Intelligent contract vulnerability detection tool evaluation method and system based on neural network

Abstract

The invention discloses an intelligent contract vulnerability detection tool evaluation method and system based on a neural network, and the method comprises the following steps: S1, carrying out the recognition and preprocessing of an intelligent contract, and obtaining the features and labels of the intelligent contract; s2, constructing a neural network model suitable for intelligent contract detection; s3, learning features of the smart contract by using a neural network model and predicting a tool result; and S4, setting an evaluation strategy of the intelligent contract vulnerability detection tool, and obtaining a prediction result. According to the method, multiple tools are used for detecting the vulnerability of the intelligent contract, the accuracy and comprehensiveness are improved, more types and scenes are covered, risks are reduced, through feature extraction and neural network learning, an intelligent evaluation model is constructed, the tool effect is automatically evaluated, a proper tool is recommended, the efficiency is improved, and the cost is reduced. The feedback module continuously collects samples and results, discovers defects, optimizes and improves the defects, improves the tool accuracy and efficiency, promotes the technical progress, and guarantees the healthy development of the block chain.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and more specifically, particularly relates to a method for evaluating a smart contract vulnerability detection tool based on a neural network. At the same time, the present invention also relates to a system for evaluating a smart contract vulnerability detection tool based on a neural network. Background Art

[0002] Blockchain smart contracts are being widely used, and the digital assets they carry are also increasing. A large amount of digital assets attracts hackers to attack in order to illegally gain economic benefits. Exploiting smart contract vulnerabilities is a common way hackers attack smart contracts.

[0003] In order to detect smart contract vulnerabilities in time before smart contracts are deployed and help smart contract developers to fix vulnerabilities in time, researchers have developed smart contract vulnerability detection tools. Since the first smart contract vulnerability detection tool came out in 2016, more than 200 smart contract vulnerability detection tools have been developed. According to different detection methods, smart contract vulnerability detection tools can be roughly divided into two categories: static smart contract vulnerability detection tools and dynamic smart contract vulnerability detection tools. The difference between the two is whether smart contracts need to be deployed during the detection process.

[0004] However, there are some problems with the existing technology: as more and more smart contract vulnerability detection tools are available, the detection methods are also becoming more diversified. However, the diverse tools lack a unified management. Since users do not understand the detection principles of the tools, they do not know how to choose the most suitable smart contract vulnerability detection tool. Moreover, due to the diversity of smart contracts, they do not know how to choose the most suitable vulnerability detection tool for a smart contract. Therefore, we propose a smart contract vulnerability detection tool evaluation method and system based on neural networks. Summary of the invention

[0005] In view of the problems existing in the prior art, the purpose of the present invention is to provide a method and system for evaluating smart contract vulnerability detection tools based on neural networks. The present invention uses multiple tools to detect smart contract vulnerabilities, improves accuracy and comprehensiveness, covers more types and scenarios, reduces risks, and constructs an intelligent evaluation model through feature extraction and neural network learning, automatically evaluates tool effects, recommends appropriate tools, improves efficiency, and reduces costs. The feedback module continuously collects samples and results, finds deficiencies and optimizes and improves them, improves tool accuracy and efficiency, promotes technological progress, and ensures the healthy development of blockchain.

[0006] To achieve the above object, the present invention provides the following technical solution: a method for evaluating a smart contract vulnerability detection tool based on a neural network, comprising the following steps:

[0007] S1, identify and preprocess the smart contract to obtain its features and labels;

[0008] S2, building a neural network model suitable for smart contract detection;

[0009] S3, uses neural network models to learn smart contract features and predict tool results;

[0010] S4, set the evaluation strategy of the smart contract vulnerability detection tool and obtain the prediction results.

