A method and device for detecting cross-chain contract vulnerabilities

Abstract

This invention discloses a method and apparatus for detecting cross-chain contract vulnerabilities, addressing the technical problem of increased economic losses caused by existing cross-chain contract vulnerability detection methods. The method includes acquiring multiple cross-chain contracts to be detected, and based on a pre-set expert mode, using pre-set fully connected network and program analysis techniques to output expert mode vectors for each cross-chain contract; constructing cross-chain control flow graphs and cross-chain data flow graphs for each cross-chain contract based on its bytecode, event logs, and source code; and using a pre-set cross-chain contract vulnerability detection model to detect each cross-chain contract based on the expert mode vectors, the corresponding cross-chain control flow graphs, and the cross-chain data flow graphs, outputting vulnerability detection results for each cross-chain contract.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, and in particular to a method and apparatus for detecting cross-chain contract vulnerabilities. Background Technology

[0002] Currently, various blockchain projects are heterogeneous blockchains developed using different technical frameworks based on different practical application scenarios and design philosophies. This has resulted in many blockchain projects becoming isolated value systems. The transaction processing capacity and scalability of blockchain technology continue to limit its widespread application.

[0003] With the deepening application of blockchain technology, the demand for integration between different scenarios is increasing, and the need for cross-chain value circulation and application collaboration is becoming increasingly apparent. In order to achieve the organic integration of blockchain projects in different industries, realize the interconnection between blockchains, and ultimately achieve the goal of cross-chain flow of business and value, blockchain has an urgent practical need for cross-chain interaction technology.

[0004] However, due to the complexity of cross-chain technology and its lack of standardization, coupled with the immutability of contracts after deployment, cases of hackers exploiting vulnerabilities in cross-chain contracts for criminal activities have become increasingly common. According to data analytics firm ChainAnalysis, cross-chain bridge hacks accounted for 69% of all stolen cryptocurrency funds in 2022, posing a serious threat to the security of the blockchain ecosystem. Therefore, the urgency of identifying cross-chain contract vulnerabilities is increasingly evident.

[0005] Most existing cross-chain contract vulnerability detection methods focus only on detecting vulnerabilities in smart contracts on a single blockchain. This process relies heavily on collected on-chain transaction statistics and cannot detect vulnerabilities in the code before contract deployment, thus increasing the risk of economic losses. Summary of the Invention

[0006] This invention provides a method and apparatus for detecting vulnerabilities in cross-chain contracts, which addresses the technical problem that existing methods for detecting vulnerabilities in cross-chain contracts increase the risk of economic losses.

[0007] The first aspect of this invention provides a method for detecting cross-chain contract vulnerabilities, comprising:

[0008] Multiple cross-chain contracts to be tested are obtained, and based on the pre-built expert mode, the pre-built fully connected network and program analysis technology are used to output the expert mode vector according to each cross-chain contract to be tested.

[0009] Based on the contract bytecode, event logs and contract source code of each cross-chain contract to be tested, construct the cross-chain control flow graph and cross-chain data flow graph corresponding to each cross-chain contract to be tested.

[0010] A pre-built cross-chain contract vulnerability detection model is used to detect each cross-chain contract to be tested based on the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be tested, and output the vulnerability detection results corresponding to each cross-chain contract to be tested.

[0011] Optionally, the step of outputting an expert mode vector based on a pre-built expert mode, using a pre-built fully connected network and program analysis technology, according to each of the cross-chain contracts to be tested, includes:

[0012] Based on the pre-built expert mode, the program analysis technology is used to judge the vulnerabilities of each of the cross-chain contracts to be tested, and outputs the cross-chain vulnerability mode corresponding to each of the cross-chain contracts to be tested.

[0013] Each of the cross-chain vulnerability patterns corresponding to the cross-chain contracts to be tested is individually encoded to generate encoded data corresponding to each of the cross-chain contracts to be tested.

[0014] The encoded data corresponding to each cross-chain contract to be tested is used as the input of a pre-set fully connected network, and an expert mode vector is output.

[0015] Optionally, the step of constructing a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested based on the contract bytecode, event logs, and contract source code includes:

[0016] Based on the contract bytecode corresponding to each of the cross-chain contracts to be tested, multiple control flow graph nodes corresponding to each of the cross-chain contracts to be tested are determined.

[0017] Based on the contract bytecode and event logs of each cross-chain contract to be tested, generate multiple control flow graph edges corresponding to each cross-chain contract to be tested.

[0018] A cross-chain control flow graph corresponding to each of the cross-chain contracts to be tested is constructed using multiple control flow graph nodes and multiple control flow graph edges corresponding to each of the cross-chain contracts to be tested.

[0019] Based on the contract source code corresponding to each of the cross-chain contracts to be tested, multiple data flow graph nodes and multiple data flow graph edges corresponding to each of the cross-chain contracts to be tested are determined.

[0020] A cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested is constructed using multiple data flow graph nodes and multiple data flow graph edges.

[0021] Optionally, the pre-built cross-chain contract vulnerability detection model includes a pre-trained language network, a graph neural network, a bimodal teacher network, and a unimodal student network; the step of using the pre-built cross-chain contract vulnerability detection model to detect each cross-chain contract to be detected based on the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and outputting the vulnerability detection results corresponding to each cross-chain contract to be detected includes:

[0022] The cross-chain data flow graphs corresponding to each of the cross-chain contracts to be tested are normalized, and the normalized cross-chain data flow graphs corresponding to each of the cross-chain contracts to be tested are output.

[0023] The normalized cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested is input into the graph neural network, and the cross-chain data flow graph vector corresponding to each of the cross-chain contracts to be tested is output.

[0024] The graph neural network and pre-trained language network are used to generate cross-chain control flow graph vectors corresponding to each cross-chain contract to be detected, based on the cross-chain control flow graphs corresponding to each cross-chain contract to be detected.

[0025] The expert mode vector is concatenated with the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and the concatenated vector corresponding to each cross-chain contract to be detected is output.

[0026] A bimodal teacher network is used to generate bytecode embeddings for each cross-chain contract to be detected based on the splicing vector and cross-chain data flow graph vector.

