Intelligent contract vulnerability detection method and system based on fine-tuning large language model

Abstract

The invention relates to an intelligent contract vulnerability detection method and system based on a fine-tuning large language model. The method comprises the following steps: acquiring an audited contract item, and acquiring a dependent contract; performing optimization balance on the data set obtained based on dependency contract construction to obtain a balanced data set; determining a large language model, designing a prompt project for the large language model, and performing model pre-training on the large language model by using the balanced data set; introducing a low-rank matrix to carry out fine tuning on the weight in the large language model to obtain a fine-tuned large language model; and performing intelligent contract vulnerability detection by using the fine-tuned large language model to obtain a detection result. A low-rank matrix is introduced to carry out fine adjustment on the weight in the large language model, and large-scale retraining on the whole model is not needed, so that the training time of the intelligent contract vulnerability detection model is greatly shortened; the fine-tuned large language model has strong adaptability and generalization ability, and can deal with the complex and difficult-to-audit security problem of the smart contract.

Description

Technical Field

[0001] The present invention relates to the field of smart contract security technology, and in particular to a smart contract vulnerability detection method and system based on a fine-tuned large language model. Background Art

[0002] Compared with a single traditional smart contract, decentralized applications (DApp) are a new blockchain application paradigm composed of a series of smart contracts. DApp has been widely used in various fields such as games and finance. Since smart contracts themselves may have vulnerabilities, it is inevitable that they will bring security issues to decentralized applications. Analyzing the security of smart contracts is a necessary way to enhance the security of blockchain systems, and identifying smart contract vulnerabilities is the first step in analyzing the security of DApps. Large language models (LLMs) have demonstrated significant capabilities in many software engineering tasks such as code generation, test generation, and code summarization. With its versatility and innovative features of explaining prediction results through plain text, LLMs have gradually become an important research direction for detecting security vulnerabilities. Although decentralized applications still have conventional contract vulnerabilities (such as reentrancy, arithmetic, etc.), nearly 80% of contract vulnerabilities are machine-unauditable and difficult to detect manually, and are uniformly summarized as logical errors in contracts.

[0003] With the continuous development of blockchain technology, a large number of digital assets are managed by smart contracts, and attackers use the security risks in smart contracts to gain a lot of illegal benefits. Traditional vulnerability security analysis is often based on program analysis, which is limited by predefined vulnerability patterns and cannot effectively analyze emerging security issues. Summary of the invention

[0004] Based on this, in order to solve the above technical problems, a smart contract vulnerability detection method and system based on a fine-tuned large language model is provided, which can improve the adaptability and generalization ability of the detection model, and can deal with complex and difficult-to-audit smart contract security issues.

[0005] A smart contract vulnerability detection method based on a fine-tuned large language model, the method comprising:

[0006] Obtain audited contract projects, scan files in the contract projects, and obtain dependent contracts;

[0007] A data set is obtained based on the dependent contract construction, and the data set is optimized and balanced to obtain a balanced data set;

[0008] Determine a large language model, design a prompting project for the large language model, and use the balanced data set to perform model pre-training on the large language model to obtain a pre-trained large language model;

[0009] Introducing a low-rank matrix to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model;

[0010] The fine-tuned large language model is used to perform smart contract vulnerability detection to obtain a detection result.

[0011] In one embodiment, obtaining an audited contract project, scanning files in the contract project, and obtaining dependent contracts includes:

[0012] Use a scanning tool to scan the files in the contract project to obtain scanning results;

[0013] Screening out files in the contract project according to the scanning result to obtain target files;

[0014] For the target file, the scanning tool is used to obtain the dependent contract according to the imported code.

[0015] In one embodiment, a data set is obtained based on the dependent contract construction, and the data set is optimized and balanced to obtain a balanced data set, including:

[0016] Determine the missing library contract based on the dependent contract, and integrate the missing library contract into the contract project to obtain a complete decentralized application project;

[0017] Collect smart contracts in the decentralized application project to construct a data set; wherein the smart contracts contain smart contract vulnerabilities;

[0018] The data set is optimally balanced using a random oversampling method to obtain a balanced data set.

