The present invention adopts a multimodal data detection framework based on graph neural networks, combined with multi-level information such as control flow, data flow and semantics of cross-chain contracts, to effectively solve the problem of automatically identifying cross-chain vulnerabilities before contract deployment. In the case of missing cross-chain contract source code, a cross-modal mutual learning strategy is adopted, and the source code information is reconstructed using bytecode, thereby effectively improving the accuracy of cross-chain vulnerability detection, and automatically, efficiently and accurately identifying cross-chain contract security vulnerabilities. In this way, the problem of automatically identifying cross-chain vulnerabilities before contract deployment is solved, ensuring the healthy development of the entire blockchain ecosystem.

[0123] In an embodiment of the present invention, the present invention provides a cross-chain contract vulnerability detection method, firstly, a plurality of cross-chain contracts to be detected are obtained, and based on a preset expert mode, a preset fully connected network and program analysis technology are used to output an expert mode vector according to each cross-chain contract to be detected; then, according to the contract bytecode, event log and contract source code corresponding to each cross-chain contract to be detected, a cross-chain control flow graph and a cross-chain data flow graph corresponding to each cross-chain contract to be detected are constructed; finally, a preset cross-chain contract vulnerability detection model is used to detect the cross-chain contract vulnerability according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected. Each cross-chain contract to be detected is detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output; based on the above scheme, based on the preset expert mode, the preset fully connected network and program analysis technology are used according to each cross-chain contract to be detected, the expert mode vector is output, and combined with the preset cross-chain contract vulnerability detection model, the constructed cross-chain control flow graph, cross-chain data flow graph and expert mode vector are processed to output the vulnerability detection result. The present invention combines the control flow, data flow and semantics of the cross-chain contract and other multi-level information, which can automatically identify cross-chain vulnerabilities before the contract is deployed, thereby reducing the risk of economic loss.

[0124] See also Figure 5 , Figure 5 This is a structural block diagram of a cross-chain contract vulnerability detection device provided in Example 2 of the present invention.

[0125] The present invention provides a cross-chain contract vulnerability detection device, comprising:

[0126] The acquisition module 501 is used to acquire multiple cross-chain contracts to be detected, and based on the preset expert mode, use the preset fully connected network and program analysis technology to output the expert mode vector according to each cross-chain contract to be detected;

[0127] Construction module 502, used to construct a cross-chain control flow graph and a cross-chain data flow graph corresponding to each cross-chain contract to be detected according to the contract bytecode, event log and contract source code corresponding to each cross-chain contract to be detected;

[0128] The detection module 503 is used to use a preset cross-chain contract vulnerability detection model to detect each cross-chain contract to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0129] Furthermore, the acquisition module 501 is specifically used for:

[0130] Based on the preset expert mode, program analysis technology is used to judge the vulnerabilities of each cross-chain contract to be tested, and the cross-chain vulnerability mode corresponding to each cross-chain contract to be tested is output;

[0131] Perform one-hot encoding on the cross-chain vulnerability patterns corresponding to each cross-chain contract to be tested, and generate the encoding data corresponding to each cross-chain contract to be tested;

[0132] The encoded data corresponding to each cross-chain contract to be detected is used as the input of the preset fully connected network, and the expert pattern vector is output.

[0133] Further, the construction module 502 is specifically used for:

[0134] Based on the contract bytecode corresponding to each cross-chain contract to be detected, multiple control flow graph nodes corresponding to each cross-chain contract to be detected are determined;

[0135] According to the contract bytecode and event log corresponding to each cross-chain contract to be detected, multiple control flow graph edges corresponding to each cross-chain contract to be detected are generated;

[0136] Using multiple control flow graph nodes and multiple control flow graph edges corresponding to each cross-chain contract to be detected, a cross-chain control flow graph corresponding to each cross-chain contract to be detected is constructed;

[0137] Based on the contract source code corresponding to each cross-chain contract to be detected, determine multiple data flow graph nodes and multiple data flow graph edges corresponding to each cross-chain contract to be detected;

[0138] A cross-chain data flow graph corresponding to each cross-chain contract to be detected is constructed by using multiple data flow graph nodes and multiple data flow graph edges corresponding to each cross-chain contract to be detected.