[0027] The single-modal student network performs cross-chain contract vulnerability detection on each cross-chain contract to be detected based on the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be detected, and outputs the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0028] Optionally, the bimodal teacher network includes a convolutional module, an average pooling layer, a fully connected layer, and an activation function layer; the step of using the bimodal teacher network to generate bytecode embeddings corresponding to each of the cross-chain contracts to be detected based on the concatenation vector and cross-chain data flow graph vector includes:

[0029] The convolution module performs convolution operations on the spliced ​​vector and cross-chain data flow graph vector corresponding to each cross-chain contract to be detected, and outputs the cross-chain data flow graph convolution features and the first spliced ​​convolution features corresponding to each cross-chain contract to be detected.

[0030] An average pooling layer is used to perform average pooling on the convolutional features of the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected and the first concatenated convolutional features, to generate the average pooling features of the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected and the first concatenated average pooling features.

[0031] The average pooling feature of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first concatenated average pooling feature are concatenated to output the concatenated feature corresponding to each cross-chain contract to be detected.

[0032] Each of the concatenated features corresponding to the cross-chain contracts to be detected is used as the input of the fully connected layer, and the fully connected features corresponding to each of the cross-chain contracts to be detected are output.

[0033] An activation function layer is used to perform a non-linear mapping on the fully connected features corresponding to each cross-chain contract to be detected, thereby generating the bytecode embedding corresponding to each cross-chain contract to be detected.

[0034] Optionally, the unimodal student network includes a convolutional module, an average pooling layer, a fully connected layer, and an activation function layer; the step of performing cross-chain contract vulnerability detection on each cross-chain contract to be detected using the unimodal student network based on the bytecode embedding and concatenation vectors corresponding to each cross-chain contract to be detected, and outputting the vulnerability detection results corresponding to each cross-chain contract to be detected, includes:

[0035] The convolution module performs convolution operations on the concatenated vectors corresponding to each cross-chain contract to be detected, and outputs the second concatenated convolution feature corresponding to each cross-chain contract to be detected.

[0036] An average pooling layer is used to perform average pooling on the second concatenated convolutional features corresponding to each of the cross-chain contracts to be detected, thereby generating the second concatenated average pooled features corresponding to each of the cross-chain contracts to be detected.

[0037] The source code information of the bytecode embeddings corresponding to each cross-chain contract to be detected is reconstructed to generate a reconstruction vector corresponding to each cross-chain contract to be detected.

[0038] The reconstruction vectors and second concatenated average pooling features corresponding to each cross-chain contract to be detected are concatenated to output the reconstruction concatenated vectors corresponding to each cross-chain contract to be detected.

[0039] The reconstructed splicing vectors corresponding to each cross-chain contract to be detected are used as inputs to the fully connected layer, and the fully connected vectors corresponding to each cross-chain contract to be detected are output.

[0040] An activation function layer is used to perform nonlinear mapping on the fully connected vectors corresponding to each cross-chain contract to be detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output.

[0041] A second aspect of the present invention provides a cross-chain contract vulnerability detection device, comprising:

[0042] The acquisition module is used to acquire multiple cross-chain contracts to be tested, and based on the pre-set expert mode, it uses a pre-set fully connected network and program analysis technology to output expert mode vectors according to each cross-chain contract to be tested;

[0043] The construction module is used to construct the cross-chain control flow graph and cross-chain data flow graph corresponding to each cross-chain contract to be tested based on the contract bytecode, event log and contract source code of each cross-chain contract to be tested;

[0044] The detection module is used to use a pre-set cross-chain contract vulnerability detection model to detect each cross-chain contract to be detected based on the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0045] A computer device provided in a third aspect of the present invention includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the cross-chain contract vulnerability detection method as described in any of the preceding claims.

[0046] The fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed, implements the steps of the cross-chain contract vulnerability detection method as described in any of the preceding claims.

[0047] The fifth aspect of the present invention provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein, when the program instructions are executed by a computer, the computer performs the steps of the cross-chain contract vulnerability detection method as described in any of the preceding claims.

[0048] As can be seen from the above technical solutions, the present invention has the following advantages:

[0049] The above-mentioned technical solution of the present invention provides a method for detecting cross-chain contract vulnerabilities. First, multiple cross-chain contracts to be detected are obtained. Based on a pre-set expert mode, a pre-set fully connected network and program analysis technique is used to output an expert mode vector for each cross-chain contract to be detected. Next, based on the contract bytecode, event logs, and contract source code corresponding to each cross-chain contract to be detected, a cross-chain control flow graph and a cross-chain data flow graph corresponding to each cross-chain contract to be detected are constructed. Finally, a pre-set cross-chain contract vulnerability detection model is used to analyze each cross-chain contract based on the expert mode vector, the cross-chain control flow graph, and the cross-chain data flow graph corresponding to each cross-chain contract to be detected. The process involves detecting cross-chain contracts and outputting vulnerability detection results for each contract. Based on this approach, and using pre-built expert modes and pre-built fully connected networks and program analysis techniques, expert mode vectors are output for each cross-chain contract. Combined with a pre-built cross-chain contract vulnerability detection model, the constructed cross-chain control flow graph, cross-chain data flow graph, and expert mode vectors are processed to output vulnerability detection results. This invention integrates multi-layered information such as the control flow, data flow, and semantics of cross-chain contracts, enabling automatic identification of cross-chain vulnerabilities before contract deployment, thereby reducing the risk of economic loss. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a flowchart illustrating the steps of a cross-chain contract vulnerability detection method provided in Embodiment 1 of the present invention.

[0052] Figure 2 This is a detection framework diagram of the cross-chain contract vulnerability detection method provided in Embodiment 1 of the present invention;

[0053] Figure 3 This is a diagram of the cross-chain interaction architecture provided in Embodiment 1 of the present invention;

[0054] Figure 4 This is a standardized flowchart of the cross-chain data flow graph provided in Embodiment 1 of the present invention;

[0055] Figure 5 This is a structural block diagram of a cross-chain contract vulnerability detection device provided in Embodiment 2 of the present invention. Detailed Implementation

[0056] This invention provides a method and apparatus for detecting cross-chain contract vulnerabilities, which addresses the technical problem that existing cross-chain contract vulnerability detection methods increase the risk of economic losses.

[0057] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0058] Terminology Explanation:

[0059] Graph Neural Networks (GNNs) are a type of neural network specifically designed for processing graph-structured data. The basic idea of ​​GNNs is to update a node's representation by aggregating information from its neighbors. By learning the rules of information transfer and transformation between nodes, they model and analyze graph data, thereby handling graph data with complex topologies, such as social networks, bioinformatics networks, and knowledge graphs.