[0019] In one embodiment, determining a large language model and designing a prompt engineering for the large language model include:

[0020] Determine a large language model, and obtain role definitions, train of thought chains, prior knowledge, requirement specifications, and response formats corresponding to the large language model;

[0021] Combine the role definition, thought chain, prior knowledge, requirement specification, and response format to design a prompt project.

[0022] In one embodiment, a low-rank matrix is ​​introduced to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model, including:

[0023] Obtaining the original weight matrix of the pre-trained large language model;

[0024] Determine two low-rank matrices, initialize the two low-rank matrices respectively, and calculate the product between the two initialized low-rank matrices;

[0025] The product is used as an updated weight matrix, and the updated weight matrix is ​​used to fine-tune the original weight matrix to obtain a fine-tuned large language model.

[0026] In one embodiment, initializing two low-rank matrices respectively and calculating the product of the two initialized low-rank matrices includes:

[0027] Perform a random Gaussian initialization operation on one low-rank matrix and a zero initialization operation on the other low-rank matrix;

[0028] Multiplying the two initialized low-rank matrices represents the update of the weights and obtains the product.

[0029] In one embodiment, the method further comprises:

[0030] Determine evaluation indicators; the evaluation indicators include precision, recall, and F1 score;

[0031] The fine-tuned large language model is evaluated using the evaluation indicator to obtain an evaluation result.

[0032] A smart contract vulnerability detection system based on a fine-tuned large language model, the system comprising:

[0033] A file scanning module, used to obtain audited contract projects, scan files in the contract projects, and obtain dependent contracts;

[0034] A data set processing module, used to obtain a data set based on the dependent contract construction, and optimize and balance the data set to obtain a balanced data set;

[0035] A model pre-training module, used to determine a large language model, design a prompting project for the large language model, and perform model pre-training on the large language model using the balanced data set to obtain a pre-trained large language model;

[0036] A model fine-tuning module, used for introducing a low-rank matrix to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model;

[0037] The vulnerability detection module is used to use the fine-tuned large language model to perform smart contract vulnerability detection and obtain detection results.

[0038] The above-mentioned smart contract vulnerability detection method and system based on the fine-tuned large language model can reduce the impact of data imbalance on model performance by scanning the contract project files to obtain dependent contracts and constructing a data set for optimization and balance; by designing a prompt project for the model, the effectiveness of the model in detecting smart contract vulnerabilities can be improved; the low-rank matrix is ​​introduced to fine-tune the weights in the large language model without having to retrain the entire model on a large scale, which greatly reduces the training time of the smart contract vulnerability detection model; the fine-tuned large language model has strong adaptability and generalization capabilities, and can cope with complex and difficult-to-audit smart contract security issues. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is an application environment diagram of a smart contract vulnerability detection method based on a fine-tuned large language model in one embodiment;

[0040] Figure 2 1 is a flow chart of a method for detecting smart contract vulnerabilities based on a fine-tuned large language model in one embodiment;

[0041] Figure 3 It is a structural block diagram of a smart contract vulnerability detection system based on a fine-tuned large language model in one embodiment;

[0042] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] The smart contract vulnerability detection method based on a fine-tuned large language model provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1As shown, the application environment includes a computer device 110. The computer device 110 can obtain audited contract projects, scan files in the contract projects, and obtain dependent contracts; the computer device 110 can construct a data set based on the dependent contracts, and optimize and balance the data set to obtain a balanced data set; the computer device 110 can determine a large language model, design a prompt project for the large language model, and use a balanced data set to pre-train the large language model to obtain a pre-trained large language model; the computer device 110 can introduce a low-rank matrix to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model; the computer device 110 can use the fine-tuned large language model to perform smart contract vulnerability detection and obtain a detection result. Among them, the computer device 110 can be, but is not limited to, various personal computers, laptops, smart phones, robots, unmanned aerial vehicles and other devices.