[0011] Optionally, the specific process of step S1 includes:

[0012] S11, compile the smart contract source code into bytecode, and then use decompilation technology to extract the operation code sequence from the bytecode;

[0013] S12, extracting features from the operation code sequence, and generating a feature sequence that can represent the features of the smart contract by analyzing information such as the correlation and occurrence frequency between the operation codes;

[0014] S13, use a variety of smart contract vulnerability detection tools to test the smart contract, and assign corresponding labels to the tested contracts based on the test results.

[0015] Optionally, the extraction operation code sequence is specifically as follows: first, obtaining the smart contract source code from the blockchain;

[0016] Then use the compilation tool to compile the smart contract source code into bytecode, or use the decompilation tool to decompile the bytecode into an opcode sequence;

[0017] Every two consecutive opcodes in the opcode sequence are regarded as a feature pair, and a unique identifier is assigned to each feature pair to ensure that the feature pair has a unique position in the feature vector;

[0018] Create a feature vector whose length is equal to the number of possible feature pairs. If the feature pair appears in the opcode sequence, the corresponding element is 1, otherwise it is 0;

[0019] Traverse all smart contracts in the data set, count the frequency of each feature pair in all smart contracts, delete those feature pairs that have never appeared in all smart contracts, record them as rare feature pairs, update the feature vector based on the results after deleting the rare feature pairs, and finally output the feature vector of the smart contract.

[0020] Optionally, the opcode sequence is an instruction sequence used in the execution of the smart contract, and each element of the feature vector corresponds to whether a feature pair appears in the opcode sequence.

[0021] Optionally, the specific process of step S13 is: collecting multiple smart contract vulnerability detection tools;

[0022] Configure the test environment on the server, including installing test tools and setting up the test network;

[0023] Analyze test results and detect possible problems or vulnerabilities in smart contracts;

[0024] According to the test results and the characteristics of the smart contract, determine the label category and assign corresponding labels to the contract to be tested.

[0025] Finally, the assigned label information is recorded in a database or stored in a file;

[0026] The functions of the detection tool cover the main aspects of smart contract testing, including functional testing, boundary testing, exception testing and security testing.

[0027] Optionally, the specific label assigned to the contract to be tested is:

[0028] 1) Manually pre-label the correct labels and set them as correct results;

[0029] 2) Obtain the test results of smart contracts using different testing tools;

[0030] 3) Match and combine the detection results with the preset labels to obtain the final labels;

[0031] 4) Label: 0 means no vulnerability, 1 means there is a vulnerability.

[0032] Optionally, the specific process of step S2 is:

[0033] S21, obtain a large amount of smart contract data from the blockchain platform, pre-process the data, and divide the data into training set, verification set and test set;

[0034] S22, determining the neural network architecture according to the characteristics of the smart contract data, and using representation learning technology to convert the smart contract data into feature vectors that can be processed by the neural network;

[0035] S23, set training parameters, use the training set for training and back-propagation optimization, and adjust model parameters based on the validation set evaluation;

[0036] S24, using the validation set data to validate the model, and adjusting the model parameters, testing the model through the test set data, and evaluating the overall performance and effect of the model when processing the test data;

[0037] S25, deploy the trained model to the server, continuously collect new data, and update and optimize the model.

[0038] Optionally, the specific process of step S4 is:

[0039] S41, analyze the contract version and select the tool that supports this version;

[0040] S42, put the contract into the model corresponding to each tool to predict the result;

[0041] S43, combining the prediction results with the average test time, calculating the tool score, and selecting the tool with the highest score for recommendation;

[0042] S44, finally displaying the tool name, prediction result and detection time to the user.

[0043] The formula for calculating the tool score is:

[0044]

[0045] Among them: Score is the final score of the tool;

[0046] W1 and W2: represent the weight coefficients of the prediction result and the average test time respectively, and the sum of W1 and W2 is 1;

[0047] TP: the probability that the tool predicts a true positive result;

[0048] TN: probability that the tool predicts a true negative result;

[0049] FP: the probability that the tool predicts a false positive result;

[0050] FN: The probability that the tool predicts a false negative result;

[0051] Time: time measurement;

[0052] Min: minimum time value;

[0053] Max: Maximum value of time.