[0060] Blockchain: Blockchain is a decentralized distributed ledger that is stored in blocks, is immutable, secure and reliable. It combines distributed storage, peer-to-peer transmission, consensus mechanisms, cryptography and other technologies to record transactions and information through a continuously growing chain of data blocks, ensuring data security and transparency.

[0061] Smart contracts: A smart contract is a piece of code stored on the blockchain that defines all the contractual terms agreed upon by all parties using the contract. After the required code is input, the smart contract will automatically execute all the corresponding pre-defined code and output the expected result. Just as the blockchain provides distributed and trusted storage, smart contracts provide distributed and reliable computation.

[0062] Cross-chain technology refers to the use of specific technical means to enable direct interaction of value across different blockchains, facilitating asset circulation and value transfer. Cross-chain technology acts as a trusted third-party exchange, allowing different users to conduct cross-chain transactions without altering the total value on any single blockchain; it simply facilitates value exchange between users on different blockchains. This not only enables information transmission but also allows value to flow between different blockchains while maintaining the principle of value conservation.

[0063] Vulnerability detection: Vulnerability detection technology refers to the analysis and testing of all front-end components and internal structures of existing software, networks, and systems to identify, locate, and fix various known and unknown vulnerabilities. A vulnerability is a flaw in software functionality, program writing, or improper hardware configuration that leads to a security risk in a system. Attackers can exploit this vulnerability to launch attacks and compromise its security.

[0064] Please see Figure 1 , Figure 1 The flowchart illustrates the steps of a cross-chain contract vulnerability detection method provided in this embodiment of the invention.

[0065] This invention provides a method for detecting cross-chain contract vulnerabilities, comprising:

[0066] Step 101: Obtain multiple cross-chain contracts to be tested, and based on the pre-built expert mode, use the pre-built fully connected network and program analysis technology to output expert mode vectors according to each cross-chain contract to be tested.

[0067] It should be noted that you should refer to [link / reference]. Figure 2 The cross-chain contract vulnerability detection framework proposed in this invention comprises four stages: expert mode extraction, cross-chain control flow graph construction, cross-chain data flow graph construction, and cross-modal mutual learning. Figure 2 As shown. Expert pattern extraction refers to determining whether cross-chain vulnerability patterns exist in the contract through keyword matching, syntax analysis, taint analysis, and other techniques, embedding the extracted expert patterns into vectors, and then learning the expert pattern vectors through a fully connected network. Cross-chain control flow graph construction refers to defining the node and edge types of the cross-chain control flow graph based on the instruction information of the contract bytecode, inputting it into a Transformer-based bidirectional encoding (BERT) model to obtain the semantics of the nodes in the graph, and then learning the graph vectors through a graph sampling and aggregation (GraphSAGE) network. Cross-chain data flow graph construction refers to defining the node and edge types of the cross-chain data flow graph based on the control flow and data flow information of the contract source code, normalizing the graph, and then inputting it into a GraphSAGE network (graph neural network) to pool and aggregate the features of each node to obtain the graph representation. Finally, cross-modal mutual learning is performed using teacher-student models (i.e., bimodal teacher network and unimodal student network) to enable inference of missing source code information with only bytecode, thereby improving the detection capability of cross-chain vulnerabilities.

[0068] Furthermore, based on the pre-built expert pattern, the process of outputting expert pattern vectors according to each cross-chain contract to be tested using a pre-built fully connected network and program analysis technology can be achieved by executing the following sub-steps S11 to S13:

[0069] Step S11: Based on the pre-built expert mode, use program analysis technology to judge the vulnerabilities of each cross-chain contract to be tested, and output the cross-chain vulnerability mode corresponding to each cross-chain contract to be tested.

[0070] Program analysis techniques include keyword matching, syntax analysis, taint analysis, and so on.

[0071] It should be noted that you should refer to [link / reference]. Figure 3 Cross-chain interaction comprises three parts: asset deposit and locking on the source chain, cross-chain communication via off-chain relays, and asset authorization and withdrawal on the destination chain, such as... Figure 3 As shown. Each part involves different cross-chain vulnerabilities, and security audits are conducted by defining a series of corresponding expert patterns, i.e., pre-defined expert patterns, specifically:

[0072] Asset deposits and locks on the source chain are divided into two parts: 1) Checking whether the deposit operation is successful: comparing the deposit amount, balance, and threshold, such as checking the cross-chain bridge balance after the deposit, the depositor's balance, and the cross-chain bridge's liquidity. 2) Checking whether the deposit operation is legal: comparing the logical conditions of the deposit, such as checking the function call and the declaration of user information.

[0073] Cross-chain communication for off-chain relays consists of two parts: 1) Checking the tokens and chains supported by the cross-chain bridge: comparing the ID values ​​of the exchange tokens, the original chain, and the destination chain. 2) Checking the address of the external call: comparing whether the address of the external call is a zero address.

[0074] The authorization and withdrawal of assets on the target chain are divided into three parts: 1) Checking the legality of asset authorization: comparing cross-chain interaction information and on-chain time status, such as checking the signature, signer information, and signature timestamp. 2) Checking for duplicate withdrawal operations: checking the mapping variables in the list for duplicate withdrawal records. 3) Checking the legality of withdrawal operations: comparing whether the withdrawing user is a specific user address or a zero address.

[0075] Furthermore, after defining the corresponding expert mode, that is, after completing the setting of the pre-set expert mode, the cross-chain vulnerability mode is determined by keyword matching, syntax analysis, taint analysis and other technologies to determine whether there is a cross-chain vulnerability mode in each cross-chain contract (the cross-chain contract to be tested), thereby obtaining the cross-chain vulnerability mode corresponding to each cross-chain contract.

[0076] Step S12: Perform one-hot encoding on the cross-chain vulnerability patterns corresponding to each cross-chain contract to be tested, and generate the encoding data corresponding to each cross-chain contract to be tested.

[0077] Step S13: Use the encoded data corresponding to each cross-chain contract to be tested as the input of the pre-set fully connected network, and output the expert mode vector.

