Intelligent contract vulnerability detection method based on graph neural network

Abstract

The invention provides an intelligent contract vulnerability detection method based on a graph neural network, and the method comprises the steps: extracting a program control flow diagram and an abstract syntax diagram from an intelligent contract code, inputting the program control flow diagram and the abstract syntax diagram into the graph neural network, converting the program control flow diagram and the abstract syntax diagram into high-dimensional feature vectors, and carrying out the classification. The intelligent contract vulnerability detection taking the contract source code and the byte code as input is realized; for a contract without a source code deployed on a block chain, intelligent contract vulnerability detection only for an intelligent contract EVM byte code is realized; compared with a traditional static analysis method, one of the biggest advantages is that the operation speed is high, and the method has high detection efficiency under the condition that the detection performance is guaranteed; meanwhile, other existing methods often only research the condition of detecting a single vulnerability, and on the basis of the method, multiple vulnerabilities can be detected at the same time, and good vulnerability detection performance is achieved only through byte codes.

Description

Technical Field

[0001] The present invention belongs to the technical field of graph neural networks in machine learning, and in particular to a smart contract vulnerability detection method based on graph neural networks. Background Art

[0002] Ethereum is currently the most active blockchain platform with a large number of users and developers. So far, its market value has reached 444.1 billion. Smart contracts are self-executing agreements on Ethereum, whose terms are written directly into the code. The existence of smart contracts makes decentralized applications (DApps) a reality, and developers can use code to control digital assets. However, like other codes, smart contracts are prone to various vulnerabilities. There are many vulnerabilities due to defects in programming methods, languages ​​and tool chains. For example, integer overflow vulnerabilities, reentrancy and call injection (or code injection), access control defect vulnerabilities, etc. Due to the increasing economic value of Ethereum, attackers have gradually paid attention to this platform. There have been large-scale attacks involving millions of dollars, such as DAO, Parity, etc. Various vulnerabilities have even cost tens of millions of dollars.

[0003] Although only about 1 / 3 of the contract source code on the Ethereum blockchain is public, the rest are only EVM bytecode. Compared with the remaining 2 / 3, this part of the contract is more vulnerable to attack because the semantics are easy to understand. Most of the existing work is aimed at bytecode analysis, but compared with the high-level language solidity, the information contained in the bytecode is very limited (such as the inability to express structures, inheritance relationships, etc.), which will affect the accuracy of detection. Therefore, the present invention focuses on the analysis of contracts with source code on the chain. In addition, most of the existing tools are still static analysis or fuzzy analysis, which takes a long time to analyze, and requires experts to summarize and define specific vulnerability rules, which is time-consuming and labor-intensive, and there are few solutions that use machine learning for detection. Summary of the invention

[0004] To solve the above problems, the present invention provides a smart contract vulnerability detection method based on graph neural network, which does not require any additional rule definition and human intervention. It only needs to learn the vulnerabilities in the training phase, and its speed is higher than the existing static solutions.

[0005] A smart contract vulnerability detection method based on graph neural network includes the following steps:

[0006] S1: Determine whether the source code of the smart contract to be tested is deployed on the blockchain. If yes, perform operation 1; if not, perform operation 2; wherein, operation 1 is: generate an abstract syntax graph ASG from the source code of the smart contract to be tested, and generate a program control flow graph CFG from the bytecode; input the abstract syntax graph ASG and the program control flow graph CFG into the graph neural network respectively, and obtain the graph embedding T corresponding to the two graphs asg and T cfg , and T asg and T cfg Splice to fusion embedding T SC The second operation is: generating a program control flow graph CFG from the bytecode of the smart contract to be detected; inputting the program control flow graph CFG into the graph neural network to obtain the corresponding graph embedding T cfg , and T cfg As a fusion embedded T SC ;

[0007] S2: Embedding Fusion into T SC Input multi-layer perceptron model F NMLP , the probability of various vulnerabilities existing in the smart contract to be detected is obtained, and the vulnerabilities with probabilities greater than the set value are regarded as the most likely vulnerabilities in the smart contract to be detected.