[0139] Furthermore, the preset cross-chain contract vulnerability detection model includes a pre-trained language network, a graph neural network, a bimodal teacher network, and a unimodal student network; the detection module 503 includes:

[0140] The first submodule is used to normalize the cross-chain data flow graphs corresponding to each cross-chain contract to be detected, and output the normalized cross-chain data flow graphs corresponding to each cross-chain contract to be detected;

[0141] The second submodule is used to input the normalized cross-chain data flow graph corresponding to each cross-chain contract to be detected into the graph neural network, and output the cross-chain data flow graph vector corresponding to each cross-chain contract to be detected;

[0142] The third submodule is used to generate a cross-chain control flow graph vector corresponding to each cross-chain contract to be detected based on the cross-chain control flow graph corresponding to each cross-chain contract to be detected using a graph neural network and a pre-trained language network;

[0143] The fourth submodule is used to perform feature splicing on the expert mode vector and the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and output the splicing vector corresponding to each cross-chain contract to be detected;

[0144] The fifth submodule is used to generate bytecode embedding corresponding to each cross-chain contract to be detected based on the splicing vector and the cross-chain data flow graph vector corresponding to each cross-chain contract to be detected using a bimodal teacher network;

[0145] The sixth sub-module is used to perform cross-chain contract vulnerability detection on each cross-chain contract to be detected through a single-modal student network according to the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0146] Furthermore, the bimodal teacher network includes a convolution module, an average pooling layer, a fully connected layer and an activation function layer; the fifth submodule is specifically used for:

[0147] The convolution module performs convolution operations on the splicing vectors and the cross-chain data flow graph vectors corresponding to each cross-chain contract to be detected, and outputs the cross-chain data flow graph convolution features and the first splicing convolution features corresponding to each cross-chain contract to be detected;

[0148] The average pooling layer is used to average pool the cross-chain data flow graph convolution features and the first splicing convolution features corresponding to each cross-chain contract to be detected, and generate the cross-chain data flow graph average pooling features and the first splicing average pooling features corresponding to each cross-chain contract to be detected;

[0149] The average pooling features of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first spliced ​​average pooling features are spliced ​​respectively, and the spliced ​​features corresponding to each cross-chain contract to be detected are output;

[0150] The concatenated features corresponding to each cross-chain contract to be detected are used as the input of the fully connected layer, and the fully connected features corresponding to each cross-chain contract to be detected are output;

[0151] The activation function layer is used to perform nonlinear mapping on the fully connected features corresponding to each cross-chain contract to be detected, and the bytecode embedding corresponding to each cross-chain contract to be detected is generated.

[0152] Furthermore, the unimodal student network includes a convolution module, an average pooling layer, a fully connected layer, and an activation function layer; the sixth submodule is specifically used for:

[0153] The convolution module performs convolution operation on the splicing vectors corresponding to each cross-chain contract to be detected, and outputs the second splicing convolution features corresponding to each cross-chain contract to be detected;

[0154] The average pooling layer is used to average pool the second concatenated convolutional features corresponding to each cross-chain contract to be detected, and the second concatenated average pooling features corresponding to each cross-chain contract to be detected are generated;

[0155] Reconstruct the source code information of the bytecode embedding corresponding to each cross-chain contract to be detected, and generate the reconstruction vector corresponding to each cross-chain contract to be detected;

[0156] Perform feature splicing on the reconstruction vectors corresponding to each cross-chain contract to be detected and the second splicing average pooling features respectively, and output the reconstruction splicing vectors corresponding to each cross-chain contract to be detected;

[0157] The reconstructed splicing vectors corresponding to each cross-chain contract to be detected are used as the input of the fully connected layer, and the fully connected vectors corresponding to each cross-chain contract to be detected are output;

[0158] The activation function layer is used to perform nonlinear mapping on the fully connected vectors corresponding to each cross-chain contract to be detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output.

[0159] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices, modules and sub-modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0160] An embodiment of the present invention further provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory; when the computer program is executed by the processor, the processor executes the steps of the cross-chain contract vulnerability detection method of the above-mentioned embodiment 1.