[0078] It should be noted that the extracted expert patterns are embedded as one-hot encoding to represent each sub-pattern. That is, the cross-chain vulnerability patterns corresponding to each cross-chain contract to be tested are one-hot encoded to generate the encoded data corresponding to each cross-chain contract to be tested. Then, the encoded data corresponding to all cross-chain contracts to be tested are processed through a fully connected network to obtain the expert pattern vector.

[0079] For example, keyword matching, syntax analysis, and taint analysis techniques are used to identify vulnerabilities in cross-chain contracts. If pattern A exists, the position corresponding to pattern A in the one-hot encoding is set to 1; otherwise, it is set to 0. Assuming there is a cross-chain vulnerability pattern AE, the dimension of the output one-hot encoding is 5. Finally, all contracts are output through a fully connected network.

[0080] Step 102: Based on the contract bytecode, event logs and contract source code of each cross-chain contract to be tested, construct the cross-chain control flow graph and cross-chain data flow graph corresponding to each cross-chain contract to be tested.

[0081] It should be noted that the bytecode of the cross-chain contract under test, deployed at a specific address, can be obtained through a blockchain explorer or node interface such as eth_getCode RPC. By listening to the contract event logs of the cross-chain bridge or through event interfaces provided by the blockchain node such as eth_getLogs RPC, the event logs generated by the on-chain contract (the bytecode of the cross-chain contract under test) can be obtained, thereby capturing relevant event data such as deposits, withdrawals, and authorizations.

[0082] Further, step 102 may include the following sub-steps S21-S25:

[0083] Step S21: Based on the contract bytecode corresponding to each cross-chain contract to be tested, determine multiple control flow graph nodes corresponding to each cross-chain contract to be tested;

[0084] Step S22: Generate multiple control flow graph edges corresponding to each cross-chain contract to be tested based on the contract bytecode and event logs.

[0085] It should be noted that the node types and edge types of the cross-chain control flow graph can be defined based on the instruction information of the contract bytecode. There are three types of control flow graph nodes: basic block nodes represent the basic units of program operations, relay layer nodes represent intermediate nodes for cross-chain data transmission, and client nodes represent the user end of the cross-chain bridge. There are three types of control flow graph edges: control flow edges represent the process of building the basic control flow on each side of a given cross-chain bridge, used to capture control flow dependencies of conditional statements or call statements; trigger edges represent the relay monitoring deposit events emitted on the source chain, or the client monitoring withdrawal events emitted on the destination chain; and notification edges represent the relay notifying the destination chain of contract execution authorization and withdrawal events. Trigger edges and notification edges are newly added to the single-chain control flow graph.

[0086] Step S23: Construct the cross-chain control flow graph corresponding to each cross-chain contract to be tested using multiple control flow graph nodes and multiple control flow graph edges corresponding to each cross-chain contract to be tested;

[0087] Step S24: Based on the contract source code corresponding to each cross-chain contract to be tested, determine multiple data flow graph nodes and multiple data flow graph edges corresponding to each cross-chain contract to be tested;

[0088] Step S25: Construct the cross-chain data flow graph corresponding to each cross-chain contract to be tested using multiple data flow graph nodes and multiple data flow graph edges.

[0089] It should be noted that the control flow graph nodes and edge types of the cross-chain data flow graph are defined based on the control flow and data flow information of the contract source code. There are two types of control flow graph nodes: core nodes represent key calls and variables in the function code, while normal nodes represent calls and variables that were not extracted as core nodes. There are three types of control flow graph edges: control flow edges represent control flow transitions during program execution; data flow edges represent data dependencies propagating from a data source to one or more data receivers; and backoff edges represent the transition trajectory where the control flow reverts to the previous state or position when conditions are not met.

[0090] Step 103: Using a pre-built cross-chain contract vulnerability detection model, the cross-chain control flow graph and cross-chain data flow graph corresponding to each cross-chain contract to be detected are used to detect each cross-chain contract to be detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output.

[0091] The pre-built cross-chain contract vulnerability detection models include pre-trained language networks (BERT model, Bidirectional Encoder Representations from Transformers), graph neural networks, bimodal teacher networks, and unimodal student networks.

[0092] It should be noted that by adopting a cross-modal mutual learning strategy to collaboratively train the teacher network and student network (bimodal teacher network and unimodal student network), and proposing a mutual learning loss based on cross-entropy, and combining the loss between bytecode and the loss between source code and bytecode, it is possible to achieve effective extraction and transfer of multimodal knowledge.

[0093] Furthermore, step 103 may include the following sub-steps S31-S36:

[0094] Step S31: Normalize the cross-chain data flow graph corresponding to each cross-chain contract to be tested, and output the normalized cross-chain data flow graph corresponding to each cross-chain contract to be tested.

[0095] Step S32: Input the normalized cross-chain data flow graph corresponding to each cross-chain contract to be tested into the graph neural network, and output the cross-chain data flow graph vector corresponding to each cross-chain contract to be tested;

[0096] It should be noted that you should refer to [link / reference]. Figure 4 Since different functions generate cross-chain data flow graphs with different structures, and not all nodes in a cross-chain data flow graph are equally important, and most graph neural networks are inherently flat during information propagation, a graph normalization process is adopted by removing normal nodes and merging features into core nodes to highlight the core nodes, such as... Figure 4 As shown. Then, the normalized cross-chain data flow graph is input into the GraphSAGE network (graph neural network), and the features (cross-chain data flow graph vectors) of each node are pooled and aggregated to obtain... Figure 4 express.

[0097] Step S33: Using graph neural networks and pre-trained language networks, generate cross-chain control flow graph vectors corresponding to each cross-chain contract to be detected based on the cross-chain control flow graphs corresponding to each cross-chain contract to be detected;

[0098] It should be noted that for the constructed cross-chain control flow graph, the basic block nodes are used as sentences and the instructions are used as words to train the BERT model to obtain the semantics of the basic block nodes. Then, the GraphSAGE network is used to learn the graph vector, which is the cross-chain control flow graph vector.

[0099] Step S34: Concatenate the expert mode vector with the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and output the concatenated vector corresponding to each cross-chain contract to be detected.