[0008] Furthermore, the graph neural network is a GCN network integrated with a graph neural memory module, and in the operation 1, the abstract syntax graph ASG and the program control flow graph CFG are respectively input into the graph neural network as the graph G, and the method for obtaining the corresponding graph embedding is specifically as follows:

[0009] For the input graph G, the graph neural memory is used to perform feature distillation on the node features of each layer of the network in GCN to obtain the graph embedding T corresponding to each layer of the network l :

[0010] T l =F T (M l-1 ,T l-1 )

[0011] Among them, T l is the graph embedding of the l-th layer network in GCN, M l-1 is the node feature matrix of the l-1th layer network in GCN, T l-1 is the graph embedding of the l-1th layer network in GCN, F T (·) is the update function of graph neural memory;

[0012] For the input graph G, the node saliency update function F is used P (·) Obtain the node saliency of each layer of the network in GCN:

[0013] P l-1 =F P (T l ,M l-1 )

[0014] Among them, P l-1 is the node significance matrix of the l-1th layer network;

[0015] The node saliency matrix P of each layer of the network is used l-1 Regularize the GCN network to obtain the updated node feature matrix M l :

[0016] M l =F M (M l-1 ,P l-1 )

[0017] Among them, M l is the node feature matrix of the l-th layer network in GCN, F M (·) is the update function of node features;

[0018] The graph embedding corresponding to the last layer of the network in GCN is used as the final graph embedding T asg or T cfg .

[0019] Furthermore, the update function F of the graph neural memory is T The update operation of (·) representation is as follows:

[0020]

[0021] Among them, U T is the first weighted graph embedding corresponding to the graph embedding, is the first weight matrix corresponding to the graph embedding, X T is the first weighted feature matrix corresponding to the node feature, is the first weight matrix corresponding to the node feature, Y T is the second weighted feature matrix corresponding to the node feature, is the second weight matrix corresponding to the node features; d is a custom factor to prevent data explosion, T′ is the intermediate graph embedding, F MLP (·) is a multilayer perceptron, softmax(·) is the activation function, and T represents transposition.

[0022] Furthermore, the update function F of the node saliency is P The update operation of (·) representation is as follows:

[0023]

[0024] Among them, UP is the second weighted graph embedding corresponding to the graph embedding, is the second weight matrix corresponding to the graph embedding, X P is the third weighted feature matrix corresponding to the node feature, is the third weight matrix corresponding to the node features, d is a custom factor to prevent data explosion, softmax(·) is the activation function, and T represents transposition.

[0025] Furthermore, the update function F of the node feature M The update operation of (·) representation is as follows:

[0026] M l =σ(w l-1 M l-1 γ l )

[0027]

[0028] Among them, σ(·) is the activation function, w l-1 is the first regularized aggregate weight matrix of the l-1th layer network, N is the number of nodes in the input graph G, i is the number of the node in the input graph G, is the first regularized aggregation weight of node i, N i is the neighbor node of node i, is the node set of node i and its neighboring nodes, γ l is the second regularized aggregation weight of the l-th layer network, ||·|| β is the β norm, is the adjacency matrix of the input graph G, is the degree matrix of the input graph G, d l-1 is the local aggregation weight matrix of the l-1th layer network, is the local aggregation weight of node i, in, is the node significance of node i, and softmax(·) is the activation function.

[0029] Furthermore, the method for obtaining the initial value M of the node feature matrix of GCN is:

[0030] FastText is used to perform text conversion operations on the abstract syntax graph ASG or the program control flow graph CFG to obtain the initial value M of the node feature matrix of the abstract syntax graph ASG or the program control flow graph in the CFG network.

[0031] Furthermore, there are 8 types of vulnerabilities, namely: controlled-delegatecall, controlled-array-length, unchecked-transfer, erc20-interface, locked-ether, shadowing-abstract, constant-function-asm, and reentrancy-eth.

