Intelligent contract malicious transaction detection and analysis method based on data dynamic storage

Abstract

The invention discloses an intelligent contract malicious transaction detection and analysis method based on data dynamic storage, and relates to the technical field of cloud computing, and the method comprises the steps: extracting transaction hash from a block, and obtaining transaction data from a block chain according to the transaction hash; performing synchronous simulation on the transaction data in the virtual machine to generate intermediate data; in a transaction simulation execution process, performing high-density dynamic storage on the intermediate data by adopting a DNA computing technology, establishing an index structure for quick retrieval, and reversely deducing a complete execution logic of the transaction; after data storage and logic inverse deduction are completed, a simulation execution task of a transaction is processed in parallel through distributed edge nodes, malicious transaction behaviors are identified through matching of an attack feature library, and a detection report is generated; according to the invention, by introducing a DNA calculation technology, high-density dynamic storage and rapid retrieval of intermediate data are realized; the simulation execution task of the transaction is processed in parallel through the distributed edge nodes, so that the malicious transaction detection efficiency is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage. Background Art

[0002] With the rapid development of blockchain technology, smart contracts have gradually become the basis of decentralized applications. However, since the code of smart contracts is transparent and automatically executed, malicious attackers often exploit vulnerabilities in smart contracts to attack, resulting in huge financial losses. Existing smart contract security analysis methods usually rely on static analysis and dynamic analysis tools, but these tools often have problems such as low accuracy, slow execution speed, and inability to fully capture malicious behavior.

[0003] The shortcomings of existing technologies in detecting malicious transactions in smart contracts are: first, the existing smart contract detection mechanism lacks an effective solution for the storage and retrieval of intermediate data, especially when a large number of transactions are executed, the bottleneck of data storage and management is more prominent. Secondly, when detecting malicious transaction behaviors, existing technologies often rely on single-node processing and fail to fully utilize the advantages of distributed computing, thus failing to quickly and effectively lock malicious transaction behaviors. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a smart contract malicious transaction detection and analysis method based on dynamic data storage to solve the problem of low accuracy in malicious transaction detection during the execution of smart contract transactions.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a method for detecting and analyzing malicious transactions in smart contracts based on dynamic data storage, which includes extracting a transaction hash from a block, and obtaining transaction data from the blockchain according to the transaction hash;

[0008] Simulate transaction data synchronously in a virtual machine to generate intermediate data;

[0009] During the transaction simulation execution process, DNA computing technology is used to store intermediate data in a high-density dynamic manner, establish an index structure for fast retrieval, and reverse the complete execution logic of the transaction;

[0010] After completing data storage and logic inversion, the simulated execution tasks of transactions are processed in parallel through distributed edge nodes, and malicious transaction behaviors are identified by matching the attack feature library;

[0011] Based on the test results, a test report is generated.

[0012] As a preferred solution of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage described in the present invention, the transaction data includes transaction bytecode, initiator, receiver, and transaction amount.

[0013] As a preferred solution of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage described in the present invention, the transaction data is synchronously simulated in a virtual machine to generate intermediate data, including the following steps:

[0014] Initialize the virtual machine environment;

[0015] Transaction data is mapped into virtual memory and registers. Transaction bytecode is decomposed into instructions. Transaction initiator, receiver and transaction amount are mapped into virtual states.

[0016] Using an instruction interpreter, each bytecode instruction is mapped into a specific operation, generating multiple potential execution paths. Considering the dynamic nature of smart contracts, each path represents a different logical branch.

[0017] Each bytecode instruction is interpreted and executed one by one through the virtual machine execution engine, and intermediate data including virtual memory status, virtual machine stack status, Gas consumption and external call results are recorded.

[0018] As a preferred solution of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage described in the present invention, DNA computing technology is used to perform high-density dynamic storage of intermediate data and establish an index structure for rapid retrieval, including the following steps:

[0019] During the transaction simulation execution, the intermediate data is split into small blocks suitable for DNA encoding, the encoding rules are defined, each data block is mapped to a DNA sequence, and a checksum and timestamp are added to each DNA sequence;

[0020] Compress a large amount of intermediate data into DNA sequences, design a dynamic storage and release mechanism, store data only when needed, and release storage resources in time after the intermediate data is used;

[0021] Generate a unique retrieval tag for each DNA sequence based on the content of the data block;

[0022] A hash algorithm is used to generate an index for each DNA sequence. Through the parallel retrieval capability of DNA computing, multiple DNA tags are compared simultaneously to find the DNA sequence that matches the query conditions, and the corresponding data blocks are quickly extracted to obtain an index structure for fast retrieval.