[0054] A neural network-based smart contract vulnerability detection tool evaluation system, the system is used to implement the above method, including a server;

[0055] The server includes a preprocessing module, a label generation module, a neural network model, a model verification module, a feedback module, a storage module, a user interaction module and a control unit;

[0056] The preprocessing module is responsible for compiling the smart contract source code into bytecode, extracting the opcode sequence, generating feature vectors, and dividing the data set;

[0057] Label generation module: Test smart contracts by executing a variety of smart contract vulnerability detection tools and assign corresponding labels based on the test results;

[0058] Neural network model: determine the neural network architecture, convert smart contract data into feature vectors, train and optimize the model;

[0059] Model verification module: Use the verification set and test set data to verify and test the model, adjust the model parameters, and evaluate the performance indicators and operating performance of the model. Finally, deploy the trained model to the server.

[0060] Feedback module: collects model prediction results and user feedback to optimize the model and improve performance, and continuously collects new data to update and optimize the model;

[0061] User interface and interaction module: provides a user interaction interface to support users to upload smart contracts, view test results and model prediction results;

[0062] Control unit: configures the test environment, manages the workflow of each module, coordinates data exchange and communication between modules, and ensures smooth operation of the overall system.

[0063] Optionally, the neural network model includes: an input layer, an LSTM layer, a pooling layer, a fully connected layer and an output layer

[0064] The input layer is responsible for receiving and processing the original time series data, wherein the time series data is usually composed of multiple time series, wherein the time series is the length of the operation code sequence, wherein each time series contains multiple features;

[0065] The LSTM layer is responsible for processing the opcode sequence and outputting the hidden state;

[0066] The pooling layer selects features that are more relevant to the vulnerability from the hidden state sequence output by the LSTM;

[0067] The fully connected layer uses the Softmax function to map the high-dimensional vector into the final output form;

[0068] The output layer is used to output the final result, and the output result is a four-dimensional vector including TP, TN, FP, and FN, and the sum of TP, TN, FP, and FN is 1.

[0069] Technical effects and advantages of the present invention: The present invention uses a variety of smart contract vulnerability detection tools and fully utilizes the advantages of different detection tools to improve the accuracy and comprehensiveness of vulnerability detection, cover more vulnerability types and scenarios, reduce the risk of missed reports and false positives, and construct an intelligent detection capability evaluation model through feature extraction and neural network learning, thereby automatically evaluating the detection effects of different tools in specific scenarios, recommending the most suitable detection tools to users, improving detection efficiency, and reducing the difficulty and cost of user tool selection;

[0070] Secondly, the feedback module continuously collects and analyzes new smart contract samples and their test results, promptly discovers the deficiencies of existing detection tools and models, and makes targeted optimizations and improvements, thereby improving the accuracy and efficiency of detection tools.

[0071] Further features and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments of the present invention with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 is a flow chart of the method provided by the present invention;

[0073] Figure 2 It is a schematic diagram of the relationship between the source code, bytecode and operation code provided by the present invention;

[0074] Figure 3 It is a schematic diagram of label assignment provided by the present invention;

[0075] Figure 4 is a schematic diagram of a tool evaluation mechanism provided by the present invention;

[0076] Figure 5 It is a schematic diagram comparing the accuracy of various tools provided by the present invention. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0078] like Figures 1 to 5 As shown, the neural network-based smart contract vulnerability detection tool evaluation method provided by the embodiment of the present invention includes the following steps:

[0079] S1, identify and preprocess the smart contract to obtain its features and labels;

[0080] S2, building a neural network model suitable for smart contract detection;

[0081] S3, uses neural network models to learn smart contract features and predict tool results;

[0082] S4, set the evaluation strategy of the smart contract vulnerability detection tool and obtain the prediction results.