[0032] Beneficial effects:

[0033] The present invention provides a smart contract vulnerability detection method based on graph neural network, which extracts program control flow charts and abstract syntax graphs from smart contract codes, and then inputs them into graph neural networks to convert them into high-dimensional feature vectors and classify them. For contracts with source code deployed on the blockchain, a smart contract vulnerability detection with contract source code and bytecode as input is implemented; for contracts with no source code deployed on the blockchain, a smart contract vulnerability detection only for the smart contract EVM bytecode is implemented; compared with traditional static analysis methods, one of the biggest advantages is the fast running speed. The present invention can have high detection efficiency while ensuring detection performance; at the same time, other existing methods often only study the situation of detecting a single vulnerability. On this basis, the present invention can also detect multiple vulnerabilities at the same time, and has good vulnerability detection performance only through bytecode. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a flow chart of the tool used in the present invention to detect smart contract vulnerabilities;

[0035] Figure 2 This is a performance comparison diagram of the present invention and competitors in detecting reentrancy vulnerabilities;

[0036] Figure 3 This is a comparison chart of the efficiency of smart contract vulnerability detection between the present invention and competitors; DETAILED DESCRIPTION

[0037] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0038] With the increasing popularity of blockchain technology, smart contracts have shown great value in finance, supply chain management and other fields due to their automatic execution characteristics and decentralized advantages. At the same time, they are also facing many security risks, which may lead to serious economic losses and system paralysis. Since smart contracts cannot be tampered with once deployed, any errors and vulnerabilities cannot be easily fixed, so it is particularly urgent and necessary to develop effective vulnerability detection solutions.

[0039] However, existing tools generally only have solutions for detecting a single vulnerability, and few tools can detect multiple vulnerabilities at the same time. It is necessary to propose a smart contract vulnerability detection method that has both binary classification and multi-classification capabilities. Based on this technical background, the present invention takes into account both efficiency and performance, and proposes a smart contract vulnerability detection method based on graph neural network, which does not require any additional rule definition and human intervention, and only needs to learn vulnerabilities in the training phase. The speed is higher than the existing static solution, which can ensure both high accuracy of the detection results and high detection efficiency.

[0040] The present invention provides a method for detecting smart contract vulnerabilities based on a graph neural network, comprising the following steps:

[0041] S1: Determine whether the source code of the smart contract to be tested is deployed on the blockchain. If yes, perform operation 1; if not, perform operation 2; wherein, operation 1 is: generate an abstract syntax graph ASG from the source code of the smart contract to be tested, and generate a program control flow graph CFG from the bytecode; input the abstract syntax graph ASG and the program control flow graph CFG into the graph neural network respectively, and obtain the graph embedding T corresponding to the two graphs asg and T cfg , and T asg and T cfg Concatenate into fusion embedding Among them, “||” represents vector concatenation; the second operation is: generating a program control flow graph CFG from the bytecode of the smart contract to be detected; inputting the program control flow graph CFG into the graph neural network to obtain the corresponding graph embedding T cfg , and T cfg As a fusion embedded T SC ;

[0042] Among them, the method for extracting the program control flow graph CFG is: use EVM CFG Builder to extract the control flow graph from the bytecode. First, the bytecode of the smart contract is disassembled into a more readable sequence of opcodes. Then, the bytecode is decomposed into basic blocks, which consist of a series of consecutive instructions in the bytecode until a branch or jump instruction appears. Next, the bytecode is analyzed to identify conditional statements, loops, and jump instructions to grasp the control flow information of the code. Finally, the control flow graph is constructed using the relationship between basic blocks and control flow structures. Control flow graph G cfg =(V,E), where V is the set of nodes in the graph, v i ∈V is a basic block, E is the edge set of the graph, e i,j ∈E is the node v i and v j The control flow dependencies between them.