[0023] As a preferred solution of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage described in the present invention, the complete execution logic of the transaction is deduced based on the DNA sequence, including the following steps:

[0024] According to the timestamp in each DNA sequence, by analyzing the operation sequence of the bytecode, a logical sequential chain of execution is established to construct a preliminary execution path;

[0025] By analyzing the stack and memory state changes of each operation step, key state updates and intermediate calculation results are identified;

[0026] Parse control flow through bytecode instructions and identify conditional branches and loop structures;

[0027] Analyze all external contract calls during the transaction, track parameter passing, return values, and call logic;

[0028] Integrate the identification and analysis results into the preliminary execution path and reconstruct the execution path of the smart contract;

[0029] Based on the reconstruction of the execution path of the smart contract, the complete execution logic of the transaction can be deduced.

[0030] As a preferred solution of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage described in the present invention, the simulated execution task of the transaction is processed in parallel by distributed edge nodes, including the following steps:

[0031] Analyze the bytecode of the smart contract through static analysis tools, identify logical boundaries, and divide the bytecode instructions of the transaction into blocks based on the logical boundaries;

[0032] Assign task blocks to each node based on the computing power and current load of the edge node;

[0033] After receiving the task, each edge node starts to execute part of the bytecode simulation task of the transaction, and collects and stores edge execution data including stack status, memory status and function call status. During the execution process, data is synchronized between nodes through a collaborative mechanism.

[0034] As a preferred solution of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage described in the present invention, the malicious transaction behavior is identified by matching the attack feature library, including the following steps:

[0035] Define attack types, including reentrancy attacks, integer overflow / underflow, and unchecked external calls;

[0036] Extract potential attack patterns by simulating attack scenarios;

[0037] Input a large number of smart contract bytecodes into static analysis tools and extract the bytecode sequence of each vulnerability as attack features;

[0038] After the collected attack features are standardized, they are combined with attack modes and attack types and stored in a feature library to obtain an attack feature library;

[0039] Analyze edge execution data to detect abnormal behavior;

[0040] If there is no abnormal behavior in the detection, a detection report is directly generated;

[0041] If abnormal behavior is detected, the attack features in the attack feature library are used to match the edge execution data in real time, identify the attack mode, and lock down malicious transaction behavior.

[0042] As a preferred solution of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage described in the present invention, generating a detection report based on the detection results refers to listing the types of malicious transaction behaviors and the specific bytecode sequences where the exceptions occurred, displaying the stack depth, memory status, function call status and Gas consumption caused by the abnormal behavior when the exception occurred, and obtaining a detection report.

[0043] In a second aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as described in the first aspect of the present invention.

[0044] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as described in the first aspect of the present invention.

[0045] The beneficial effects of the present invention are as follows: by introducing DNA computing technology, high-density dynamic storage and rapid retrieval of intermediate data are achieved. DNA computing technology can not only compress and store intermediate data, but also realize reverse deduction and rapid retrieval of transaction execution logic through timestamp and hash index structure. This dynamic storage mechanism ensures that data can be quickly accessed when needed, and storage resources are released in time when not needed, thereby improving storage utilization. In addition, the efficiency of malicious transaction detection is greatly improved by parallel processing of simulated execution tasks of transactions by distributed edge nodes. Combined with real-time matching of the attack feature library, the present invention can identify malicious transaction behaviors more quickly and accurately, and generate detailed detection reports, greatly improving the security of smart contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0047] Figure 1 This is a flow chart of the method for detecting and analyzing malicious transactions in smart contracts based on dynamic data storage in Example 1.