[0045] In one embodiment, Figure 2 As shown, a smart contract vulnerability detection method based on a fine-tuned large language model is provided, comprising the following steps:

[0046] Step 202, obtain the audited contract project, scan the files in the contract project, and obtain the dependent contracts.

[0047] In traditional technology, although many research works have published data sets for smart contract vulnerability detection, most of the contract codes in these data sets are only 40 lines, or even less, which is far lower than the code size of decentralized application DApp projects in the real world. Vulnerability detection tools that can perform well for these simplified contracts cannot ensure that they can still maintain good performance in real complex DApp scenarios.

[0048] In order to solve the problem that the existing data set is not representative, in this embodiment, the computer device can obtain audited contract projects, scan the files in the contract projects, and obtain dependent contracts. Specifically, the computer device can obtain audited contract projects from Code4rena and Slowmist platforms, and implement a python gadget SmartCollect to restore the dependent contracts of a complete DApp project, such as dependent public libraries, called external contracts, etc.

[0049] In one embodiment, a smart contract vulnerability detection method based on a fine-tuned large language model is provided, which may also include a process of obtaining dependent contracts, the specific process including: using a scanning tool to scan files in a contract project to obtain scanning results; screening files in the contract project according to the scanning results to obtain target files; for the target file, using a scanning tool to obtain dependent contracts according to the imported code.

[0050] In order to better obtain a complete DApp project, the computer device can use a scanning tool to scan all .sol files in the contract project and exclude irrelevant configuration files such as .js files. For each .sol file, the scanning tool can obtain the dependent contract according to the corresponding import code "import". / aave / ILendingPool.sol";" and return a list of file paths imported in the Solidity file. Scan the input directory to find the .sol imported in the Solidity file and find the missing .sol files.

[0051] Step 204, constructing a data set based on the dependent contract, and optimizing and balancing the data set to obtain a balanced data set.

[0052] After identifying the dependent contracts of each DApp, missing library contracts such as ERC20 can be found, usually from the OpenZeppelin library. To this end, in this embodiment, these missing library contracts can be collected from Github and automatically integrated into the DApp project to ensure the integrity of the project.

[0053] Specifically, in this embodiment, the computer device can use the gadget SmartCollect to collect 215 DApp projects, including 4998 smart contracts, which have the vulnerabilities summarized by SWC Registry. With the iterative reentry vulnerabilities of Solidity versions, arithmetic vulnerabilities still seriously affect the security of contracts, but vulnerabilities such as unprotected self-destruction contracts and default visibility of functions are all compensated in high versions of Solidity. Therefore, in this embodiment, the reentry vulnerabilities, arithmetic vulnerabilities and timestamp dependencies of contracts are still taken as research objects. At the same time, in order to verify the performance of LLM on contract logic errors, the computer device also collected 23 contracts with contract token price manipulation vulnerabilities using the gadget, sorted the collected data, and saved them in .json format.

[0054] In one embodiment, a smart contract vulnerability detection method based on a fine-tuned large language model is provided, which may also include a process of optimizing and enhancing data samples, the specific process including: determining missing library contracts based on dependent contracts, integrating the missing library contracts into the contract project, and obtaining a complete decentralized application project; collecting smart contracts in the decentralized application project, and constructing a data set; wherein the smart contracts contain smart contract vulnerabilities; and optimizing the balanced data set using a random oversampling method to obtain a balanced data set.

[0055] A prominent and practical problem of vulnerability detection is data imbalance. The ratio of vulnerability and non-vulnerability cases in real projects is extremely unbalanced. According to existing research, it is observed that the performance of advanced code vulnerability detection methods based on deep learning drops sharply in unbalanced data. In order to solve the data imbalance problem of the used dataset, this embodiment proposes random over sampling to optimize the dataset.