[0100] It should be noted that after obtaining expert mode vectors using a fully connected network and graph vectors corresponding to the cross-chain control flow graph and cross-chain data flow graph using the GraphSAGE network, the expert mode vectors and cross-chain control flow graph vectors are concatenated to obtain instruction information, execution logic, and cross-chain interaction features obtained from the contract bytecode. Finally, since bytecode provides concise instruction information while source code provides comprehensive control flow and data flow dependencies, the information from source code and bytecode complements each other to achieve high-precision detection of cross-chain contract vulnerabilities. Therefore, when faced with missing cross-chain contract source code, a teacher-student model is chosen for cross-modal mutual learning, enabling the inference of missing source code information even with only bytecode available, thereby improving the detection capability of cross-chain vulnerabilities.

[0101] Step S35: Using a bimodal teacher network, generate the bytecode embedding corresponding to each cross-chain contract to be tested based on the splicing vector and cross-chain data flow graph vector corresponding to each cross-chain contract to be tested;

[0102] The bimodal teacher network consists of convolutional modules, average pooling layers, fully connected layers, and activation function layers; the network structure of the convolutional modules is a convolutional neural network.

[0103] Specifically, the process of generating bytecode embeddings for each cross-chain contract to be tested using a bimodal teacher network based on the concatenation vector and cross-chain data flow graph vector can be achieved by executing the following sub-steps S351 to S355:

[0104] Step S351: Perform convolution operation on the concatenated vector and cross-chain data flow graph vector corresponding to each cross-chain contract to be detected through the convolution module, and output the cross-chain data flow graph convolution feature and the first concatenated convolution feature corresponding to each cross-chain contract to be detected.

[0105] Step S352: Use an average pooling layer to perform average pooling on the convolutional features of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first spliced ​​convolutional features to generate the average pooling features of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first spliced ​​average pooling features.

[0106] Step S353: Perform feature concatenation on the average pooling feature of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first concatenated average pooling feature, and output the concatenated feature corresponding to each cross-chain contract to be detected.

[0107] Step S354: Take the splicing features corresponding to each cross-chain contract to be detected as the input of the fully connected layer, and output the fully connected features corresponding to each cross-chain contract to be detected.

[0108] Step S355: Use an activation function layer to perform nonlinear mapping on the fully connected features corresponding to each cross-chain contract to be detected, and generate the bytecode embedding corresponding to each cross-chain contract to be detected.

[0109] It should be noted that the bimodal teacher network takes the concatenated vector of the expert mode vector and the corresponding vector of the cross-chain control flow graph, and the embedding of the cross-chain data flow graph (cross-chain data flow graph vector) as input. After passing through the convolutional neural network and average pooling, the feature concatenation is input to the fully connected layer and the activation layer to obtain the predicted label (bytecode embedding) output by the bimodal teacher network.

[0110] Step S36: Using a single-modal student network, perform cross-chain contract vulnerability detection on each cross-chain contract to be detected based on the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0111] The unimodal student network includes convolutional modules, average pooling layers, fully connected layers, and activation function layers; the network structure of the convolutional modules is a convolutional neural network.

[0112] Specifically, the process of performing cross-chain contract vulnerability detection on each cross-chain contract to be detected through a single-modal student network based on the bytecode embedding and concatenation vectors corresponding to each cross-chain contract to be detected, and outputting the vulnerability detection results for each cross-chain contract to be detected, can be achieved by executing the following sub-steps S361 to S366:

[0113] Step S361: Perform convolution operation on the concatenated vectors corresponding to each cross-chain contract to be detected through the convolution module, and output the second concatenated convolution feature corresponding to each cross-chain contract to be detected.

[0114] Step S362: Use an average pooling layer to perform average pooling on the second concatenated convolutional features corresponding to each cross-chain contract to be detected, and generate the second concatenated average pooled features corresponding to each cross-chain contract to be detected.

[0115] Step S363: Reconstruct the source code information of the bytecode embedding corresponding to each cross-chain contract to be detected, and generate the reconstruction vector corresponding to each cross-chain contract to be detected.

[0116] Step S364: Perform feature concatenation on the reconstruction vector and the second concatenated average pooling feature corresponding to each cross-chain contract to be detected, and output the reconstruction concatenation vector corresponding to each cross-chain contract to be detected.

[0117] Step S365: Take the reconstructed splicing vector corresponding to each cross-chain contract to be detected as the input of the fully connected layer, and output the fully connected vector corresponding to each cross-chain contract to be detected.

[0118] Step S366: Use the activation function layer to perform nonlinear mapping on the fully connected vector corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected.

[0119] It should be noted that the unimodal student network uses the concatenated vector of the expert mode vector and the corresponding vector of the cross-chain control flow graph as the input of the convolutional neural network and performs average pooling. It uses bytecode embedding learned from the bimodal teacher network to supervise the learning of the student network, reconstructs the source code information of the bytecode, and then uses the source code information of the bimodal teacher network for supervised learning. The features are concatenated and input into the fully connected layer and activation layer to obtain the final predicted label (vulnerability detection result).

[0120] In this embodiment, to address the problem of automatically identifying cross-chain vulnerabilities before contract deployment, this invention combines multi-layered information such as control flow, data flow, and semantics of cross-chain contracts. By extracting expert patterns from contract bytecode and constructing a cross-chain control flow graph, the execution logic of the contract is obtained to identify its access control integrity. A cross-chain data flow graph is constructed from the contract source code to obtain rich control and data flow information, thereby identifying the contract's cross-chain semantic consistency. Furthermore, in the event of missing cross-chain contract source code, this invention employs a cross-modal mutual learning strategy to reconstruct source code information using bytecode, thereby effectively improving the accuracy of cross-chain vulnerability detection.

[0121] For comparison of technical effectiveness, existing technologies can be referenced. Most current research focuses on vulnerability detection in smart contracts on a single blockchain, with very little attention paid to cross-chain contract vulnerability detection across multiple blockchains. Furthermore, cross-chain bridges are complex mechanisms; navigating between two completely independent blockchain ecosystems built using different programming languages ​​creates opportunities for hackers. The problem of automatically identifying cross-chain vulnerabilities before contract deployment remains unsolved. Moreover, how to reconstruct source code information from bytecode and improve the accuracy of cross-chain vulnerability detection when the cross-chain contract source code is missing is also a pressing issue. Additionally, existing cross-chain attack detection methods rely on collected on-chain transaction statistics, which cannot discover vulnerabilities in the code before contract deployment and thus prevent economic losses. Furthermore, since only a small portion of cross-chain contracts are open source, it is difficult to recover rich control flow and data flow semantics from the bytecode; current research has not yet solved the problem of achieving high-precision vulnerability detection when the cross-chain contract source code is missing.

