Intelligent contract attack detection method and system

Abstract

The invention discloses a smart contract attack detection method and system, and relates to the technical field of block chain security, and the method comprises the steps: constructing a behavior feature map of a target smart contract: obtaining the historical transaction information of a target smart contract creator, and constructing a first behavior feature map, decompiling the target smart contract, extracting a calling relation, constructing a second behavior feature map, and combining the first behavior feature map with the second behavior feature map; performing feature extraction and classification on the behavior feature graph based on a graph neural network to obtain an attack risk classification result of the target smart contract; and monitoring a newly created smart contract in the block chain network, taking the newly created smart contract as a target smart contract, repeating the above steps, and outputting an attack detection result. According to the invention, by constructing the smart contract creation behavior graph, unified modeling of the historical behavior and the contract calling relationship of the contract creator is realized for the first time, and the limitation that a traditional method only pays attention to a single feature is broken through.

Description

Technical Field

[0001] The present invention relates to the field of blockchain security technology, and in particular to a smart contract attack detection method and system. Background Art

[0002] The application of blockchain smart contract technology has expanded from the financial field to multiple fields such as medical care and supply chain. Its decentralized and tamper-proof characteristics provide a trusted foundation for business process automation. As a new type of security threat, the state manipulation attack of smart contracts changes the internal state of the contract through a carefully designed transaction sequence, thereby controlling the contract behavior or obtaining illegal gains. This type of attack is highly concealed and can often only be discovered after the attack occurs, causing serious losses to blockchain platforms and users. Existing smart contract security analysis methods mainly focus on static code auditing and post-transaction tracking, and lack the ability to monitor the runtime state of the contract in real time.

[0003] Traditional smart contract vulnerability detection technology mainly relies on fixed rule patterns, which is difficult to cope with the rapid evolution of attack methods. Existing methods usually separate the static code features and dynamic interaction behaviors of contracts, and cannot fully characterize the security risks of contracts. Especially when dealing with state manipulation attacks, it is difficult to identify potential attack patterns in a timely manner due to the lack of comprehensive analysis of the historical behavior of contract creators and contract call relationships. In addition, existing technologies often face the trade-off between computing efficiency and accuracy when dealing with large-scale smart contract networks, and it is difficult to meet the needs of real-time monitoring.

[0004] The smart contract attack detection method based on graph neural network proposed in the present invention belongs to the field of blockchain security technology. By constructing a feature graph that integrates the historical behavior of the contract creator and the contract call relationship, combined with the adaptive feature extraction mechanism of the graph attention network, real-time detection of smart contract state manipulation attacks is achieved, solving the technical problems existing in the prior art such as detection lag, incomplete feature expression, and low real-time monitoring efficiency. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the present invention provides a smart contract attack detection method and system, which can solve the problems mentioned in the background technology.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: a smart contract attack detection method, comprising: constructing a behavior characteristic graph of a target smart contract, including: obtaining historical transaction information of the creator of the target smart contract to construct a first behavior characteristic graph, decompiling the target smart contract to extract the call relationship to construct a second behavior characteristic graph, and merging the first behavior characteristic graph with the second behavior characteristic graph;

[0008] Extract and classify the behavior feature graph based on a graph neural network to obtain an attack risk classification result of the target smart contract;

[0009] Monitor the newly created smart contract in the blockchain network, take the newly created smart contract as the target smart contract, repeat the above steps, and output the attack detection result.

[0010] As a preferred solution of the smart contract attack detection method of the present invention, the construction process of the first behavior feature graph is as follows:

[0011] Obtain the creator address and creation block information of the target smart contract;

[0012] According to the creator address and the creation block information, the historical transaction data of the creator is obtained, the historical transactions with transfer behavior are constructed as a first type of edge set, the historical transactions with contract function call behavior are constructed as a second type of edge set, and the historical transactions with smart contract creation behavior are constructed as a third type of edge set. The first behavior feature graph is constructed based on the first type of edge set, the second type of edge set, and the third type of edge set.