[0043] The extraction method of the abstract syntax graph ASG is as follows: First, compile the contract source code through solc to generate an abstract syntax tree, which describes the grammatical structure of the contract code in a fine-grained manner. Then, by constructing control flow and data flow related relationships such as node access, function call, conditional judgment, etc., the meaning of the abstract syntax tree is enriched to achieve a more accurate and comprehensive code graphing process. asg =(V,E), where V is a node in the graph, v i ∈V is the element of the statement granularity in the source code, E is the edge of the graph, and e i,j ∈E is the node v i and v j The control flow, data flow and data structure dependencies between them. It should be noted that the edges in the ASG graph have no attributes, which is equivalent to having no weight.

[0044] It can be seen that the present invention converts the graph structure into a high-dimensional embedding by inputting it into a graph neural network, obtains the embedding of the two graphs, and then fuses their features to obtain the final contract embedding;

[0045] S2: Embedding Fusion into T SC Input multi-layer perceptron model F NMLP , the probability of various vulnerabilities existing in the smart contract to be detected is obtained, and the vulnerabilities with probabilities greater than the set value are regarded as the most likely vulnerabilities in the smart contract to be detected.

[0046] That is to say, the present invention uses a multi-layer perceptron model F NMLP according to Predict the vulnerability label of the contract:

[0047]

[0048] Indicates that contract i has no vulnerability v, Indicates that contract i has vulnerability v. When v is 0, it determines whether contract i is negative, that is, there is no vulnerability. is the predicted probability that the label of contract i is v. In the multi-classification problem, v has 9 values. In the binary classification problem, v has only 2 values. NMLP There are two fully connected layers, ReLU activation function is applied, and the dropout value is set to 0.2.

[0049] When v has 9 values, it indicates that the multilayer perceptron model F of the present invention NMLPEight vulnerabilities can be identified: controlled-delegatecall, controlled-array-length, unchecked-transfer, erc20-interface, locked-ether, shadowing-abstract, constant-function-asm, reentrancy-eth.

[0050] At the same time, the present invention optimizes the multi-layer perceptron model F NMLP The loss function used is cross entropy loss:

[0051]

[0052] Among them, y i is the real vulnerability label of contract i.

[0053] Furthermore, the GNN used in the present invention has two core components that assist each other in working, and gradually obtain the final representation of the graph. The traditional GCN network is used as the basic network, and the Graph Neural Memory extracts the embedded representation of the graph from the node representation of the basic network; based on this, in the operation 1, the abstract syntax graph ASG and the program control flow graph CFG are respectively input into the graph neural network as the graph G, and the method for obtaining the corresponding graph embedding is specifically as follows:

[0054] S11: For the input graph G, the graph neural memory is used to perform feature distillation on the node features of each layer of the network in GCN to obtain the graph embedding T corresponding to each layer of the network l :

[0055] T l =F T (M l-1 ,T l-1 )

[0056] Among them, T l is the graph embedding of the l-th layer network in GCN, M l-1 is the node feature matrix of the l-1th layer network in GCN, T l-1 is the graph embedding of the l-1th layer network in GCN, F T (·) is the update function of graph neural memory;

[0057] It should be noted that before inputting the abstract syntax graph ASG and the program control flow graph CFG into the graph neural network, the abstract syntax graph ASG and the program control flow graph CFG must first be converted into inputs that can be used by the graph neural network, that is, first obtain the initial value M of the node feature matrix of GCN; the method for obtaining the initial value M of the node feature matrix of GCN is: use the datasets data structure in torch_geometric to store the graph, for CFG and ASG, respectively, regard the nodes as text blocks, and use FastText to perform text conversion operations on the abstract syntax graph ASG or the program control flow graph CFG to obtain the initial value M of the node feature matrix of the abstract syntax graph ASG or the program control flow graph in the CFG network. Among them, the nodes of the abstract syntax graph ASG and the program control flow graph in the CFG network will obtain d-dimensional feature vectors, that is, the node feature matrix of the graph can be obtained. N is the number of nodes, and the edges of the graph are represented using a sparse adjacency matrix.