[0056] Specifically, oversampling balances the dataset by increasing the number of samples in the minority class. For example, the random oversampling method randomly selects samples from the minority class, samples them repeatedly, and adds them to the training data, which can enhance the representativeness of the minority class and thus alleviate the impact of data imbalance on model performance.

[0057] Step 206 , determine a large language model, design a prompting project for the large language model, and use a balanced data set to pre-train the large language model to obtain a pre-trained large language model.

[0058] Since the design of prompt engineering has a significant impact on the effectiveness of smart contract vulnerability detection, in this embodiment, prompts are defined as scenarios that meet specific roles and requirements. Specifically, clear role definitions, prior knowledge, and response formats can be provided in the prompt engineering, requiring the large language model to act as a smart contract auditor and identify four types of vulnerabilities in the provided contract.

[0059] In one embodiment, a smart contract vulnerability detection method based on a fine-tuned large language model is provided, which may also include a process of designing a prompt project for the large language model. The specific process includes: determining the large language model, obtaining the role definition, thought chain, prior knowledge, requirement specification, and response format corresponding to the large language model; and designing a prompt project in combination with the role definition, thought chain, prior knowledge, requirement specification, and response format.

[0060] In this embodiment, in order to better evaluate the ability of the large language model to detect smart contract vulnerabilities and parse codes, the smart contract vulnerability detection results and audit reports can be used as benchmarks for evaluation. A prompting project is designed based on the CoT method. The purpose of the prompting project is to require the large language model LLM to imitate the way auditors audit smart contracts. The entire audit process includes a thorough understanding of the background information and goals of the smart contract, as well as a comprehensive analysis of the logic behind its vulnerabilities. The prompting project design combines role definition, thought chain, requirement specification, and response format.

[0061] Step 208: introduce a low-rank matrix to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model.

[0062] Among them, model fine-tuning can include full-parameter fine-tuning and LoRA fine-tuning. The classic fine-tuning method mainly refers to full-parameter fine-tuning (FFT), which is considered to be a more powerful technical method than LoRA fine-tuning in terms of effect. It involves updating all parameters of the pre-trained model so that the model can achieve optimal performance on new tasks. Before full-parameter fine-tuning, the model usually needs to go through a pre-training stage; after obtaining the basic pre-trained model, the model is further trained using a specific data set containing some smart contract vulnerabilities to adapt it to the smart contract vulnerability detection task.

[0063] The core of full parameter fine-tuning is: for the smart contract vulnerability detection task, all parameters of the model are retrained based on the task data to make it perform best on the task. In the full parameter fine-tuning process, all weights W of the pre-trained model are treated as learnable parameters and updated by gradient descent. Specifically, given a task dataset D = {(x i ,y i )}, all parameter fine-tuning aims to minimize the loss function L of a specific task, where x i is the input, y i For the output label, the gradient of the loss function to the model parameter W is calculated through back propagation. The specific formula is: Among them, β is the learning rate, It represents the gradient of the loss function L with respect to the parameter W. During the full parameter fine-tuning process, the model parameters are greatly updated to adapt to the needs of specific tasks.

[0064] LoRA (Low-Rank Adaptation of Large Language Models) is a lightweight fine-tuning method that aims to improve the adaptability and efficiency of LLM, especially for customization of specific tasks under limited resources and data conditions. The core idea of ​​LoRA is to efficiently adjust the weights of the pre-trained model by introducing a low-rank matrix without having to retrain the entire model on a large scale, greatly reducing the training time of the smart contract vulnerability detection model.

[0065] In one embodiment, a smart contract vulnerability detection method based on a fine-tuned large language model is provided, which may also include a process of performing LoRA fine-tuning on the large language model, and the specific process includes: obtaining the original weight matrix of the pre-trained large language model; determining two low-rank matrices, initializing the two low-rank matrices respectively, and calculating the product between the two initialized low-rank matrices; using the product as an updated weight matrix, and using the updated weight matrix to fine-tune the original weight matrix to obtain a fine-tuned large language model.