[0013] As a preferred solution of the smart contract attack detection method of the present invention, the construction process of the second behavior characteristic graph is as follows:

[0014] Decompile the target smart contract, extract the external contract address and function call signature in the target smart contract, directly extract if the external contract address comes from hard coding, extract based on storage slot number and offset if the external contract address comes from contract storage, and extract based on parameter matching if the external contract address comes from function parameters, construct the call relationship of the target smart contract as a fourth type of edge set, and construct the second behavior feature graph based on the fourth type of edge set;

[0015] The step of merging the first behavior characteristic graph and the second behavior characteristic graph comprises the following steps:

[0016] The nodes in the first behavior characteristic graph and the nodes in the second behavior characteristic graph are normalized and identified, the nodes with the same identification in the first behavior characteristic graph and the second behavior characteristic graph are merged, the relationship between the first type of edge set, the second type of edge set, the third type of edge set and the fourth type of edge set is kept unchanged, and the behavior characteristic graph is constructed.

[0017] As a preferred solution of the smart contract attack detection method of the present invention, the construction process of the second behavior characteristic graph is as follows:

[0018] Decompile the target smart contract, extract the external contract address and function call signature in the target smart contract, directly extract if the external contract address comes from hard coding, extract based on storage slot number and offset if the external contract address comes from contract storage, and extract based on parameter matching if the external contract address comes from function parameters, construct the call relationship of the target smart contract as a fourth type of edge set, and construct the second behavior feature graph based on the fourth type of edge set;

[0019] The step of merging the first behavior characteristic graph and the second behavior characteristic graph comprises the following steps:

[0020] The nodes in the first behavior characteristic graph and the nodes in the second behavior characteristic graph are normalized and identified, the nodes with the same identification in the first behavior characteristic graph and the second behavior characteristic graph are merged, the relationship between the first type of edge set, the second type of edge set, the third type of edge set and the fourth type of edge set is kept unchanged, and the behavior characteristic graph is constructed.

[0021] As a preferred solution of the smart contract attack detection method described in the present invention, wherein: the aggregated feature vector is edge set weighted; wherein, the edge set weight coefficients are calculated for the first to fourth edge sets respectively, and the edge set weight coefficients are multiplied by the aggregated feature vector and then feature fusion is performed to generate a fused feature vector of the target smart contract.

[0022] As a preferred solution of the smart contract attack detection method described in the present invention, wherein: monitoring the newly created smart contract in the blockchain network, taking the newly created smart contract as the target smart contract, repeating the above steps, and outputting the attack detection result, comprises the following steps:

[0023] Establish a communication connection with the blockchain node through the remote procedure call interface, traverse the transaction information in the block, and extract transaction data with smart contract creation characteristics;

[0024] Parsing the smart contract bytecode in the transaction data, taking the smart contract corresponding to the smart contract bytecode as the target smart contract, and executing the steps of constructing a smart contract creation behavior graph and classifying attack risks;

[0025] Generate smart contract security warning information based on the attack risk classification result. If the target smart contract is a state manipulation attack contract, output an attack warning, otherwise continue to execute the transaction information extraction step.

[0026] As a preferred solution of the smart contract attack detection method described in the present invention, wherein: monitoring the newly created smart contract in the blockchain network, taking the newly created smart contract as the target smart contract, repeating the above steps, and outputting the attack detection result, comprises the following steps:

[0027] Establish a communication connection with the blockchain node through the remote procedure call interface, traverse the transaction information in the block, and extract transaction data with smart contract creation characteristics;

[0028] Parsing the smart contract bytecode in the transaction data, taking the smart contract corresponding to the smart contract bytecode as the target smart contract, and executing the steps of constructing a smart contract creation behavior graph and classifying attack risks;

[0029] Generate smart contract security warning information based on the attack risk classification result. If the target smart contract is a state manipulation attack contract, output an attack warning, otherwise continue to execute the transaction information extraction step.