[0122] To address the aforementioned issues, this invention proposes a cross-chain contract vulnerability detection method. This invention employs a multimodal data detection framework based on graph neural networks, combining multi-layered information such as control flow, data flow, and semantics of cross-chain contracts. This effectively solves the problem of automatically identifying cross-chain vulnerabilities before contract deployment. In the case of missing cross-chain contract source code, a cross-modal mutual learning strategy is used to reconstruct source code information using bytecode, thereby effectively improving the accuracy of cross-chain vulnerability detection and automatically, efficiently, and accurately identifying cross-chain contract security vulnerabilities. This ultimately solves the problem of automatically identifying cross-chain vulnerabilities before contract deployment, ensuring the healthy development of the entire blockchain ecosystem.

[0123] In this embodiment of the invention, a method for detecting cross-chain contract vulnerabilities is provided. First, multiple cross-chain contracts to be detected are acquired. Based on a pre-set expert mode, a pre-set fully connected network and program analysis technique is used to output an expert mode vector for each cross-chain contract to be detected. Next, based on the contract bytecode, event logs, and contract source code corresponding to each cross-chain contract to be detected, a cross-chain control flow graph and a cross-chain data flow graph corresponding to each cross-chain contract to be detected are constructed. Finally, a pre-set cross-chain contract vulnerability detection model is used to analyze the expert mode vectors and the cross-chain control flow graphs and cross-chain data flow graphs corresponding to each cross-chain contract to be detected. Each cross-chain contract to be tested is tested, and the vulnerability detection results for each cross-chain contract are output. Based on the above scheme, and based on a pre-built expert mode, a pre-built fully connected network and program analysis technology are used to output expert mode vectors for each cross-chain contract to be tested. Combined with a pre-built cross-chain contract vulnerability detection model, the constructed cross-chain control flow graph, cross-chain data flow graph, and expert mode vectors are processed to output vulnerability detection results. This invention combines multi-level information such as the control flow, data flow, and semantics of cross-chain contracts, and can automatically identify cross-chain vulnerabilities before contract deployment, thereby reducing the risk of economic loss.

[0124] Please see Figure 5 , Figure 5 This is a structural block diagram of a cross-chain contract vulnerability detection device provided in Embodiment 2 of the present invention.

[0125] This invention provides a cross-chain contract vulnerability detection device, comprising:

[0126] The acquisition module 501 is used to acquire multiple cross-chain contracts to be tested, and based on the pre-set expert mode, it uses a pre-set fully connected network and program analysis technology to output expert mode vectors according to each cross-chain contract to be tested.

[0127] Module 502 is used to construct the cross-chain control flow graph and cross-chain data flow graph corresponding to each cross-chain contract to be tested based on the contract bytecode, event log and contract source code of each cross-chain contract to be tested;

[0128] The detection module 503 is used to use a pre-built cross-chain contract vulnerability detection model to detect each cross-chain contract to be tested based on the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be tested, and output the vulnerability detection results corresponding to each cross-chain contract to be tested.

[0129] Furthermore, module 501 is specifically used for:

[0130] Based on the pre-built expert mode, the program analysis technology is used to judge the vulnerabilities of each cross-chain contract to be tested, and outputs the cross-chain vulnerability mode corresponding to each cross-chain contract to be tested.

[0131] Each cross-chain vulnerability pattern corresponding to the cross-chain contract to be tested is individually encoded to generate the encoded data corresponding to each cross-chain contract to be tested.

[0132] The encoded data corresponding to each cross-chain contract to be tested is used as the input of a pre-built fully connected network, and the output is an expert mode vector.

[0133] Furthermore, module 502 is specifically used for:

[0134] Based on the contract bytecode corresponding to each cross-chain contract to be tested, multiple control flow graph nodes corresponding to each cross-chain contract to be tested are determined.

[0135] Based on the contract bytecode and event logs of each cross-chain contract to be tested, generate multiple control flow graph edges corresponding to each cross-chain contract to be tested.

[0136] By using multiple control flow graph nodes and multiple control flow graph edges corresponding to each cross-chain contract to be tested, a cross-chain control flow graph corresponding to each cross-chain contract to be tested is constructed.

[0137] Based on the contract source code corresponding to each cross-chain contract to be tested, multiple data flow graph nodes and multiple data flow graph edges corresponding to each cross-chain contract to be tested are determined.

[0138] By using multiple data flow graph nodes and multiple data flow graph edges corresponding to each cross-chain contract to be tested, a cross-chain data flow graph corresponding to each cross-chain contract to be tested is constructed.

[0139] Furthermore, the pre-built cross-chain contract vulnerability detection model includes a pre-trained language network, graph neural network, bimodal teacher network, and unimodal student network; the detection module 503 includes:

[0140] The first submodule is used to normalize the cross-chain data flow graph corresponding to each cross-chain contract to be tested, and output the normalized cross-chain data flow graph corresponding to each cross-chain contract to be tested.

[0141] The second submodule is used to input the normalized cross-chain data flow graph corresponding to each cross-chain contract to be tested into the graph neural network and output the cross-chain data flow graph vector corresponding to each cross-chain contract to be tested.

[0142] The third submodule is used to generate cross-chain control flow graph vectors corresponding to each cross-chain contract to be detected based on the cross-chain control flow graph corresponding to each cross-chain contract to be detected, using graph neural networks and pre-trained language networks.

[0143] The fourth submodule is used to perform feature concatenation between the expert mode vector and the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and output the concatenated vector corresponding to each cross-chain contract to be detected.

[0144] The fifth submodule is used to generate the bytecode embedding corresponding to each cross-chain contract to be tested by using a dual-modal teacher network based on the splicing vector and cross-chain data flow graph vector corresponding to each cross-chain contract to be tested.

[0145] The sixth submodule is used to perform cross-chain contract vulnerability detection on each cross-chain contract to be tested through a single-modal student network based on the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be tested, and output the vulnerability detection results corresponding to each cross-chain contract to be tested.

[0146] Furthermore, the bimodal teacher network includes convolutional modules, average pooling layers, fully connected layers, and activation function layers; the fifth submodule is specifically used for:

[0147] The convolution module performs convolution operations on the spliced ​​vector and cross-chain data flow graph vector corresponding to each cross-chain contract to be detected, and outputs the convolutional features of the cross-chain data flow graph and the first spliced ​​convolutional features corresponding to each cross-chain contract to be detected.