[0083] Specifically, the specific process of step S1 includes:

[0084] S11, compile the smart contract source code into bytecode, and then use decompilation technology to extract the operation code sequence from the bytecode;

[0085] like Figure 2 As shown in the figure, it shows the relationship between the Solidity source code, bytecode and opcode of the smart contract. Solidity is the source code of the smart contract. Its syntax is similar to JavaScript and is written by the smart contract developer. However, the source code of the smart contract cannot be directly processed by the Ethereum virtual machine and needs to be compiled into bytecode using a compiler. The bytecode consists of opcodes and operands, but it is not suitable for human reading. In order to read and process opcodes more intuitively, the bytecode is usually decompiled into an opcode sequence.

[0086] Specifically, S12, extracting features from the operation code sequence, and generating a feature sequence that can represent the features of the smart contract by analyzing information such as the correlation and occurrence frequency between the operation codes;

[0087] S13, use a variety of smart contract vulnerability detection tools to test the smart contract, and assign corresponding labels to the tested contracts based on the test results.

[0088] Furthermore, by extracting the opcode sequence from the bytecode and performing feature extraction, we can gain a deeper understanding of the behavior patterns of smart contracts, thereby more accurately identifying potential security risks. Testing with a variety of detection tools can cover multiple aspects of smart contract security and reduce the risk of missed reports and false positives. Through feature extraction and neural network learning, we can build an intelligent detection capability evaluation model to automatically evaluate the detection effects of different tools in specific scenarios, thereby quickly recommending the most suitable detection tool to users and improving detection efficiency.

[0089] Furthermore, the impact of compiler versions on the performance of smart contract vulnerability detection tools is a crucial consideration that cannot be ignored. Different versions of compilers introduce new features, optimize performance, and fix old vulnerabilities while also changing the bytecode generation mechanism of smart contracts. Given that many vulnerability detection tools rely on bytecode or syntax parsing generated by a specific compiler version, the performance of these tools may be significantly affected when processing different versions of smart contracts.

[0090] In view of the above situation, vulnerability detection tools must be adapted to different versions of compilers during development and actual application, and even their vulnerability detection rule base must be updated to ensure that high detection accuracy can be maintained for all versions of smart contracts. This implementation integrates multiple smart contract vulnerability detection tools and can predict the detection results of smart contract vulnerability detection tools under existing mainstream compiler versions, thereby demonstrating its excellent flexibility and adaptability.

[0091] Specifically, the extraction operation code sequence is as follows: first, obtain the smart contract source code from the blockchain;

[0092] Then use the compilation tool to compile the smart contract source code into bytecode, or use the decompilation tool to decompile the bytecode into an opcode sequence;

[0093] Every two consecutive opcodes in the opcode sequence are regarded as a feature pair, and a unique identifier is assigned to each feature pair to ensure that the feature pair has a unique position in the feature vector;

[0094] Create a feature vector whose length is equal to the number of possible feature pairs. If the feature pair appears in the opcode sequence, the corresponding element is 1, otherwise it is 0;

[0095] Traverse all smart contracts in the data set, count the frequency of each feature pair in all smart contracts, delete those feature pairs that have never appeared in all smart contracts, record them as rare feature pairs, update the feature vector based on the results after deleting the rare feature pairs, and finally output the feature vector of the smart contract.

[0096] Specifically, the opcode sequence is an instruction sequence used in the execution of the smart contract, and each element of the feature vector corresponds to whether a feature pair appears in the opcode sequence.

[0097] Furthermore, by converting the opcode sequence of the smart contract into a feature vector, the complex smart contract analysis task is simplified to the processing of the feature vector, which improves the analysis efficiency and allows the rapid processing of large amounts of smart contract data. By deleting rare feature pairs and updating the feature vector, the redundant information in the feature vector is reduced, allowing the model to pay more attention to the features that have an important impact on the behavior of the smart contract, thereby enhancing the generalization ability of the model and enabling it to more accurately identify the differences between different smart contracts.