[0030] To further solve the above technical problems, the present invention provides the following technical solutions: A smart contract attack detection system, comprising: a feature graph construction module, used to obtain historical transaction information of the creator of the target smart contract to construct a first behavior feature graph, decompile the target smart contract to extract the call relationship to construct a second behavior feature graph, and merge the first behavior feature graph with the second behavior feature graph;

[0031] A risk classification module, used to extract and classify the behavior feature graph based on a graph neural network to obtain an attack risk classification result of the target smart contract;

[0032] The real-time monitoring module is used to monitor the newly created smart contract in the blockchain network, take the newly created smart contract as the target smart contract, execute the feature graph construction and risk classification steps, and output the attack detection result.

[0033] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and wherein the processor implements the steps of the smart contract attack detection method as described above when executing the computer program.

[0034] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the smart contract attack detection method as described above are implemented.

[0035] Beneficial effects of the present invention: By constructing a smart contract creation behavior graph, the present invention realizes the unified modeling of the historical behavior of the contract creator and the contract call relationship for the first time, breaking through the limitation of the traditional method that only focuses on a single feature; using a graph attention network for feature extraction, accurately identifying key interaction patterns through an adaptive weight calculation mechanism, and improving the ability to detect complex attack behaviors; in the real-time monitoring link, through characterized transaction screening and parallel processing mechanisms, the system overhead is significantly reduced, and efficient monitoring of large-scale smart contract networks is achieved. This solution not only improves the accuracy and timeliness of attack detection, but also has the ability to generalize new attack patterns, providing an innovative technical path for smart contract security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0037] Figure 1 This is a schematic diagram of the overall process of a smart contract attack detection method proposed by the present invention;

[0038] Figure 2 A diagram of computer equipment in a smart contract attack detection method proposed in the present invention. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0040] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0041] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a smart contract attack detection method.

[0042] S1: Constructing a behavior characteristic graph of a target smart contract, including: obtaining historical transaction information of the creator of the target smart contract to construct a first behavior characteristic graph, decompiling the target smart contract to extract the call relationship to construct a second behavior characteristic graph, and merging the first behavior characteristic graph with the second behavior characteristic graph.

[0043] S1.1: Get the creator address and creation block information of the target smart contract.

[0044] S1.2: According to the creator's address and creation block information, the creator's historical transaction data is obtained, and the historical transactions with transfer behavior are constructed as the first type of edge set, the historical transactions with contract function call behavior are constructed as the second type of edge set, and the historical transactions with smart contract creation behavior are constructed as the third type of edge set. Based on the first type of edge set, the second type of edge set and the third type of edge set, the first behavior feature graph is constructed.

[0045] S1.3: Decompile the target smart contract, extract the external contract address and function call signature in the target smart contract. If the external contract address comes from hard coding, it is directly extracted. If the external contract address comes from contract storage, it is extracted based on storage slot number and offset. If the external contract address comes from function parameters, it is extracted based on parameter matching. The call relationship of the target smart contract is constructed as a fourth type of edge set, and the second behavior feature graph is constructed based on the fourth type of edge set.

[0046] S1.4: Normalize the nodes in the first behavior characteristic graph and the nodes in the second behavior characteristic graph, merge the nodes with the same identification in the first behavior characteristic graph and the second behavior characteristic graph, keep the relationship between the first type edge set, the second type edge set, the third type edge set and the fourth type edge set unchanged, and construct the behavior characteristic graph.