[0058] Among them, the update function F of the graph neural memory T The update operation of (·) representation is as follows:

[0059]

[0060] In each layer of the graph neural memory, the graph embedding is refined by focusing on the node features of the previous layer in the base network and performing cross-attention operations for feature distillation. T is the first weighted graph embedding corresponding to the graph embedding, is the first weight matrix corresponding to the graph embedding, X T is the first weighted feature matrix corresponding to the node feature, is the first weight matrix corresponding to the node feature, Y T is the second weighted feature matrix corresponding to the node feature, is the second weight matrix corresponding to the node features; d is a custom factor to prevent data explosion after the vector is dot-producted; T′ is the intermediate graph embedding; F MLP (·) is a multilayer perceptron (MLP), which consists of two fully connected layers (the transformation matrix is and ), with an activation function added in the middle, softmax(·) is the activation function, and T represents transposition.

[0061] S12: For the input graph G, use the node saliency update function F P (·) Obtain the node saliency of each layer of the network in GCN:

[0062] P l-1 =FP (T l ,M l-1 )

[0063] Among them, P l-1 is the node significance matrix of the l-1th layer network;

[0064] Among them, evaluating the nodes in turn through the updated graph embedding helps GCN filter out nodes that are more important for global aggregation. This can be done through the function F P To evaluate the significance of each node in the graph, the update function F of the node significance P The update operation of (·) representation is as follows:

[0065]

[0066] Among them, U P is the second weighted graph embedding corresponding to the graph embedding, is the second weight matrix corresponding to the graph embedding, X P is the third weighted feature matrix corresponding to the node feature, is the third weight matrix corresponding to the node features, are all learnable parameter matrices, d is a custom factor to prevent data explosion, softmax(·) is the activation function, and T represents transposition. It should be noted that the node significance of the l-1 layer is a graph embedding T consisting of l layers l and the node feature matrix M of the l-1 layer l-1 Joint decision, P l-1 The sum of all elements of is 1, and the node saliency vividly interprets the coupling relationship between each node and the global graph representation.

[0067] It should be noted that the present invention learns the node significance in the graph in order to guide the neighborhood aggregation of the graph neural network, and makes the representation of the graph more accurate by promoting the propagation of node features with high significance.

[0068] S13: Using the node saliency matrix P of each layer of the network l-1 Regularize the GCN network to obtain the updated node feature matrix M l :

[0069] M l =F M (M l-1 ,P l-1 )

[0070] Among them, M l is the node feature matrix of the l-th layer network in GCN, F M (·) is the update function of node features;

[0071] Among them, the update function F of the node feature M The update operation of (·) representation is as follows:

[0072] M l =σ(w l-1 M l-1 γ l )

[0073]

[0074] Among them, σ(·) is the activation function, w l-1 is the first regularized aggregate weight matrix of the l-1th layer network, N is the number of nodes in the input graph G, i is the number of the node in the input graph G, is the first regularized aggregation weight of node i, N i is the neighbor node of node i, is the node set of node i and its neighboring nodes, γ l is the second regularized aggregation weight of the l-th layer network, γ l It is also the learnable parameter matrix of the lth layer, ||·|| β is the β norm, is the adjacency matrix of the input graph G, is the degree matrix of the input graph G, d l-1 is the adjacency matrix of the graph Sum degree matrix The calculated normalized local aggregation weight matrix of the l-1 layer network, is the local aggregation weight of node i, and the aggregation range is node i and its neighboring node set N i , in, is the node saliency of node i, which is obtained by aggregating the saliency of nodes in the same range, and softmax(·) is the activation function.

[0075] S14: Take the graph embedding corresponding to the last layer of the network in GCN as the final graph embedding T asg or T cfg .