[0066] In one embodiment, during the LoRA fine-tuning of the large language model, the process may further include the process of initializing the low-rank matrix. The specific process includes: performing a random Gaussian initialization operation on one low-rank matrix and a zero initialization operation on another low-rank matrix; multiplying the two initialized low-rank matrices to represent the weight update and obtaining the product.

[0067] Specifically, when performing LoRA fine-tuning, the low-rank matrix A is initialized with a random Gaussian distribution, and the low-rank matrix B is initialized with zeros. Therefore, ΔW is initialized to 0, and only the weights of W q , W k , W v are adjusted.

[0068] In a deep neural network, especially in an autoregressive large language model, the weight matrix usually has a high dimension. For a given fully connected layer, its weight matrix W ∈ R d*k , where d is the input dimension and k is the output dimension. The key idea of LoRA is to use the low-rank factorization of the matrix to approximately represent the weight update, that is, to represent the updated weight matrix as the product of two low-rank matrices. The formula can be expressed as: ΔW = AB T ; where A ∈ R d*r and B ∈ R k*r represent the low-rank matrices respectively, and r << min(d, k) is the size of the rank. By using the low-rank factorization method of the matrix, the large language model only needs to learn and store the two low-rank matrices A and B, without updating the entire weight matrix W. Therefore, LoRA can achieve model fine-tuning while significantly reducing the number of parameters.

[0069] In this embodiment, during the model fine-tuning process, the weight matrix W is updated by introducing a low-rank approximation. The formula can be expressed as: W new = W0 + ΔW = W0 + AB T ; where W0 is the original weight matrix in the pre-trained language model, and ΔW = AB T is the low-rank update part learned by LoRA; W new is the weight matrix after low-rank approximation update; at this time, only A and B are updated as trainable parameters, while W0 is frozen and does not receive gradient updates. By using the LoRA fine-tuning method, the complexity of fine-tuning can be effectively reduced, while avoiding the huge computational overhead required for full-parameter fine-tuning.

[0070] Step 210, use the fine-tuned large language model to detect smart contract vulnerabilities and obtain the detection results.

[0071] In one embodiment, a smart contract vulnerability detection method based on a fine-tuned large language model is provided, which may also include a process of performing model evaluation, and the specific process includes: determining evaluation indicators; the evaluation indicators include precision, recall, and F1 score; and using the evaluation indicators to evaluate the fine-tuned large language model to obtain an evaluation result.

[0072] In one embodiment, in order to evaluate the performance of the fine-tuned large language model in the smart contract vulnerability detection method based on the fine-tuned large language model provided in this application, an experimental evaluation is conducted, and the specific process includes:

[0073] The experimental settings are as follows: 85% of the dataset is randomly used for model training and 15% is used for model testing. When fine-tuning the large language model, the maximum length parameter model_max_length of the input text is set to 5024, because the length of most code snippets does not exceed this value; the number of training rounds (num_train_epochs) is set to 5, and the learning rate (learning_rate) is set to 2e-4. In the fine-tuning process, the most critical parameter is the setting of the fine-tuning method. By setting use_lora to USE_LORA, the LoRA method is used to fine-tune the trained LLM. All experiments are conducted on a server equipped with NVIDIA A800GPU and 14vCPU Intel(R)Xeon(R)Gold 6348CPU.

[0074] In order to accurately and reasonably evaluate the effect of the SmartBugBert model, precision, recall, and F1-Score were selected as evaluation indicators. The calculation method of each evaluation indicator is as follows:

[0075] Precision(PRE): It indicates the proportion of smart contracts that actually have vulnerabilities among all smart contracts marked as having vulnerabilities by the model.

[0076] Recall(REC): It indicates the proportion of smart contracts that the model can correctly identify among all smart contracts that actually have vulnerabilities.

[0077] F1-Score(F1): It is the harmonic mean of precision and recall, which is used to comprehensively represent the performance of the two.