[0047] It should be noted that the behavior feature graph in the present invention includes two types of nodes: account address nodes and contract function nodes, as well as three types of edges: transfer, function call and contract creation. This heterogeneous graph structure can simultaneously characterize the static code features and dynamic interaction features of smart contracts. By integrating the creator's historical transaction behavior and contract call relationship into a unified graph structure, the limitation of traditional methods that only focus on a single feature is broken. In S1.3, the external contract address is extracted through three methods: hard coding, storage slots and function parameters, which solves the technical problem of multi-source storage of address information in smart contracts. The node normalization method used in S1.4 realizes the effective fusion of heterogeneous information while keeping the edge set relationship unchanged, improves the graph structure's ability to characterize contract behavior patterns, and provides a more comprehensive feature basis for subsequent attack detection.

[0048] Preferably, in a specific embodiment of the present invention, the process of constructing a behavior feature graph first needs to solve the problem of multi-source acquisition of smart contract information. The creator address and creation block information of the target smart contract are obtained through the remote procedure call interface of the blockchain node. These basic information are the key entry points for constructing the behavior feature graph, enabling the system to trace the creation history of the contract. When obtaining the creator's historical transaction data, the present invention divides the transaction behavior into three categories: transfer, function call, and contract creation, and constructs different types of edge sets respectively. This classification method can more accurately characterize the interaction pattern between accounts, especially in identifying suspicious fund flows and abnormal contract call patterns. In the contract call relationship extraction link, the present invention first checks the hard-coded address in the contract code, then obtains the address stored in the contract state through the storage slot number and offset, and finally obtains the address parameter in the function call through parameter matching. This hierarchical extraction strategy ensures that no possible external call relationship is missed. In the graph integration stage, the node normalization identification method is adopted to achieve the fusion of heterogeneous information while maintaining the integrity of the edge set. This method not only reduces the redundancy of the graph, but also improves the graph structure's ability to express contract behavior characteristics, laying the foundation for subsequent attack detection.

[0049] S2: Extract and classify the behavior feature graph based on the graph neural network to obtain the attack risk classification result of the target smart contract.

[0050] S2.1: Use the bag-of-words model to encode the features of the nodes in the behavior feature graph and convert the node address information and function signature information into a node feature vector.

[0051] S2.2: Extract features from node feature vectors based on the graph attention network, perform weighted feature aggregation by calculating the attention coefficients between nodes, and generate an aggregated feature vector of the node. If there are multiple layers of graph attention networks, perform nonlinear transformation on the aggregated feature vector and repeat the feature aggregation process.

[0052] It should be noted that the aggregated feature vector is edge-set weighted; wherein, the edge-set weight coefficients are calculated for the first to fourth edge sets respectively, and the edge-set weight coefficients are multiplied by the aggregated feature vector to perform feature fusion to generate the fused feature vector of the target smart contract.

[0053] S2.3: The aggregated feature vectors are summarized using the average pooling method, and the attack risk classification results of the target smart contract are output after being processed by the random deactivation layer and the fully connected layer.

[0054] In a specific embodiment of the present invention, the feature extraction and classification process based on graph neural network first solves the problem of high-dimensional heterogeneous representation of smart contract behavior features. Traditional methods often process the address information and function call information of smart contracts separately, making it difficult to capture the correlation between them. The present invention uses the bag-of-words model to encode the features of nodes, uniformly maps the address information and function signature information to the same feature space, and realizes the unified representation of heterogeneous information.

[0055] In the feature extraction stage, the present invention adopts a graph attention network structure, which breaks through the limitation of traditional graph neural networks that aggregate all neighbor nodes with equal weights. By calculating the attention coefficients between nodes, the system can adaptively identify neighbor nodes that are more important to the current node, enhancing the ability to characterize the interaction mode of smart contracts. Especially when dealing with multi-layer networks, through nonlinear transformation and repeated feature aggregation, the model can capture more complex contract interaction patterns.

[0056] In the final classification decision stage, the present invention adopts a combination of average pooling and random dropout. Average pooling ensures full utilization of the full-image features, while the random dropout mechanism effectively prevents the model from overfitting to specific patterns and improves the generalization ability of attack detection. This design significantly improves the ability to identify unknown attack patterns while maintaining the simplicity of the model.