[0048] Figure 2 This is a flow chart for identifying malicious transaction behavior in Example 1. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0050] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0051] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0052] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage, comprising the following steps:

[0053] S1. Extract the transaction hash from the block and obtain the transaction data from the blockchain according to the transaction hash, including the following steps:

[0054] Transaction data includes transaction bytecode, initiator, receiver, and transaction amount;

[0055] It should be noted that before obtaining transaction data, the blockchain needs to be synchronized. According to the current business scenario, select the appropriate block synchronization strategy, including full synchronization, incremental synchronization and specified height synchronization. Full synchronization refers to synchronizing all block information of the blockchain starting from the genesis block. It is suitable for initial startup or when the local blockchain status needs to be rebuilt. Incremental synchronization refers to starting from the last stopped position and only synchronizing the newly added block information. It is suitable for daily operation and can improve synchronization efficiency. Specified height synchronization refers to synchronizing data from a certain block height based on user input or configuration file. It is suitable for transaction analysis in a specific period.

[0056] It should be noted that by extracting transaction hashes from blocks and obtaining transaction data based on transaction hashes, the present invention can quickly locate and extract complete information related to a specific transaction, including transaction bytecode, initiator, recipient, transaction amount, etc. This precise positioning and data extraction mechanism provides basic data for subsequent transaction simulation and detection, ensuring that the analysis of each transaction is based on a real and complete data source, thereby improving the accuracy and reliability of the analysis.

[0057] S2. Synchronize the transaction data in the virtual machine to generate intermediate data, including the following steps:

[0058] A virtual machine is a technology that simulates a complete computer system through software (such as VirtualBox, Hyper-V (Microsoft virtualization technology), etc.), allowing multiple operating systems or applications to run on physical hardware, providing a hardware abstraction layer and isolation to improve resource utilization and system flexibility;

[0059] Initialize the virtual machine environment;

[0060] Specifically, start the virtual machine simulation execution unit, which is responsible for simulating the execution process of the smart contract in the virtual environment. The core modules of the virtual machine include virtual memory, register group, instruction interpreter and execution engine. This virtual machine environment needs to be able to fully simulate the smart contract execution mechanism in the blockchain network to ensure that each bytecode instruction can be accurately executed;

[0061] Transaction data is mapped to virtual memory and registers. The transaction bytecode is decomposed into instructions, which are ready to be interpreted and executed one by one in the virtual machine environment. The transaction initiator, recipient and transaction amount are mapped to the virtual state to ensure that the contract execution in the virtual environment is consistent with the actual transaction scenario.

[0062] Using an instruction interpreter, each bytecode instruction is mapped into a specific operation (such as calling a function, updating storage, transferring money, etc.), generating multiple potential execution paths. Considering the dynamic nature of smart contracts (such as conditional branches, loops, calling other contracts, etc.), each path represents a different logical branch.

[0063] The virtual machine execution engine interprets and executes each bytecode instruction one by one, and records intermediate data including virtual memory status, virtual machine stack status, gas consumption, and external call results;

[0064] Specifically, after each bytecode instruction is executed, the variables stored in the virtual memory, the contract's storage data, the account balance, etc. will change with the execution of the instruction. These changes are captured to ensure that the memory state of each path can be fully recorded. Each element in the stack represents the number of operations currently executed or the intermediate result. For example, when a smart contract executes an addition operation, the stack state before and after the addition operation is recorded to ensure that the execution process of each path is clearly visible. The Gas consumption of each path will be carefully tracked, and the Gas consumption of each bytecode instruction will be recorded to ensure that the economy of the simulated execution is consistent with the actual execution. If the Gas consumption of a path exceeds the Gas limit of the transaction, the path will be marked as failed and terminated. Continued execution, when a contract calls an external contract (such as through bytecode instructions such as CALL (call instruction in Ethereum virtual machine EVM), DELEGATECALL (delegate call instruction)), the detailed information of the external call is recorded, including the address of the called contract, the passed parameters, the return value and status (success or failure) of the call. External contract calls also consume Gas. The system records the Gas consumption of each external call and includes it in the total Gas consumption, tracks the return value of the external call, and determines the subsequent execution logic of the contract based on the return value. For example, some contracts rely on the return value of the external contract to execute conditional branches. The results of each external call will be recorded in detail to ensure that the call results affect the subsequent path execution.

[0065] It should be noted that synchronous simulation in a virtual machine can accurately simulate the execution process of smart contracts and generate detailed intermediate data, such as virtual memory status, stack status, gas consumption, and external call results. This refined simulation can not only reproduce the execution process of smart contracts in a real environment, but also help track the details of each step of the operation, thereby providing a complete execution path and status data for subsequent malicious transaction detection, significantly improving the ability to analyze complex contract logic.