[0148] An average pooling layer is used to average pool the convolutional features of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first concatenated convolutional features to generate the average pooling features of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first concatenated average pooling features.

[0149] The average pooling feature of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first concatenated average pooling feature are concatenated to output the concatenated feature corresponding to each cross-chain contract to be detected.

[0150] Each concatenated feature corresponding to the cross-chain contract to be detected is used as the input of the fully connected layer, and the fully connected feature corresponding to each cross-chain contract to be detected is output.

[0151] An activation function layer is used to perform a non-linear mapping on the fully connected features corresponding to each cross-chain contract to be detected, thereby generating the bytecode embedding corresponding to each cross-chain contract to be detected.

[0152] Furthermore, the unimodal student network includes convolutional modules, average pooling layers, fully connected layers, and activation function layers; the sixth submodule is specifically used for:

[0153] The convolution module performs convolution operations on the concatenated vectors corresponding to each cross-chain contract to be detected, and outputs the second concatenated convolution feature corresponding to each cross-chain contract to be detected.

[0154] An average pooling layer is used to perform average pooling on the second concatenated convolutional features corresponding to each cross-chain contract to be detected, thereby generating the second concatenated average pooled features corresponding to each cross-chain contract to be detected.

[0155] The source code information of the bytecode embeddings of each cross-chain contract to be detected is reconstructed to generate the reconstruction vector of each cross-chain contract to be detected.

[0156] The reconstruction vectors and second concatenated average pooling features corresponding to each cross-chain contract to be detected are concatenated to output the reconstruction concatenated vectors corresponding to each cross-chain contract to be detected.

[0157] The reconstructed splicing vectors corresponding to each cross-chain contract to be detected are used as inputs to the fully connected layer, and the fully connected vectors corresponding to each cross-chain contract to be detected are output.

[0158] An activation function layer is used to perform nonlinear mapping on the fully connected vectors corresponding to each cross-chain contract to be tested, and the vulnerability detection results corresponding to each cross-chain contract to be tested are output.

[0159] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, modules, and sub-modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0160] This invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program; when the computer program is executed by the processor, the processor performs the steps of the cross-chain contract vulnerability detection method as described in Embodiment 1 above.

[0161] This invention also provides a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements the steps of the cross-chain contract vulnerability detection method as described in Embodiment 1 above.

[0162] This invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the cross-chain contract vulnerability detection method as described in Embodiment 1 above.

[0163] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0164] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0165] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting cross-chain contract vulnerabilities, characterized in that, include: Multiple cross-chain contracts to be tested are obtained, and based on the pre-built expert mode, the pre-built fully connected network and program analysis technology are used to output the expert mode vector according to each cross-chain contract to be tested. Based on the contract bytecode, event logs and contract source code of each cross-chain contract to be tested, construct the cross-chain control flow graph and cross-chain data flow graph corresponding to each cross-chain contract to be tested. A pre-built cross-chain contract vulnerability detection model is used to detect each cross-chain contract to be detected based on the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected. The step of constructing a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested, based on the contract bytecode, event logs, and contract source code, includes: Based on the contract bytecode corresponding to each of the cross-chain contracts to be tested, multiple control flow graph nodes corresponding to each of the cross-chain contracts to be tested are determined. Based on the contract bytecode and event logs of each cross-chain contract to be tested, generate multiple control flow graph edges corresponding to each cross-chain contract to be tested. A cross-chain control flow graph corresponding to each of the cross-chain contracts to be tested is constructed using multiple control flow graph nodes and multiple control flow graph edges corresponding to each of the cross-chain contracts to be tested. Based on the contract source code corresponding to each of the cross-chain contracts to be tested, multiple data flow graph nodes and multiple data flow graph edges corresponding to each of the cross-chain contracts to be tested are determined. A cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested is constructed using multiple data flow graph nodes and multiple data flow graph edges corresponding to each of the cross-chain contracts to be tested. The pre-built cross-chain contract vulnerability detection model includes a pre-trained language network, a graph neural network, a bimodal teacher network, and a unimodal student network. The pre-built cross-chain contract vulnerability detection model is used to detect each cross-chain contract according to the expert mode vector, the cross-chain control flow graph, and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and outputs the vulnerability detection results for each cross-chain contract to be detected, including: The cross-chain data flow graphs corresponding to each of the cross-chain contracts to be tested are normalized, and the normalized cross-chain data flow graphs corresponding to each of the cross-chain contracts to be tested are output. The normalized cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested is input into the graph neural network, and the cross-chain data flow graph vector corresponding to each of the cross-chain contracts to be tested is output. The graph neural network and pre-trained language network are used to generate cross-chain control flow graph vectors corresponding to each cross-chain contract to be detected, based on the cross-chain control flow graphs corresponding to each cross-chain contract to be detected. The expert mode vector is concatenated with the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and the concatenated vector corresponding to each cross-chain contract to be detected is output. A bimodal teacher network is used to generate bytecode embeddings for each cross-chain contract to be detected based on the splicing vector and cross-chain data flow graph vector. The single-modal student network performs cross-chain contract vulnerability detection on each cross-chain contract to be detected based on the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be detected, and outputs the vulnerability detection results corresponding to each cross-chain contract to be detected.

2. The cross-chain contract vulnerability detection method according to claim 1, characterized in that, The method based on pre-defined expert patterns, employing pre-defined fully connected networks and program analysis techniques, outputs expert pattern vectors for each cross-chain contract to be tested, including: Based on the pre-built expert mode, the program analysis technology is used to judge the vulnerabilities of each of the cross-chain contracts to be tested, and outputs the cross-chain vulnerability mode corresponding to each of the cross-chain contracts to be tested. Each of the cross-chain vulnerability patterns corresponding to the cross-chain contracts to be tested is individually encoded to generate encoded data corresponding to each of the cross-chain contracts to be tested. The encoded data corresponding to each cross-chain contract to be tested is used as the input of a pre-set fully connected network, and an expert mode vector is output.