[0078] Among them, True Positive (TP) indicates the number of smart contract vulnerability types accurately detected; False Negative (FN) indicates the number of smart contracts that actually have vulnerabilities but the model fails to accurately identify; False Positive (FP) indicates the number of smart contracts that the model falsely reports as having vulnerabilities when there are no vulnerabilities; True Negative (TN) indicates the number of smart contracts that are accurately identified as not having vulnerabilities.

[0079] Experimental results and analysis:

[0080] Performance evaluation:

[0081] Using the collected data, we used the mainstream open source large language model Llama3-8B ] The training was performed on Qwen2-7B and Qwen2-7B, and the two fine-tuning techniques of FFT and LoRA were combined. The experimental results are shown in the following table:

[0082] Experimental comparison of fine-tuning large language models based on FFT and LoRA

[0083]

[0084] As can be seen from the table above, without any preprocessing of the smart contract source code, the fine-tuned large language model can achieve relatively good performance in the smart contract vulnerability detection task. Among them, the highest precision rate reaches 0.78, the highest recall rate reaches 0.70, and the highest F1 score reaches 0.73, showing a relatively balanced detection performance.

[0085] Moreover, all-parameter fine-tuning is significantly better than LoRA fine-tuning in terms of both precision and recall. This is because LoRA freezes the weights of some parameters, which limits the model's learning ability and optimization space on specific tasks, making the model unable to fully adapt to the complexity of smart contract vulnerability detection tasks.

[0086] The impact of fine-tuning:

[0087] In order to illustrate the impact of fine-tuning on the performance of the smart contract vulnerability detection task, this example compares the performance of the Qwen2 model without fine-tuning. The experimental results are shown in the following table:

[0088] Qwen2 performance without fine-tuning

[0089]

[0090] Large language models without fine-tuning have extremely limited performance on the specific task of smart contract vulnerability detection and are not effective for this task. This shows that domain-specific fine-tuning is crucial to improving the performance of models on complex tasks.

[0091] At the same time, in this example, a comparative analysis was conducted on the latest technical methods, CPTLENS and GPTSCAN. Due to the differences in the data sets used, this evaluation was only based on the accuracy index. In addition, the best performing full-parameter fine-tuning model was selected as the comparison object, and the experimental results are shown in the following table:

[0092] Comparison of full parameter fine-tuning with other methods

[0093]

[0094] As can be seen from the table above, from the perspective of accuracy, the LLM after full parameter fine-tuning is significantly better than the latest technical methods in the smart contract vulnerability detection task. Among them, the accuracy of Llama3-8B-FFT and Qwen2-7B-FFT are 0.78 and 0.78 respectively, which are significantly higher than 0.64 and 0.57 of GPTLENS and GPTSCAN.

[0095] Effectiveness of detecting price manipulation vulnerabilities:

[0096] In order to verify the effectiveness of LLM in detecting smart contract price manipulation vulnerabilities, this embodiment conducted experimental analysis on PRE and REC of different vulnerability types. The experimental results are shown in the following table:

[0097] Precision and recall for different vulnerability types

[0098]

[0099] According to the results in the table above, the price manipulation vulnerability (PMV) shows excellent precision on all three LLM models, and the recall rate is also over 0.6. This shows that the LLM model has high accuracy and strong recognition ability when detecting this type of vulnerability. Therefore, LLM is effective in detecting price manipulation vulnerabilities. Since there may be multiple vulnerabilities in the smart contract source code at the same time, this situation will cause LLM to identify and output multiple vulnerability categories, which may increase the number of FPs and thus reduce the precision.

[0100] Effectiveness of sample enhancement:

[0101] In this example, the impact of sample-enhanced ROS on the LLM contract vulnerability detection task with unbalanced data samples is evaluated, and the experimental results are presented in the following table:

[0102] Results of fine-tuning large oracle models enhanced by ROS

[0103]

[0104] Based on the experimental comparison of fine-tuned large language models based on FFT and LoRA and the results of fine-tuned large oracle models enhanced by ROS, it can be seen that the Llama and Qwen models enhanced by ROS data have improved their accuracy by 6% and 7% respectively, and their recall by 9% and 16% respectively compared with the unenhanced models. Therefore, it can be proved that data enhancement ROS is effective to a certain extent for LLM with imbalanced data.