[0066] S3. During the transaction simulation execution process, DNA computing technology is used to perform high-density dynamic storage of intermediate data, establish an index structure for fast retrieval, and reverse the complete execution logic of the transaction, including the following steps:

[0067] S3.1. During the transaction simulation execution process, the intermediate data is split into small blocks suitable for DNA encoding, and the encoding rules are defined. The specific encoding rules are to map 3 bits of binary data to 1 base, and map each data block to a DNA sequence. The binary information (0 and 1) in each data block will be mapped to the DNA base sequence (A, T, C, G), and a checksum and timestamp will be added to each DNA sequence. During the data storage and retrieval process, the checksum is used to verify the accuracy of the data and prevent errors;

[0068] It should be noted that DNA computing uses the four bases of DNA (A, T, C, G) as information storage carriers, which can achieve higher density than traditional storage devices;

[0069] Compress a large amount of intermediate data into DNA sequences to significantly reduce storage space usage. Design a dynamic storage and release mechanism to store data only when needed and release storage resources in a timely manner after the intermediate data is used or analyzed.

[0070] Generate a unique retrieval tag for each DNA sequence based on the content of the data block, transaction execution timestamp, or key logical node;

[0071] A hash algorithm is used to generate an index for each DNA sequence. Through the parallel retrieval capability of DNA computing, multiple DNA tags are compared simultaneously to find the DNA sequence that matches the query conditions, and the corresponding data blocks are quickly extracted to obtain an index structure for fast retrieval.

[0072] It should be noted that the use of DNA computing technology for high-density dynamic storage of intermediate data has greatly improved the density and efficiency of data storage. The storage capacity of DNA sequences far exceeds that of traditional storage media, and can decompose a large amount of intermediate data into small blocks and compress them. This not only solves the storage problem of a large amount of data generated during the execution of smart contracts, but also ensures that data can be quickly retrieved through index structures. The parallel retrieval capability of DNA computing can process multiple query requests at the same time, greatly improving the retrieval speed of intermediate data and providing technical support for real-time detection of malicious trading behavior.

[0073] S3.2, according to the timestamp in each DNA sequence, by analyzing the operation sequence of the bytecode, establish the logical sequence chain of execution and construct the preliminary execution path;

[0074] Specifically, all log data related to the execution of smart contracts is obtained through blockchain nodes or monitoring tools, including transaction timestamps, bytecode instructions for each operation, stack status, memory status, gas consumption, etc. Each operation step will have a timestamp to identify its order in the entire contract execution. By analyzing the operation sequence of the bytecode, a logical sequence chain of execution is established;

[0075] By analyzing the stack and memory state changes of each operation step, key state updates (such as storage writing, parameter passing) and intermediate calculation results are identified;

[0076] Specifically, it analyzes the stack changes of each operation step by step, tracks the depth changes of the stack, and records the key operands, monitors the changes of memory status, especially the writing, reading and modifying of memory, analyzes the dynamic data involved in the process, and determines the storage location of state variables and important memory operations;

[0077] Parse control flow through bytecodes (instructions such as JUMP or JUMPI (jump instructions or conditional jump instructions)) and identify conditional branches and loop structures;

[0078] Specifically, the JUMPI instruction is used to identify the conditional judgment in the contract, and the branch of the execution path is inferred through the conditional value in the stack. The JUMP instruction is used to identify the loop structure, analyze the boundary conditions and number of iterations of the loop, and determine the termination condition of the loop in combination with the stack changes;

[0079] Analyze all external contract calls during the transaction, track parameter passing, return values, and call logic;

[0080] Specifically, identify the bytecode instructions of the external call, determine the target address of the call, record the parameters passed to the external contract, analyze the return value of the call, and determine how the return value affects the subsequent logic, embed the external contract call into the main execution path, and ensure that the logic of the external call is consistent with the main contract logic;

[0081] Integrate the identification and analysis results into the preliminary execution path and reconstruct the execution path of the smart contract;

[0082] Based on the reconstruction of the execution path of the smart contract, the complete execution logic of the transaction can be deduced.