[0076] In other words, the above three steps S11 to S13 realize mutually reinforcing self-circular updates, and the graph neural memory can dynamically aggregate and extract graph embeddings from node features. Finally, the neural network will obtain T L+1 As the embedded representation of the graph, L is the number of GCN layers.

[0077] The following comparative experiments are conducted using the five smart contract vulnerability detection tools shown in Table 1. Two of them are machine learning solutions and three are static analysis solutions. The table shows the versions of the detection tools used in this embodiment, as well as their input forms, detection methods, and the time when the current version was launched. Finally, in Table 1, you can also see how the papers corresponding to each tool have been cited on Google Scholar, as well as how the corresponding projects have been starred and forked on Github. It is hoped that these indicators can be used to roughly measure the advancement, recognition, and popularity of these comparative tools.

[0078] Table 1 Comparison of tool situations

[0079]

[0080] The final results of Table 1 are shown in Table 2. The leftmost column in the table shows the types of vulnerabilities to be detected. Since not every competitor can fully detect these 8 vulnerabilities, the vulnerabilities are used as row classifications here, and the accuracy, recall, precision and F1 score of each tool for the detectable vulnerabilities are shown in turn as a quantification of performance. All experiments use the 10-fold cross validation method.

[0081] In addition, we have added a test for the proportion of detectable contracts to measure how many contracts the tool can detect normally. Contracts that fail to detect will not be counted in the calculation of other detection indicators.

[0082] Table 2 Results

[0083]

[0084]

[0085]

[0086] It can be seen that for all 8 vulnerabilities, the present invention has the highest accuracy in 7 of them and always holds the highest F1 score. Especially in the 4 vulnerabilities of controlled-array-length, unchecked-transfer, erc20-interface and constant-function-asm, the present invention is significantly better than other tools in performance.

[0087] Compared with the best performing tools in each indicator among competitors. Among the above-mentioned 4 vulnerabilities, the present invention has an accuracy improvement ranging from 26.9% to 80.83%, and at the same time, it has an improvement of 35.62% to 78.96% in F1 score. Among the other 3 vulnerabilities with the highest accuracy, there is an accuracy improvement ranging from 3.26% to 7.37%, and an improvement of 18.42% to 38.25% in F1 score. For the locked-ether vulnerability, although the accuracy is 4.03% lower than the highest DLVA, the F1 score of the present invention is 16.86% higher, and the Precision value is 29.81% higher. It shows that although the accuracy is slightly lower, the true positive rate is much higher than DLVA. In summary, the detection model of the present invention achieves a high accuracy rate, and also does an excellent job in balancing precision and recall, which guarantees the true positive rate to a certain extent.

[0088] Among the eight types of vulnerabilities involved, only reentrancy vulnerabilities are the type of vulnerabilities that can be detected by all tools. Figure 2 It is the performance diagram of each tool. It can be seen intuitively that the present invention has quite excellent performance. It can be seen that the test results show that the present invention has achieved very good detection effect for the 8 types of smart contract vulnerabilities and has strong competitiveness.

[0089] It can be seen that BSGVD, which uses both contract bytecode and source code, has better performance in detecting most vulnerabilities than BGVD, which only uses bytecode. However, the accuracy of BGVD is only in the 0.3% to 3.04% lag range, which is higher than other competitors. It should be noted that most of the contracts on the blockchain do not deploy source code, so it is also very important to detect vulnerabilities in contracts only through bytecode. Some existing methods perform additional processing on this through other technologies such as knowledge distillation. As a byproduct, the present invention also has good detection performance only through bytecode detection.