[0105] It should be understood that, although the various steps in the above-mentioned flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flow chart may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0106] In one embodiment, Figure 3 As shown, a smart contract vulnerability detection system based on a fine-tuned large language model is provided, including: a file scanning module 310, a data set processing module 320, a model pre-training module 330, a model fine-tuning module 340 and a vulnerability detection module 350, wherein:

[0107] The file scanning module 310 is used to obtain audited contract projects, scan the files in the contract projects, and obtain dependent contracts;

[0108] The data set processing module 320 is used to obtain a data set based on the dependent contract construction, and optimize and balance the data set to obtain a balanced data set;

[0109] A model pre-training module 330 is used to determine a large language model, design a prompting project for the large language model, and perform model pre-training on the large language model using a balanced data set to obtain a pre-trained large language model;

[0110] A model fine-tuning module 340 is used to introduce a low-rank matrix to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model;

[0111] The vulnerability detection module 350 is used to use the fine-tuned large language model to perform smart contract vulnerability detection and obtain detection results.

[0112] In one embodiment, the file scanning module 310 is also used to use a scanning tool to scan files in the contract project to obtain scanning results; filter out files in the contract project according to the scanning results to obtain target files; for the target files, use a scanning tool to obtain dependent contracts according to the imported code.

[0113] In one embodiment, the data set processing module 320 is also used to: determine the missing library contract based on the dependent contract, integrate the missing library contract into the contract project to obtain a complete decentralized application project; collect the smart contracts in the decentralized application project to construct a data set; wherein the smart contract contains smart contract vulnerabilities; use a random oversampling method to optimize the balanced data set to obtain a balanced data set.

[0114] In one embodiment, the model pre-training module 330 is also used to determine a large language model, obtain the role definition, chain of thought, prior knowledge, requirement specification, and response format corresponding to the large language model; and design a prompt project in combination with the role definition, chain of thought, prior knowledge, requirement specification, and response format.

[0115] In one embodiment, the model fine-tuning module 340 is also used to determine two low-rank matrices, initialize the two low-rank matrices respectively, and calculate the product between the two initialized low-rank matrices; use the product as an updated weight matrix, and use the updated weight matrix to fine-tune the original weight matrix to obtain a fine-tuned large language model.

[0116] In one embodiment, the model fine-tuning module 340 is further used to perform a random Gaussian initialization operation on one low-rank matrix and a zero initialization operation on another low-rank matrix; the two initialized low-rank matrices are multiplied to represent the update of the weights to obtain a product.

[0117] In one embodiment, a smart contract vulnerability detection system based on a fine-tuned large language model is provided, and further includes: a model evaluation module, for determining evaluation indicators; the evaluation indicators include precision, recall, and F1 score; and the fine-tuned large language model is evaluated using the evaluation indicators to obtain an evaluation result.

[0118] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a smart contract vulnerability detection method based on a fine-tuned large language model is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0119] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0120] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of a smart contract vulnerability detection method based on a fine-tuned large language model are implemented.

[0121] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of a smart contract vulnerability detection method based on a fine-tuned large language model are implemented.

[0122] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0123] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0124] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A smart contract vulnerability detection method based on a fine-tuned large language model, characterized in that: The method comprises: Obtain audited contract projects, scan files in the contract projects, and obtain dependent contracts; A data set is obtained based on the dependent contract construction, and the data set is optimized and balanced to obtain a balanced data set; Determine a large language model, design a prompting project for the large language model, and use the balanced data set to perform model pre-training on the large language model to obtain a pre-trained large language model; Introducing a low-rank matrix to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model; The fine-tuned large language model is used to perform smart contract vulnerability detection to obtain a detection result.