[0083] It should be noted that the reverse process helps to trace the source and execution path of malicious transaction behavior, especially in the face of complex contract attacks (such as reentrancy attacks or multi-layer nested calls). By analyzing each step in the execution path, the present invention can identify the specific location of malicious operations and their triggering conditions, providing strong technical support for the accurate detection and prevention of malicious transaction behaviors. This reverse analysis mechanism significantly improves the comprehensiveness and accuracy of transaction simulation, and helps to improve the security and reliability of smart contracts.

[0084] S4. After completing data storage and logic inversion, simulate the execution of transactions in parallel through distributed edge nodes, and identify malicious transaction behaviors through matching of attack feature libraries, including the following steps:

[0085] S4.1. Analyze the bytecode of the smart contract through static analysis tools (such as Slither (smart contract security analysis tool)), identify logical boundaries (such as functions, loops, conditional branches, etc.), and divide the bytecode instructions of the transaction into blocks based on the logical boundaries;

[0086] Specifically, the logical boundary includes structures such as functions, loops, and conditional branches. The entry point of a function is usually identified by a function selector (a 4-byte hash). In the bytecode, the selector of a function call can help us locate the starting position of a function. By identifying the entry and end points of a function, the bytecode can be divided into different function blocks. In the bytecode of a smart contract, conditional branches are usually implemented by the JUMPI instruction. JUMPI is a conditional jump instruction that determines whether to jump to a specified bytecode position based on the conditional value at the top of the stack. It identifies the starting and end points of conditional branches to ensure the integrity of the branch structure. Loops are usually used in combination with JUMP and JUMPI in bytecode. JUMP is an unconditional jump and is often used for back-jumping of loop bodies. By analyzing the target position of the JUMP instruction and the conditions for the jump, the loop structure can be identified, and the starting and end points of the loop and its conditional judgment can be identified. External contract calls in smart contracts are presented in the bytecode with corresponding instructions. Through these instructions, a contract can call another external contract, pass parameters, and receive return values. By identifying these instructions, the logic of external calls can be divided into separate blocks, which facilitates the analysis of cross-contract interaction logic.

[0087] According to the computing power and current load of the edge node, each node is assigned a task block. The goal of task allocation is to balance the load of each node and ensure the maximum efficiency of parallel execution.

[0088] After receiving the task, each edge node starts to execute part of the bytecode simulation task of the transaction, and collects and stores edge execution data including stack status, memory status and function call status. During the execution process, the nodes synchronize data through a collaborative mechanism to ensure the state consistency between task blocks. Each edge node generates edge execution data when executing bytecode, and uses a distributed hash table to manage the storage and sharing of edge execution data. The collaborative mechanism means that when a node needs to access the edge execution data of other nodes, it sends a data request through the DHT mechanism. In the case of cross-block dependencies, each node will regularly synchronize the execution status of its task block (such as the current stack and memory status) to other nodes that depend on the data.

[0089] It should be noted that by processing the simulated execution tasks of transactions in parallel through distributed edge nodes, the present invention can make full use of the computing resources of multiple nodes to realize the parallel processing of some tasks of transaction bytecode. This distributed computing mode avoids the performance bottleneck of single node processing and significantly improves the processing efficiency of transaction simulation, especially when facing a large number of transaction tasks, it can effectively shorten the simulation execution time. In addition, the coordination mechanism between edge nodes ensures data synchronization and consistency, and ensures the accuracy of simulation processing. S4.2. Define attack types, including reentrancy attacks, integer overflow / underflow, and unchecked external calls;

[0090] Extract potential attack patterns by simulating attack scenarios;

[0091] Input the bytecodes of a large number of smart contracts into the static analysis tool, output the vulnerability information of each contract, including the vulnerability type, the bytecode sequence that occurred, and related memory, stack, gas consumption and other information, and extract the bytecode sequence of each vulnerability as the attack feature;

[0092] After the collected attack features are standardized, they are combined with attack modes and attack types and stored in a feature library to obtain an attack feature library;

[0093] Specifically, the stack state includes collecting the current stack depth, the type and order of operands. Stack operations are crucial in the contract execution process. Any abnormal stack behavior may indicate a potential attack, such as a stack overflow or an unexpected operand change. The memory state includes recording the variable values ​​in the memory and their changes. By monitoring the memory state, abnormal behaviors such as illegal memory access and unauthorized data modification can be detected. Function calls refer to tracking external function calls, especially unchecked return values. Unchecked external function calls may lead to attack behaviors (such as reentrancy attacks).