3. The cross-chain contract vulnerability detection method according to claim 1, characterized in that, The bimodal teacher network includes a convolutional module, an average pooling layer, a fully connected layer, and an activation function layer. The bimodal teacher network generates bytecode embeddings for each cross-chain contract to be detected based on the concatenation vector and cross-chain data flow graph vector, including: The convolution module performs convolution operations on the spliced ​​vector and cross-chain data flow graph vector corresponding to each cross-chain contract to be detected, and outputs the cross-chain data flow graph convolution features and the first spliced ​​convolution features corresponding to each cross-chain contract to be detected. An average pooling layer is used to perform average pooling on the convolutional features of the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected and the first concatenated convolutional features, to generate the average pooling features of the cross-chain data flow graph corresponding to each of the cross-chain contracts to be detected and the first concatenated average pooling features. The average pooling feature of the cross-chain data flow graph corresponding to each cross-chain contract to be detected and the first concatenated average pooling feature are concatenated to output the concatenated feature corresponding to each cross-chain contract to be detected. Each of the concatenated features corresponding to the cross-chain contracts to be detected is used as the input of the fully connected layer, and the fully connected features corresponding to each of the cross-chain contracts to be detected are output. An activation function layer is used to perform a non-linear mapping on the fully connected features corresponding to each cross-chain contract to be detected, thereby generating the bytecode embedding corresponding to each cross-chain contract to be detected.

4. The cross-chain contract vulnerability detection method according to claim 1, characterized in that, The unimodal student network includes a convolutional module, an average pooling layer, a fully connected layer, and an activation function layer. The unimodal student network performs cross-chain contract vulnerability detection on each cross-chain contract to be detected based on the bytecode embedding and concatenation vectors corresponding to each cross-chain contract to be detected, and outputs the vulnerability detection results for each cross-chain contract to be detected, including: The convolution module performs convolution operations on the concatenated vectors corresponding to each cross-chain contract to be detected, and outputs the second concatenated convolution feature corresponding to each cross-chain contract to be detected. An average pooling layer is used to perform average pooling on the second concatenated convolutional features corresponding to each of the cross-chain contracts to be detected, thereby generating the second concatenated average pooled features corresponding to each of the cross-chain contracts to be detected. The source code information of the bytecode embeddings corresponding to each cross-chain contract to be detected is reconstructed to generate a reconstruction vector corresponding to each cross-chain contract to be detected. The reconstruction vectors and second concatenated average pooling features corresponding to each cross-chain contract to be detected are concatenated to output the reconstruction concatenated vectors corresponding to each cross-chain contract to be detected. The reconstructed splicing vectors corresponding to each cross-chain contract to be detected are used as inputs to the fully connected layer, and the fully connected vectors corresponding to each cross-chain contract to be detected are output. An activation function layer is used to perform nonlinear mapping on the fully connected vectors corresponding to each cross-chain contract to be detected, and the vulnerability detection results corresponding to each cross-chain contract to be detected are output.

5. A cross-chain contract vulnerability detection device, characterized in that, include: The acquisition module is used to acquire multiple cross-chain contracts to be tested, and based on the pre-set expert mode, it uses a pre-set fully connected network and program analysis technology to output expert mode vectors according to each cross-chain contract to be tested; The construction module is used to construct the cross-chain control flow graph and cross-chain data flow graph corresponding to each cross-chain contract to be tested based on the contract bytecode, event log and contract source code of each cross-chain contract to be tested; The detection module is used to use a pre-set cross-chain contract vulnerability detection model to detect each cross-chain contract to be detected based on the expert mode vector, the cross-chain control flow graph and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and output the vulnerability detection results corresponding to each cross-chain contract to be detected. The step of constructing a cross-chain control flow graph and a cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested, based on the contract bytecode, event logs, and contract source code, includes: Based on the contract bytecode corresponding to each of the cross-chain contracts to be tested, multiple control flow graph nodes corresponding to each of the cross-chain contracts to be tested are determined. Based on the contract bytecode and event logs of each cross-chain contract to be tested, generate multiple control flow graph edges corresponding to each cross-chain contract to be tested. A cross-chain control flow graph corresponding to each of the cross-chain contracts to be tested is constructed using multiple control flow graph nodes and multiple control flow graph edges corresponding to each of the cross-chain contracts to be tested. Based on the contract source code corresponding to each of the cross-chain contracts to be tested, multiple data flow graph nodes and multiple data flow graph edges corresponding to each of the cross-chain contracts to be tested are determined. A cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested is constructed using multiple data flow graph nodes and multiple data flow graph edges corresponding to each of the cross-chain contracts to be tested. The pre-built cross-chain contract vulnerability detection model includes a pre-trained language network, a graph neural network, a bimodal teacher network, and a unimodal student network. The pre-built cross-chain contract vulnerability detection model is used to detect each cross-chain contract according to the expert mode vector, the cross-chain control flow graph, and the cross-chain data flow graph corresponding to each cross-chain contract to be detected, and outputs the vulnerability detection results for each cross-chain contract to be detected, including: The cross-chain data flow graphs corresponding to each of the cross-chain contracts to be tested are normalized, and the normalized cross-chain data flow graphs corresponding to each of the cross-chain contracts to be tested are output. The normalized cross-chain data flow graph corresponding to each of the cross-chain contracts to be tested is input into the graph neural network, and the cross-chain data flow graph vector corresponding to each of the cross-chain contracts to be tested is output. The graph neural network and pre-trained language network are used to generate cross-chain control flow graph vectors corresponding to each cross-chain contract to be detected, based on the cross-chain control flow graphs corresponding to each cross-chain contract to be detected. The expert mode vector is concatenated with the cross-chain control flow graph vector corresponding to each cross-chain contract to be detected, and the concatenated vector corresponding to each cross-chain contract to be detected is output. A bimodal teacher network is used to generate bytecode embeddings for each cross-chain contract to be detected based on the splicing vector and cross-chain data flow graph vector. The single-modal student network performs cross-chain contract vulnerability detection on each cross-chain contract to be detected based on the bytecode embedding and splicing vectors corresponding to each cross-chain contract to be detected, and outputs the vulnerability detection results corresponding to each cross-chain contract to be detected.

6. A computer device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the cross-chain contract vulnerability detection method as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the cross-chain contract vulnerability detection method as described in any one of claims 1-4.

8. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, wherein when the program instructions are executed by a computer, the computer performs the cross-chain contract vulnerability detection method as described in any one of claims 1-4.

Images