[0057] Compared with the existing technology, the present invention realizes accurate modeling of contract interaction patterns through the graph attention mechanism, breaking through the limitation of traditional methods that only focus on static code features or single interaction features. This method not only improves the accuracy of attack detection, but also has the ability to generalize new attack patterns. Especially when dealing with complex state manipulation attacks, it can automatically identify key interaction patterns through the attention mechanism, providing a new technical path for smart contract security analysis.

[0058] S3: Monitor the newly created smart contract in the blockchain network, take the newly created smart contract as the target smart contract, repeat the above steps, and output the attack detection results.

[0059] S3.1: Establish a communication connection with the blockchain node through the remote procedure call interface, traverse the transaction information in the block, and extract transaction data with smart contract creation characteristics.

[0060] S3.2: Parse the smart contract bytecode in the transaction data, take the smart contract corresponding to the smart contract bytecode as the target smart contract, and execute steps S1 and S2.

[0061] S3.3: Generate smart contract security warning information based on the attack risk classification results. If the target smart contract is a state manipulation attack contract, output an attack warning, otherwise continue to execute step S3.1.

[0062] The transaction information in the block is sorted by creation time to form a transaction sequence, and adjacent transactions in the transaction sequence are analyzed for correlation. If it is detected that continuously created smart contracts have similar bytecode features, these smart contracts are classified into the same attack group for risk assessment.

[0063] In a specific embodiment of the present invention, the real-time monitoring system of smart contracts first solves the technical problem of hysteresis detection in traditional methods. The existing technology usually finds problems only after the attack occurs, and it is difficult to achieve preventive protection. The present invention establishes a real-time communication mechanism with the blockchain node, and starts risk assessment in the smart contract deployment stage, which greatly advances the protection time window. In terms of transaction data processing, the present invention designs an identification mechanism for smart contract creation features. Traditional methods often require complete analysis of all transaction data, resulting in a large computational overhead. The present invention directly locates contract creation transactions through feature extraction, significantly improving monitoring efficiency. Especially when dealing with high-frequency trading scenarios, this method can effectively reduce system load and maintain stable processing performance. The present invention adopts a closed-loop early warning mechanism in the risk assessment link, breaking through the limitations of traditional passive monitoring. By instantly sending the newly created smart contract into the risk assessment model, the system can identify potential threats before the attack behavior actually occurs. This active early warning mechanism not only improves the timeliness of protection, but also provides sufficient preparation time for the deployment of defense measures.

[0064] Compared with the existing technology, the real-time monitoring solution of the present invention has significant advantages: first, through feature recognition, it can realize the rapid positioning of contract creation and reduce system resource consumption; second, through real-time evaluation, it establishes a complete closed loop from discovery to early warning, which improves the initiative of protection; finally, through the continuous monitoring mechanism, it ensures the reliable operation of the system, providing a strong guarantee for the safe operation of the blockchain ecosystem.

[0065] In summary, the present invention realizes the unified modeling of the historical behavior of the contract creator and the contract call relationship for the first time by constructing a smart contract creation behavior graph, breaking through the limitation of the traditional method that only focuses on a single feature; it uses a graph attention network for feature extraction, accurately identifies key interaction patterns through an adaptive weight calculation mechanism, and improves the detection capability of complex attack behaviors; in the real-time monitoring link, through the characterized transaction screening and parallel processing mechanism, it significantly reduces the system overhead and realizes efficient monitoring of large-scale smart contract networks. This solution not only improves the accuracy and timeliness of attack detection, but also has the ability to generalize new attack patterns, providing an innovative technical path for smart contract security protection.