[0094] Analyze edge execution data to detect abnormal behavior;

[0095] If there is no abnormal behavior in the detection, a detection report is directly generated;

[0096] If abnormal behavior is detected, the attack features in the attack feature library are used to match the edge execution data in real time, identify the attack mode, and lock the malicious transaction behavior;

[0097] Specifically, the characteristic of a reentrancy attack is that when a contract calls an external contract, the external contract calls the original contract again, resulting in the status not being updated in time. Reentrancy attack detection is achieved by monitoring the function call stack. If the function call is not completed and is called again, the reentrancy attack detection is triggered, the reentrancy attack is identified and the transaction simulation is terminated; the characteristic of integer overflow / underflow is that when the result of an arithmetic operation exceeds the representable range of the data type, integer overflow detection is achieved by monitoring the result of each arithmetic operation, checking whether the result exceeds the boundary of the data type, identifying the integer overflow and recording the exception; the characteristic of an unchecked external call is that after the contract calls an external contract, the return value is not checked. Unchecked external calls are achieved by monitoring the return value of each external call. If the return value is not checked, it is marked as a potential attack behavior, the unchecked call is identified and the developer is prompted to fix it.

[0098] It should be noted that, through the matching of the attack feature library, the present invention can quickly identify potential malicious behaviors in transactions. The features in the attack feature library are based on in-depth analysis and standardized extraction of malicious transaction patterns, and can accurately match abnormal patterns that occur during transaction execution. Combined with real-time transaction simulation and intermediate data analysis, it is possible to timely detect attack behaviors such as reentrancy attacks and integer overflows during transaction execution, significantly improving the accuracy and response speed of malicious transaction detection and enhancing the security of smart contracts.

[0099] S5. Based on the detection results, generating a detection report means listing the type of malicious transaction behavior and the specific bytecode sequence where the exception occurred, displaying the stack depth, memory status, function call status and Gas consumption caused by the abnormal behavior when the exception occurred, and obtaining a detection report.

[0100] It should be noted that by generating a detection report based on the detection results, the present invention can provide detailed and accurate detection feedback. The report not only lists the types of malicious transaction behaviors, but also displays the specific bytecode sequence, stack depth, memory status, function call status, and Gas consumption when the exception occurs. Through this detailed report, users can clearly understand the specific details and scope of the attack, thereby providing a basis for subsequent security protection or vulnerability repair, greatly improving the auditability and transparency of smart contracts.

[0101] This embodiment also provides a computer device, which is suitable for the case of a method for detecting and analyzing malicious transactions in smart contracts based on dynamic data storage, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions, thereby implementing the method for detecting and analyzing malicious transactions in smart contracts based on dynamic data storage as proposed in the above embodiment.

[0102] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0103] The present embodiment also provides a storage medium on which a computer program is stored. When the program is executed by the processor, the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, disk or optical disk.

[0104] In summary, the present invention achieves high-density dynamic storage and rapid retrieval of intermediate data by: introducing DNA computing technology. DNA computing technology can not only compress and store intermediate data, but also realize reverse deduction and rapid retrieval of transaction execution logic through timestamp and hash index structure. This dynamic storage mechanism ensures that data can be quickly accessed when needed, and storage resources are released in time when not needed, thereby improving storage utilization. In addition, the efficiency of malicious transaction detection is greatly improved by parallel processing of simulated execution tasks of transactions by distributed edge nodes. Combined with real-time matching of the attack feature library, the present invention can identify malicious transaction behaviors more quickly and accurately, and generate detailed detection reports, greatly improving the security of smart contracts.

[0105] Example 2, referring to Table 1, is the second example of the present invention. In order to further verify the technical solution of the present invention, experimental simulation data of the smart contract malicious transaction detection and analysis method based on dynamic data storage is provided.