[0098] Specifically, the specific process of step S13 is: collecting multiple smart contract vulnerability detection tools;

[0099] Configure the test environment on the server, including installing test tools and setting up the test network;

[0100] Analyze test results and detect possible problems or vulnerabilities in smart contracts;

[0101] According to the test results and the characteristics of the smart contract, determine the label category and assign corresponding labels to the contract to be tested.

[0102] Finally, the assigned label information is recorded in a database or stored in a file;

[0103] The functions of the detection tool cover the main aspects of smart contract testing, including functional testing, boundary testing, exception testing and security testing.

[0104] Specifically, the corresponding labels assigned to the contract to be tested are:

[0105] 1) Manually pre-label the correct labels and set them as correct results;

[0106] 2) Obtain the test results of smart contracts using different testing tools;

[0107] 3) Match and combine the detection results with the preset labels to obtain the final labels;

[0108] 4) Label: 0 means no vulnerability, 1 means there is a vulnerability.

[0109] like Figure 3 As shown, 0 represents no vulnerability and 1 represents a vulnerability: First, for a smart contract, manual labeling is required, and manual labeling is considered to be the correct result;

[0110] Secondly, different smart contract vulnerability detection tools are used to detect smart contracts and obtain their detection results. Finally, the two labels are combined to obtain the final label. In addition, in order to better evaluate the tools, the average detection time and supported smart contract versions of different tools are collected.

[0111] Specifically, the specific process of step S2 is:

[0112] S21, obtain a large amount of smart contract data from the blockchain platform, pre-process the data, and divide the data into training set, verification set and test set;

[0113] S22, determining the neural network architecture according to the characteristics of the smart contract data, and using representation learning technology to convert the smart contract data into feature vectors that can be processed by the neural network;

[0114] S23, set training parameters, use the training set for training and back-propagation optimization, and adjust model parameters based on the validation set evaluation;

[0115] S24, using the validation set data to validate the model, and adjusting the model parameters, testing the model through the test set data, and evaluating the overall performance and effect of the model when processing the test data;

[0116] S25, deploy the trained model to the server, continuously collect new data, and update and optimize the model.

[0117] Furthermore, by simulating the learning mechanism of the human brain, neural network learning can deeply analyze the complex logic and behavior patterns of smart contracts, automatically discover potential vulnerabilities and abnormal transaction patterns, and not only improve the efficiency of smart contract security detection, but also update detection strategies in real time to deal with new vulnerabilities. In addition, neural networks can also predict the performance and reliability of smart contracts based on historical data, providing strong support for the optimization and decision-making of smart contracts;

[0118] Furthermore, this embodiment demonstrates a high degree of scalability. Specifically, at the tool level, whenever a new smart contract vulnerability detection tool is released, we only need to use the tool to annotate the smart contract and train the neural network model accordingly, and then we can easily integrate it into this embodiment, thereby achieving seamless expansion at the tool level;

[0119] Furthermore, at the compiler version level, as the smart contract compiler version is updated and iterated, as long as the existing tools can support the processing of the new version of the smart contract, this embodiment can also maintain compatibility and support for the new version to ensure continuous and stable operation. In addition, at the vulnerability level, once a new vulnerability is discovered, we only need to incorporate the smart contract tool that can detect the vulnerability into the system to achieve accurate prediction of the new vulnerability detection results, which fully demonstrates the flexibility and foresight of this embodiment in vulnerability detection.

[0120] Specifically, the specific process of step S4 is:

[0121] S41, analyze the contract version and select the tool that supports this version;

[0122] S42, put the contract into the model corresponding to each tool to predict the result;

[0123] S43, combining the prediction results with the average test time, calculating the tool score, and selecting the tool with the highest score for recommendation;

[0124] S44, finally displaying the tool name, prediction result and detection time to the user.