[0161] An embodiment of the present invention also provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the cross-chain contract vulnerability detection method of the above-mentioned embodiment 1 are implemented.

[0162] An embodiment of the present invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the cross-chain contract vulnerability detection method of the above-mentioned embodiment 1.

[0163] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0164] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0165] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cross-chain contract vulnerability detection method, characterized in that: include: Obtain multiple cross-chain contracts to be detected, and based on a preset expert mode, use a preset fully connected network and program analysis technology to output an expert mode vector according to each of the cross-chain contracts to be detected; According to the contract bytecode, event log and contract source code corresponding to each of the cross-chain contracts to be detected, a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected are constructed; A preset cross-chain contract vulnerability detection model is used to detect each of the cross-chain contracts to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected, and the vulnerability detection results corresponding to each of the cross-chain contracts to be detected are output.

2. The cross-chain contract vulnerability detection method according to claim 1 is characterized in that: Based on the preset expert mode, the preset fully connected network and program analysis technology are used to output the expert mode vector according to each cross-chain contract to be detected, including: Based on the preset expert mode, program analysis technology is used to judge the vulnerabilities of each cross-chain contract to be detected, and the cross-chain vulnerability mode corresponding to each cross-chain contract to be detected is output; Performing one-hot encoding on the cross-chain vulnerability patterns corresponding to each of the cross-chain contracts to be detected, respectively, to generate encoding data corresponding to each of the cross-chain contracts to be detected; The encoded data corresponding to each of the cross-chain contracts to be detected is used as the input of the preset fully connected network, and an expert mode vector is output.

3. The cross-chain contract vulnerability detection method according to claim 1 is characterized in that: The step of constructing a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected according to the contract bytecode, event log and contract source code corresponding to each of the cross-chain contracts to be detected includes: Based on the contract bytecode corresponding to each of the cross-chain contracts to be detected, determine a plurality of control flow graph nodes corresponding to each of the cross-chain contracts to be detected; Generate multiple control flow graph edges corresponding to each of the cross-chain contracts to be detected according to the contract bytecode and event log corresponding to each of the cross-chain contracts to be detected; Using a plurality of control flow graph nodes and a plurality of control flow graph edges corresponding to each of the cross-chain contracts to be detected, a cross-chain control flow graph corresponding to each of the cross-chain contracts to be detected is constructed; Based on the contract source code corresponding to each of the cross-chain contracts to be detected, determine a plurality of data flow graph nodes and a plurality of data flow graph edges corresponding to each of the cross-chain contracts to be detected; A cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected is constructed using multiple data flow graph nodes and multiple data flow graph edges corresponding to each of the cross-chain contracts to be detected.

4. The cross-chain contract vulnerability detection method according to claim 1 is characterized in that: The preset cross-chain contract vulnerability detection model includes a pre-trained language network, a graph neural network, a bimodal teacher network, and a unimodal student network; the preset cross-chain contract vulnerability detection model is used to detect each of the cross-chain contracts to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected, and the vulnerability detection results corresponding to each of the cross-chain contracts to be detected are output, including: Normalize the cross-chain data flow graphs corresponding to each of the cross-chain contracts to be detected, and output the normalized cross-chain data flow graphs corresponding to each of the cross-chain contracts to be detected; Input the normalized cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected into the graph neural network, and output the cross-chain data flow graph vector corresponding to each of the cross-chain contracts to be detected; Using the graph neural network and the pre-trained language network to generate a cross-chain control flow graph vector corresponding to each of the cross-chain contracts to be detected according to the cross-chain control flow graph corresponding to each of the cross-chain contracts to be detected; Perform feature splicing on the expert mode vector and the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and output the splicing vector corresponding to each cross-chain contract to be detected; A bimodal teacher network is used to generate bytecode embedding corresponding to each of the cross-chain contracts to be detected according to the splicing vectors and cross-chain data flow graph vectors corresponding to each of the cross-chain contracts to be detected; Through the single-modal student network, cross-chain contract vulnerability detection is performed on each of the cross-chain contracts to be detected according to the bytecode embedding and splicing vectors corresponding to each of the cross-chain contracts to be detected, and the vulnerability detection results corresponding to each of the cross-chain contracts to be detected are output.