[0106] In order to evaluate the effectiveness of the smart contract malicious transaction detection and analysis method based on dynamic data storage, a comparative experiment between the experimental group and the control group was designed. The experimental group used the smart contract malicious transaction detection method based on DNA computing technology to store and reverse analyze the transaction data of the smart contract; the control group used the conventional detection method based on logging and static analysis. The experimental objects were transaction data on two smart contract platforms, and malicious transaction behaviors such as reentrancy attacks and integer overflow attacks were simulated respectively.

[0107] In the experimental preparation stage, the corresponding transaction hash was first extracted from the blockchain network, and the complete transaction data was obtained based on the hash value, including basic information such as transaction bytecode, initiator, receiver, and transaction amount. In the experimental group, a virtual machine was used to synchronize the transaction data and generate detailed intermediate data. Subsequently, DNA computing technology was used to store the intermediate data in a high-density dynamic manner, and the corresponding index and checksum were generated through the DNA sequence to ensure that the data can be quickly retrieved in subsequent steps. At the same time, based on the timestamp and content of the DNA sequence, the complete execution logic of the transaction was reversed.

[0108] After the storage and reverse inference were completed, the experimental group used distributed edge nodes to parallel process the simulated execution of transactions, combined with features such as reentrancy attacks and integer overflows in the attack feature library, to accurately identify malicious transactions and generate relevant detection reports. The control group relied on traditional logging and static analysis tools to gradually parse and detect transaction data. During the experiment, key parameters such as data storage efficiency, transaction execution logic reverse inference time, and malicious transaction detection time were recorded for each group.

[0109] The details are shown in Table 1 below:

[0110] Table 1 Experimental record table

[0111]

[0112]

[0113] By comparing the data of the experimental group and the control group in Table 1, it can be clearly seen that the experimental group's smart contract malicious transaction detection method using DNA computing technology has shown significant advantages in all key parameters. First, in terms of data storage efficiency, the experimental group achieved a storage efficiency of 450MB per second by using DNA computing technology to compress intermediate data with high density, which is 125% higher than the 200MB of the control group. This significant improvement is due to the storage and retrieval capabilities of DNA computing technology for large-scale data, which greatly optimizes the storage problem of a large amount of intermediate data generated during the transaction simulation process.

[0114] Secondly, the reverse time of transaction execution logic was only 15 seconds in the experimental group, while the control group needed 35 seconds. The experimental group was able to quickly deduce the complete execution path of the transaction through the index structure of timestamps and DNA sequences, which greatly reduced the time cost of reverse analysis and improved efficiency.

[0115] In terms of malicious transaction detection time, the experimental group performed better, taking only 8 seconds to complete the identification of malicious transactions, while the control group took 25 seconds. The experimental group significantly improved the speed and accuracy of detection by processing tasks in parallel through distributed edge nodes and combining real-time matching of attack feature libraries. In terms of memory usage, the storage mechanism of the experimental group was more efficient, occupying only 300MB of memory, while the control group required 700MB, which shows that DNA computing technology is more resource-efficient in data management.

[0116] In addition, the experimental group achieved a retrieval speed of 5,000 data blocks per second for intermediate data, while the control group only achieved 2,000, showing the strong advantages of DNA computing technology in parallel retrieval capabilities. In terms of malicious transaction identification accuracy, the experimental group reached 98%, while the control group only achieved 70%, further proving the high accuracy of the present invention in malicious transaction detection.

[0117] In summary, the method for detecting malicious transactions in smart contracts based on DNA computing technology of the present invention has significant advantages in data storage efficiency, reverse time, detection time and resource occupation, especially in real-time identification and detection accuracy of malicious transactions, showing strong innovation and novelty. These advantages not only effectively solve the problem of low data storage and analysis efficiency in existing detection methods, but also significantly improve the accuracy and speed of malicious transaction detection in smart contracts, providing a strong technical guarantee for the security of smart contracts.

[0118] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage, characterized in that: include, Extract the transaction hash from the block and obtain the transaction data from the blockchain based on the transaction hash; Simulate transaction data synchronously in a virtual machine to generate intermediate data; During the transaction simulation execution process, DNA computing technology is used to store intermediate data in a high-density dynamic manner, establish an index structure for fast retrieval, and reverse the complete execution logic of the transaction; After completing data storage and logic inversion, the simulated execution tasks of transactions are processed in parallel through distributed edge nodes, and malicious transaction behaviors are identified by matching the attack feature library; Based on the test results, a test report is generated.