2. The smart contract vulnerability detection method based on a fine-tuned large language model according to claim 1 is characterized in that: Obtain audited contract projects, scan the files in the contract projects, and obtain dependent contracts, including: Use a scanning tool to scan the files in the contract project to obtain scanning results; Screening out files in the contract project according to the scanning result to obtain target files; For the target file, the scanning tool is used to obtain the dependent contract according to the imported code.

3. The smart contract vulnerability detection method based on a fine-tuned large language model according to claim 1 is characterized in that: A data set is obtained based on the dependent contract construction, and the data set is optimized and balanced to obtain a balanced data set, including: Determine the missing library contract based on the dependent contract, and integrate the missing library contract into the contract project to obtain a complete decentralized application project; Collect smart contracts in the decentralized application project to construct a data set; wherein the smart contracts contain smart contract vulnerabilities; The data set is optimally balanced using a random oversampling method to obtain a balanced data set.

4. The smart contract vulnerability detection method based on a fine-tuned large language model according to claim 1 is characterized in that: Determine a large language model, and design a prompt project for the large language model, including: Determine a large language model, and obtain role definitions, train of thought chains, prior knowledge, requirement specifications, and response formats corresponding to the large language model; Combine the role definition, thought chain, prior knowledge, requirement specification, and response format to design a prompt project.

5. The smart contract vulnerability detection method based on a fine-tuned large language model according to claim 1 is characterized in that: A low-rank matrix is ​​introduced to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model, including: Obtaining the original weight matrix of the pre-trained large language model; Determine two low-rank matrices, initialize the two low-rank matrices respectively, and calculate the product between the two initialized low-rank matrices; The product is used as an updated weight matrix, and the updated weight matrix is ​​used to fine-tune the original weight matrix to obtain a fine-tuned large language model.

6. The smart contract vulnerability detection method based on a fine-tuned large language model according to claim 5 is characterized in that: Initialize the two low-rank matrices respectively, and calculate the product between the two initialized low-rank matrices, including: Perform a random Gaussian initialization operation on one low-rank matrix and a zero initialization operation on the other low-rank matrix; Multiplying the two initialized low-rank matrices represents the update of the weights and obtains the product.

7. The smart contract vulnerability detection method based on a fine-tuned large language model according to claim 1 is characterized in that: The method further comprises: Determine evaluation indicators; the evaluation indicators include precision, recall, and F1 score; The fine-tuned large language model is evaluated using the evaluation indicator to obtain an evaluation result.

8. A smart contract vulnerability detection system based on a fine-tuned large language model, characterized in that: The system comprises: A file scanning module, used to obtain audited contract projects, scan files in the contract projects, and obtain dependent contracts; A data set processing module, used to obtain a data set based on the dependent contract construction, and optimize and balance the data set to obtain a balanced data set; A model pre-training module, used to determine a large language model, design a prompting project for the large language model, and perform model pre-training on the large language model using the balanced data set to obtain a pre-trained large language model; A model fine-tuning module, used for introducing a low-rank matrix to fine-tune the weights in the pre-trained large language model to obtain a fine-tuned large language model; The vulnerability detection module is used to use the fine-tuned large language model to perform smart contract vulnerability detection and obtain detection results.

9. The smart contract vulnerability detection system based on a fine-tuned large language model according to claim 8, characterized in that: The file scanning module is also used to: use a scanning tool to scan the files in the contract project to obtain a scanning result; filter the files in the contract project according to the scanning result to obtain a target file; for the target file, use the scanning tool to obtain a dependent contract according to the imported code.

10. The smart contract vulnerability detection system based on a fine-tuned large language model according to claim 8, characterized in that: The data set processing module is also used to: determine the missing library contract based on the dependent contract, integrate the missing library contract into the contract project to obtain a complete decentralized application project; collect the smart contracts in the decentralized application project to construct a data set; wherein the smart contract contains a smart contract vulnerability; use a random oversampling method to optimize and balance the data set to obtain a balanced data set.

Images