[0125] The formula for calculating the tool score is:

[0126]

[0127] Among them: Score is the final score of the tool;

[0128] W1 and W2: represent the weight coefficients of the prediction result and the average test time respectively, and the sum of W1 and W2 is 1;

[0129] TP: the probability that the tool predicts a true positive result;

[0130] TN: probability that the tool predicts a true negative result;

[0131] FP: the probability that the tool predicts a false positive result;

[0132] FN: The probability that the tool predicts a false negative result;

[0133] Time: time measurement;

[0134] Min: minimum time value;

[0135] Max: Maximum value of time.

[0136] like Figure 4 As shown in the figure, when detecting a new smart contract, first analyze the versions supported by the contract and select the vulnerability detection tools that support this version. Secondly, put it into the trained model (each tool trains a model) to obtain the detection result prediction of the contract. Then merge the time and the prediction result to obtain the score of the tool. The specific merging method is shown in the formula. The score is the prediction result, and the tool with the highest score is the recommended tool. Finally, the recommended tool name, tool prediction result, and average detection time are displayed to the user.

[0137] A neural network-based smart contract vulnerability detection tool evaluation system, the system is used to implement the above method, including a server;

[0138] The server includes a preprocessing module, a label generation module, a neural network model, a model verification module, a feedback module, a storage module, a user interaction module and a control unit;

[0139] The preprocessing module is responsible for compiling the smart contract source code into bytecode, extracting the opcode sequence, generating feature vectors, and dividing the data set;

[0140] Label generation module: Test smart contracts by executing a variety of smart contract vulnerability detection tools and assign corresponding labels based on the test results;

[0141] Neural network model: determine the neural network architecture, convert smart contract data into feature vectors, train and optimize the model;

[0142] Model verification module: Use the verification set and test set data to verify and test the model, adjust the model parameters, and evaluate the performance indicators and operating performance of the model. Finally, deploy the trained model to the server.

[0143] Feedback module: collects model prediction results and user feedback to optimize the model and improve performance, and continuously collects new data to update and optimize the model;

[0144] User interface and interaction module: provides a user interaction interface to support users to upload smart contracts, view test results and model prediction results;

[0145] Control unit: configures the test environment, manages the workflow of each module, coordinates data exchange and communication between modules, and ensures smooth operation of the overall system.

[0146] Furthermore, by setting up a feedback module to continuously collect and analyze new smart contract samples and their detection results, the deficiencies of existing detection tools and models can be discovered in a timely manner, so that targeted optimization and improvement can be carried out, which can improve the accuracy and efficiency of detection tools.

[0147] Specifically, the neural network model includes: input layer, LSTM layer, pooling layer, fully connected layer and output layer

[0148] The input layer is responsible for receiving and processing the original time series data, wherein the time series data is usually composed of multiple time series, wherein the time series is the length of the operation code sequence, wherein each time series contains multiple features;

[0149] The LSTM layer is responsible for processing the opcode sequence and outputting the hidden state;

[0150] The pooling layer selects features that are more relevant to the vulnerability from the hidden state sequence output by the LSTM;

[0151] The fully connected layer uses the Softmax function to map the high-dimensional vector into the final output form;

[0152] The output layer is used to output the final result, and the output result is a four-dimensional vector including TP, TN, FP, and FN, and the sum of TP, TN, FP, and FN is 1.

[0153] Furthermore, in order to evaluate the accuracy of the prediction, the present invention statistically analyzed the prediction results of the tool in this embodiment and the actual detection results of the tool, and statistically analyzed the accuracy of the prediction. The experimental results are as follows: Figure 5 shown.

[0154] Slither has the highest prediction result, reaching 98.41%, followed by Oyente, Mythril, GraphSA and ParSE, with prediction accuracy rates of 97.10%, 96.57%, 94.21% and 94.07% respectively. Sfuzz, AttackImitator and ContractGNN have medium prediction accuracy rates, with prediction accuracy rates around 90%, 91.23%, 90.57% and 89.64% respectively. Smartain, ContractFuzzer and xFuzz have the lowest prediction accuracy rates, 87.56%, 86.52% and 84.21% respectively.