5. The cross-chain contract vulnerability detection method according to claim 4 is characterized in that: The bimodal teacher network includes a convolution module, an average pooling layer, a fully connected layer and an activation function layer; the bimodal teacher network is used to generate the bytecode embedding corresponding to each of the cross-chain contracts to be detected according to the splicing vectors and cross-chain data flow graph vectors corresponding to each of the cross-chain contracts to be detected, including: Perform convolution operation on the splicing vector and the cross-chain data flow graph vector corresponding to each of the cross-chain contracts to be detected through the convolution module, and output the cross-chain data flow graph convolution feature and the first splicing convolution feature corresponding to each of the cross-chain contracts to be detected; The average pooling layer is used to average pool the cross-chain data flow graph convolution features and the first splicing convolution features corresponding to each of the cross-chain contracts to be detected, so as to generate the cross-chain data flow graph average pooling features and the first splicing average pooling features corresponding to each of the cross-chain contracts to be detected; The average pooling features of the cross-chain data flow graphs corresponding to the cross-chain contracts to be detected and the first spliced ​​average pooling features are respectively spliced, and the spliced ​​features corresponding to the cross-chain contracts to be detected are output; The concatenated features corresponding to each of the cross-chain contracts to be detected are respectively used as the input of the fully connected layer, and the fully connected features corresponding to each of the cross-chain contracts to be detected are output; An activation function layer is used to perform nonlinear mapping on the fully connected features corresponding to each of the cross-chain contracts to be detected, and a bytecode embedding corresponding to each of the cross-chain contracts to be detected is generated.

6. The cross-chain contract vulnerability detection method according to claim 4 is characterized in that: The single-modal student network includes a convolution module, an average pooling layer, a fully connected layer, and an activation function layer; the single-modal student network performs cross-chain contract vulnerability detection on each of the cross-chain contracts to be detected according to the bytecode embedding and splicing vectors corresponding to each of the cross-chain contracts to be detected, and outputs the vulnerability detection results corresponding to each of the cross-chain contracts to be detected, including: Perform convolution operation on the splicing vectors corresponding to each of the cross-chain contracts to be detected through the convolution module, and output the second splicing convolution features corresponding to each of the cross-chain contracts to be detected; An average pooling layer is used to average pool the second concatenated convolutional features corresponding to each of the cross-chain contracts to be detected, so as to generate second concatenated average pooling features corresponding to each of the cross-chain contracts to be detected; Reconstructing the source code information of the bytecode embedding corresponding to each of the cross-chain contracts to be detected, and generating a reconstruction vector corresponding to each of the cross-chain contracts to be detected; Respectively perform feature splicing on the reconstruction vector corresponding to each of the cross-chain contracts to be detected and the second splicing average pooling feature, and output the reconstructed splicing vector corresponding to each of the cross-chain contracts to be detected; The reconstructed splicing vectors corresponding to the cross-chain contracts to be detected are respectively used as the input of the fully connected layer, and the fully connected vectors corresponding to the cross-chain contracts to be detected are output; The activation function layer is used to perform nonlinear mapping on the fully connected vectors corresponding to each cross-chain contract to be detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output.

7. A cross-chain contract vulnerability detection device, characterized in that: include: An acquisition module is used to acquire multiple cross-chain contracts to be detected, and based on a preset expert mode, a preset fully connected network and program analysis technology are used to output an expert mode vector according to each of the cross-chain contracts to be detected; A construction module, used to construct a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected according to the contract bytecode, event log and contract source code corresponding to each of the cross-chain contracts to be detected; The detection module is used to use a preset cross-chain contract vulnerability detection model to detect each of the cross-chain contracts to be detected according to the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected, and output the vulnerability detection results corresponding to each of the cross-chain contracts to be detected.

8. A computer device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor executes the steps of the cross-chain contract vulnerability detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed, the cross-chain contract vulnerability detection method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, wherein when the program instructions are executed by a computer, the computer is caused to execute the cross-chain contract vulnerability detection method as described in any one of claims 1-6.

Images