[0090] Figure 3 The detection time of the machine learning method takes into account the time for preprocessing the original data (i.e., the contract bytecode or source code). It can be seen that the running speed of the present invention is less than 1 second, which is much higher than the static analysis tool. It is similar to the running speed of DLVA which also uses the machine learning method. It should be noted that one of the biggest advantages of the machine learning method over the traditional static analysis method is its fast running speed. The present invention can have high detection efficiency while ensuring detection performance;

[0091] The present invention simultaneously detects the eight smart contract vulnerabilities mentioned above. Tables 3 and 4 show the experimental results. It can be seen that the accuracy of BSGVD is as high as 91.26%, and the F1 score is as high as 97.42%. The accuracy of BGVD based only on bytecode also reaches an acceptable 87.34%, and the F1 score reaches 96.43%. It can be seen that other existing methods often only study the detection of a single vulnerability. On this basis, the present invention can also detect multiple vulnerabilities at the same time;

[0092] Table 3 Results of BSGVD detecting 8 vulnerabilities at the same time

[0093] vulnerability accuracy precision recall F1 controlled-delegatecall 96.15 - - - controlled-array-length 94.74 - - - unchecked-transfer 92.32 - - - erc20-interface 96.95 - - - locked-ether 94.59 - - - shadowing-abstract 92.67 - - - constant-function-asm 83.46 - - - reentrancy-eth 79.21 - - - total 91.26 97.44 97.39 97.42

[0094] Table 4 Results of BGVD detecting 8 vulnerabilities at the same time

[0095] vulnerability accuracy precision recall F1 controlled-delegatecall 90.71 - - - controlled-array-length 82.75 - - - unchecked-transfer 91.39 - - - erc20-interface 94.83 - - - locked-ether 90.33 - - - shadowing-abstract 83.03 - - - constant-function-asm 71.85 - - - reentrancy-eth 76.50 - - - total 87.34 96.22 96.66 96.43

[0096] The experimental results of the above process show that the final smart contract vulnerability detection performance and efficiency of the present invention are much higher than those of other competitors in the comparative experiment. Specifically, the present invention extracts the program control flow chart and abstract syntax graph from the smart contract code, and further inputs them into the graph neural network to convert them into high-dimensional feature vectors and classify them. For contracts with source code deployed on the blockchain, a smart contract vulnerability detection method BSGVD with contract source code and bytecode as input is implemented; for contracts without source code deployed on the blockchain, a detection method BGVD that only targets the smart contract EVM bytecode is implemented.

[0097] In summary, the present invention proposes a smart contract vulnerability detection method based on graph neural network, which can detect 8 common smart contract vulnerabilities. This tool is applicable to all smart contracts on Ethereum, regardless of whether the source code is deployed, and runs automatically throughout the process without the need for experts to define rules or manually define features.

[0098] Of course, the present invention may have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art may certainly make various corresponding changes and modifications based on the present invention, but these corresponding changes and modifications should all fall within the scope of protection of the claims attached to the present invention.

Claims

1. A smart contract vulnerability detection method based on graph neural network, characterized in that: The following steps are involved: S1: Determine whether the source code of the smart contract to be tested is deployed on the blockchain. If yes, execute operation 1; If not, perform operation 2; wherein, operation 1 is: generating an abstract syntax graph ASG from the source code of the smart contract to be detected, and generating a program control flow graph CFG from the bytecode; The abstract syntax graph ASG and the program control flow graph CFG are input into the graph neural network respectively, and the graph embedding T corresponding to the two graphs is obtained. asg and T cfg , and T asg and T cfg Splice to fusion embedding T SC The second operation is: generating a program control flow graph CFG from the bytecode of the smart contract to be detected; inputting the program control flow graph CFG into the graph neural network to obtain the corresponding graph embedding T cfg , and T cfg As a fusion embedded T SC ; S2: Embedding Fusion into T SC Input multi-layer perceptron model F NMLP , the probability of various vulnerabilities existing in the smart contract to be detected is obtained, and the vulnerabilities with probabilities greater than the set value are regarded as the most likely vulnerabilities in the smart contract to be detected.