[0155] Furthermore, the prediction accuracy of most smart contract vulnerability detection tools integrated in this embodiment exceeds the threshold of 85%. This data fully verifies the reliability of the prediction results of this embodiment, and provides a solid and effective reference benchmark for evaluating the performance of smart contract vulnerability detection tools. The high-accuracy prediction results not only demonstrate the excellent generalization ability of the selected prediction model or method, ensuring stable performance in different tools and complex scenarios, but also the differences between the prediction results also point out the direction for the subsequent targeted optimization and improvement of the performance of each detection tool, and promote the continuous advancement of smart contract security detection technology.

[0156] In summary: the present invention uses a variety of smart contract vulnerability detection tools and fully utilizes the advantages of different detection tools to improve the accuracy and comprehensiveness of vulnerability detection, cover more vulnerability types and scenarios, reduce the risk of missed reports and false positives, and construct an intelligent detection capability evaluation model through feature extraction and neural network learning, so as to automatically evaluate the detection effects of different tools in specific scenarios, recommend the most suitable detection tools to users, improve detection efficiency, and reduce the difficulty and cost of user tool selection;

[0157] Secondly, the feedback module continuously collects and analyzes new smart contract samples and their test results, promptly discovers the deficiencies of existing detection tools and models, and makes targeted optimizations and improvements, thereby improving the accuracy and efficiency of detection tools.

[0158] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A neural network-based smart contract vulnerability detection tool evaluation method, characterized in that: The steps include: S1, identify and preprocess the smart contract to obtain its features and labels; S2, building a neural network model suitable for smart contract detection; S3, uses neural network models to learn smart contract features and predict tool results; S4, set the evaluation strategy of the smart contract vulnerability detection tool and obtain the prediction results.

2. The neural network-based smart contract vulnerability detection tool evaluation method according to claim 1, characterized in that: The specific process of step S1 includes: S11, compile the smart contract source code into bytecode, and then use decompilation technology to extract the operation code sequence from the bytecode; S12, extracting features from the operation code sequence, and generating a feature sequence that can represent the features of the smart contract by analyzing information such as the correlation and occurrence frequency between the operation codes; S13, use a variety of smart contract vulnerability detection tools to test the smart contract, and assign corresponding labels to the tested contracts based on the test results.

3. The neural network-based smart contract vulnerability detection tool evaluation method according to claim 2, characterized in that: The extraction operation code sequence is specifically as follows: first, obtain the smart contract source code from the blockchain; Then use the compilation tool to compile the smart contract source code into bytecode, or use the decompilation tool to decompile the bytecode into an opcode sequence; Every two consecutive opcodes in the opcode sequence are regarded as a feature pair, and a unique identifier is assigned to each feature pair to ensure that the feature pair has a unique position in the feature vector; Create a feature vector whose length is equal to the number of possible feature pairs. If the feature pair appears in the opcode sequence, the corresponding element is 1, otherwise it is 0; Traverse all smart contracts in the data set, count the frequency of each feature pair in all smart contracts, delete those feature pairs that have never appeared in all smart contracts, record them as rare feature pairs, update the feature vector based on the results after deleting the rare feature pairs, and finally output the feature vector of the smart contract.

4. The neural network-based smart contract vulnerability detection tool evaluation method according to claim 3 is characterized in that: The opcode sequence is an instruction sequence used in the execution of the smart contract, and each element of the feature vector corresponds to whether a feature pair appears in the opcode sequence.

5. The neural network-based smart contract vulnerability detection tool evaluation method according to claim 3 is characterized in that: The specific process of step S13 is: collecting multiple smart contract vulnerability detection tools; Configure the test environment on the server, including installing test tools and setting up the test network; Analyze test results and detect possible problems or vulnerabilities in smart contracts; According to the test results and the characteristics of the smart contract, determine the label category and assign corresponding labels to the contract to be tested. Finally, the assigned label information is recorded in a database or stored in a file; The functions of the detection tool cover the main aspects of smart contract testing, including functional testing, boundary testing, exception testing and security testing.