2. The method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as claimed in claim 1, characterized in that: The transaction data includes transaction bytecode, initiator, recipient and transaction amount.

3. The method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as claimed in claim 2, characterized in that: The transaction data is synchronously simulated in the virtual machine to generate intermediate data, including the following steps: Initialize the virtual machine environment; Map transaction data to virtual memory and registers. The transaction bytecode is decomposed into instructions, and the transaction initiator, receiver, and transaction amount are mapped to virtual states. Using an instruction interpreter, each bytecode instruction is mapped into a specific operation, generating multiple potential execution paths. Considering the dynamic nature of smart contracts, each path represents a different logical branch. Each bytecode instruction is interpreted and executed one by one through the virtual machine execution engine, and intermediate data including virtual memory status, virtual machine stack status, Gas consumption and external call results are recorded.

4. The method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as claimed in claim 3, characterized in that: DNA computing technology is used to store intermediate data in a high-density dynamic manner and to establish an index structure for fast retrieval, including the following steps: During the transaction simulation execution, the intermediate data is split into small blocks suitable for DNA encoding, the encoding rules are defined, each data block is mapped to a DNA sequence, and a checksum and timestamp are added to each DNA sequence; Compress a large amount of intermediate data into DNA sequences, design a dynamic storage and release mechanism, store data only when needed, and release storage resources in time after the intermediate data is used; Generate a unique retrieval tag for each DNA sequence based on the content of the data block; A hash algorithm is used to generate an index for each DNA sequence. Through the parallel retrieval capability of DNA computing, multiple DNA tags are compared simultaneously to find the DNA sequence that matches the query conditions, and the corresponding data blocks are quickly extracted to obtain an index structure for fast retrieval.

5. The method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as claimed in claim 4, characterized in that: Based on the DNA sequence, the complete execution logic of the transaction is deduced, including the following steps: According to the timestamp in each DNA sequence, by analyzing the operation sequence of the bytecode, a logical sequential chain of execution is established to construct a preliminary execution path; By analyzing the stack and memory state changes of each operation step, key state updates and intermediate calculation results are identified; Parse control flow through bytecode instructions and identify conditional branches and loop structures; Analyze all external contract calls during the transaction, track parameter passing, return values, and call logic; Integrate the identification and analysis results into the preliminary execution path and reconstruct the execution path of the smart contract; Based on the reconstruction of the execution path of the smart contract, the complete execution logic of the transaction can be deduced.

6. The method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as claimed in claim 5, characterized in that: The simulated execution task of parallel processing of transactions by distributed edge nodes includes the following steps: Analyze the bytecode of the smart contract through static analysis tools, identify logical boundaries, and divide the bytecode instructions of the transaction into blocks based on the logical boundaries; Assign task blocks to each node based on the computing power and current load of the edge node; After receiving the task, each edge node starts to execute part of the bytecode simulation task of the transaction, and collects and stores edge execution data including stack status, memory status and function call status. During the execution process, data is synchronized between nodes through a collaborative mechanism.

7. The method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as claimed in claim 6, characterized in that: By matching the attack feature library, malicious transaction behaviors are identified, including the following steps: Define attack types, including reentrancy attacks, integer overflow / underflow, and unchecked external calls; Extract potential attack patterns by simulating attack scenarios; Input a large number of smart contract bytecodes into static analysis tools and extract the bytecode sequence of each vulnerability as attack features; After the collected attack features are standardized, they are combined with attack modes and attack types and stored in a feature library to obtain an attack feature library; Analyze edge execution data to detect abnormal behavior; If there is no abnormal behavior in the detection, a detection report is directly generated; If abnormal behavior is detected, the attack features in the attack feature library are used to match the edge execution data in real time, identify the attack mode, and lock down malicious transaction behavior.

8. The method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as claimed in claim 7, characterized in that: Based on the detection results, generating a detection report means listing the type of malicious transaction behavior and the specific bytecode sequence where the exception occurred, displaying the stack depth, memory status, function call status and Gas consumption caused by the abnormal behavior when the exception occurred, and obtaining a detection report.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as described in any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the method for detecting and analyzing malicious transactions of smart contracts based on dynamic data storage as described in any one of claims 1 to 8 are implemented.

Images