2. A method for detecting smart contract vulnerabilities based on graph neural networks as claimed in claim 1, characterized in that: The graph neural network is a GCN network integrated with a graph neural memory module, and in the operation 1, the abstract syntax graph ASG and the program control flow graph CFG are respectively input into the graph neural network as graph G, and the method for obtaining the corresponding graph embedding is specifically as follows: For the input graph G, the graph neural memory is used to perform feature distillation on the node features of each layer of the network in GCN to obtain the graph embedding T corresponding to each layer of the network l : T l =F T (M l-1 ,T l-1 ) Among them, T l is the graph embedding of the l-th layer network in GCN, M l-1 is the node feature matrix of the l-1th layer network in GCN, T l-1 is the graph embedding of the l-1th layer network in GCN, F T (·) is the update function of graph neural memory; For the input graph G, the node saliency update function F is used P (·) Obtain the node saliency of each layer of the network in GCN: P l-1 =F P (T l ,M l-1 ) Among them, P l-1 is the node significance matrix of the l-1th layer network; The node saliency matrix P of each layer of the network is used l-1 Regularize the GCN network to obtain the updated node feature matrix M l : M l =F M (M l-1 ,P l-1 ) Among them, M l is the node feature matrix of the l-th layer network in GCN, F M (·) is the update function of node features; The graph embedding corresponding to the last layer of the network in GCN is used as the final graph embedding T asg or T cfg .

3. A method for detecting smart contract vulnerabilities based on graph neural networks as claimed in claim 2, characterized in that: Update function F of graph neural memory T The update operation of (·) representation is as follows: Among them, U T is the first weighted graph embedding corresponding to the graph embedding, is the first weight matrix corresponding to the graph embedding, X T is the first weighted feature matrix corresponding to the node feature, is the first weight matrix corresponding to the node feature, Y T is the second weighted feature matrix corresponding to the node feature, is the second weight matrix corresponding to the node features; d is a custom factor to prevent data explosion, T′ is the intermediate graph embedding, F MLP (·) is a multilayer perceptron, softmax(·) is the activation function, and T represents transposition.

4. A method for detecting smart contract vulnerabilities based on graph neural network as claimed in claim 2, characterized in that: Update function F of node saliency P The update operation of (·) representation is as follows: Among them, U P is the second weighted graph embedding corresponding to the graph embedding, is the second weight matrix corresponding to the graph embedding, X P is the third weighted feature matrix corresponding to the node feature, is the third weight matrix corresponding to the node features, d is a custom factor to prevent data explosion, softmax(·) is the activation function, and T represents transposition.

5. The method for detecting smart contract vulnerabilities based on graph neural network according to claim 1, characterized in that: Update function F of node features M The update operation of (·) representation is as follows: M l =σ(w l-1 M l-1 c l ) Among them, σ(·) is the activation function, w l-1 is the first regularized aggregate weight matrix of the l-1th layer network, N is the number of nodes in the input graph G, i is the number of the node in the input graph G, is the first regularized aggregation weight of node i, N i is the neighbor node of node i, is the node set of node i and its neighboring nodes, γ l is the second regularized aggregation weight of the l-th layer network, ||·|| β is the β norm, is the adjacency matrix of the input graph G, is the degree matrix of the input graph G, d l-1 is the local aggregation weight matrix of the l-1th layer network, For Node The local aggregation weight of in, is the node significance of node i, and softmax(·) is the activation function.

6. A method for detecting smart contract vulnerabilities based on graph neural networks as claimed in any one of claims 2 to 5, characterized in that: The method for obtaining the initial value M of the node feature matrix of GCN is: FastText is used to perform text conversion operations on the abstract syntax graph ASG or the program control flow graph CFG to obtain the initial value M of the node feature matrix of the abstract syntax graph ASG or the program control flow graph in the CFG network.

7. A method for detecting smart contract vulnerabilities based on graph neural networks as claimed in claim 1, characterized in that: There are 8 types of vulnerabilities, namely: controlled-delegatecall, controlled-array-length, unchecked-transfer, erc20-interface, locked-ether, shadowing-abstract, constant-function-asm, and reentrancy-eth.

Images