6. The neural network-based smart contract vulnerability detection tool evaluation method according to claim 1, characterized in that: The specific tags assigned to the contract under test are: 1) Manually pre-label the correct labels and set them as correct results; 2) Obtain the test results of smart contracts using different testing tools; 3) Match and combine the detection results with the preset labels to obtain the final labels; 4) Label: 0 means no vulnerability, 1 means there is a vulnerability.

7. The neural network-based smart contract vulnerability detection tool evaluation method according to claim 1, characterized in that: The specific process of step S2 is: S21, obtain a large amount of smart contract data from the blockchain platform, pre-process the data, and divide the data into training set, verification set and test set; S22, determining the neural network architecture according to the characteristics of the smart contract data, and using representation learning technology to convert the smart contract data into feature vectors that can be processed by the neural network; S23, set training parameters, use the training set for training and back-propagation optimization, and adjust model parameters based on the validation set evaluation; S24, using the validation set data to validate the model, and adjusting the model parameters, testing the model through the test set data, and evaluating the overall performance and effect of the model when processing the test data; S25, deploy the trained model to the server, continuously collect new data, and update and optimize the model.

8. The neural network-based smart contract vulnerability detection tool evaluation method according to claim 1, characterized in that: The specific process of step S4 is as follows: S41, analyze the contract version and select the tool that supports this version; S42, put the contract into the model corresponding to each tool to predict the result; S43, combining the prediction results with the average test time, calculating the tool score, and selecting the tool with the highest score for recommendation; S44, finally displaying the tool name, prediction result and detection time to the user. The formula for calculating the tool score is: Among them: Score is the final score of the tool; W1 and W2: represent the weight coefficients of the prediction result and the average test time respectively, and the sum of W1 and W2 is 1; TP: the probability that the tool predicts a true positive result; TN: probability that the tool predicts a true negative result; FP: the probability that the tool predicts a false positive result; FN: The probability that the tool predicts a false negative result; Time: time measurement; Min: minimum time value; Max: Maximum value of time.

9. A neural network-based smart contract vulnerability detection tool evaluation system, characterized by: The system is used to implement the method described in any one of claims 1 to 8, including a server; The server includes a preprocessing module, a label generation module, a neural network model, a model verification module, a feedback module, a storage module, a user interaction module and a control unit; The preprocessing module is responsible for compiling the smart contract source code into bytecode, extracting the opcode sequence, generating feature vectors, and dividing the data set; Label generation module: Test smart contracts by executing a variety of smart contract vulnerability detection tools and assign corresponding labels based on the test results; Neural network model: determine the neural network architecture, convert smart contract data into feature vectors, train and optimize the model; Model verification module: Use the verification set and test set data to verify and test the model, adjust the model parameters, and evaluate the performance indicators and operating performance of the model. Finally, deploy the trained model to the server. Feedback module: collects model prediction results and user feedback to optimize the model and improve performance, and continuously collects new data to update and optimize the model; User interface and interaction module: provides a user interaction interface to support users to upload smart contracts, view test results and model prediction results; Control unit: configures the test environment, manages the workflow of each module, coordinates data exchange and communication between modules, and ensures smooth operation of the overall system.

10. The neural network-based smart contract vulnerability detection tool evaluation system according to claim 9, characterized in that: The neural network model includes: input layer, LSTM layer, pooling layer, fully connected layer and output layer The input layer is responsible for receiving and processing the original time series data, wherein the time series data is usually composed of multiple time series, wherein the time series is the length of the operation code sequence, wherein each time series contains multiple features; The LSTM layer is responsible for processing the opcode sequence and outputting the hidden state; The pooling layer selects features that are more relevant to the vulnerability from the hidden state sequence output by the LSTM; The fully connected layer uses the Softmax function to map the high-dimensional vector into the final output form; The output layer is used to output the final result, and the output result is a four-dimensional vector including TP, TN, FP, and FN, and the sum of TP, TN, FP, and FN is 1.

Images