[0066] Embodiment 2 is an embodiment of the present invention, which provides a smart contract attack detection system, including:

[0067] A feature graph construction module, used to obtain historical transaction information of the creator of the target smart contract to construct a first behavior feature graph, decompile the target smart contract to extract the call relationship to construct a second behavior feature graph, and merge the first behavior feature graph with the second behavior feature graph;

[0068] A risk classification module, used to extract and classify the behavior feature graph based on a graph neural network to obtain an attack risk classification result of the target smart contract;

[0069] The real-time monitoring module is used to monitor the newly created smart contract in the blockchain network, take the newly created smart contract as the target smart contract, execute the feature graph construction and risk classification steps, and output the attack detection result.

[0070] Example 3, reference Figure 2 , is an embodiment of the present invention, which is different from the previous embodiment in that: if the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0071] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0072] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0073] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0074] Example 4 is an embodiment of the present invention, which provides a smart contract attack detection method. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0075] To verify the effectiveness of the method of the present invention, this embodiment constructs a test data set containing normal contracts and state manipulation attack contracts. The experiment compares the traditional static code analysis method, the transaction sequence analysis method and the detection method based on graph neural network proposed in the present invention. The experimental environment uses a standard Ethereum test network to obtain smart contract creation information in real time through the remote procedure call interface. In the feature extraction stage, the combination effects of different types of edge sets were tested separately to verify the necessity of multi-source information fusion. During the model training process, a five-fold cross-validation was used to evaluate the generalization performance of the model, and the model structure was optimized by adjusting the number of layers and node feature dimensions of the graph attention network.

[0076] In the real-time monitoring performance test, this embodiment designs a stress test solution under high concurrency scenarios. By simulating contract creation events of different frequencies, the response time and resource usage of the test system are tested. Special attention is paid to the performance when processing large-scale smart contract networks. By comparing the processing efficiency under different scale data sets, the scalability of the method of the present invention in actual application scenarios is verified.

[0077] Table 1 Comparison of test results by detection method

[0078]

[0079]

[0080] As shown in Table 1, the present invention is significantly superior to traditional methods in multiple key indicators. In terms of attack detection rate, the present invention achieves a detection rate of 0.91, which is 26.4% and 16.7% higher than static code analysis and transaction sequence analysis respectively; the false alarm rate is reduced to 0.06, which is more than half of the traditional method. In terms of performance, the average response time of the present invention is only 320 milliseconds, which is more than 50% higher than the traditional method. At the same time, the concurrent processing capacity reaches 280TPS, which significantly improves the real-time monitoring efficiency of the system. Although the memory usage of the method of the present invention is slightly higher than that of the traditional method, this resource overhead is acceptable considering the significantly improved detection performance. Especially in high-concurrency scenarios, the present invention exhibits better scalability and stability, which fully proves the superiority of this method in practical applications.

[0081] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A smart contract attack detection method, characterized in that: include: Constructing a behavior characteristic graph of a target smart contract, including: acquiring historical transaction information of a creator of the target smart contract to construct a first behavior characteristic graph, decompiling the target smart contract to extract a call relationship to construct a second behavior characteristic graph, and merging the first behavior characteristic graph with the second behavior characteristic graph; Extract and classify the behavior feature graph based on a graph neural network to obtain an attack risk classification result of the target smart contract; Monitor the newly created smart contract in the blockchain network, take the newly created smart contract as the target smart contract, repeat the above steps, and output the attack detection result.

2. The smart contract attack detection method according to claim 1, characterized in that: The construction process of the first behavior characteristic graph is as follows: Obtain the creator address and creation block information of the target smart contract; According to the creator address and the creation block information, the historical transaction data of the creator is obtained, the historical transactions with transfer behavior are constructed as a first type of edge set, the historical transactions with contract function call behavior are constructed as a second type of edge set, and the historical transactions with smart contract creation behavior are constructed as a third type of edge set. The first behavior feature graph is constructed based on the first type of edge set, the second type of edge set, and the third type of edge set.

3. The smart contract attack detection method according to claim 2, characterized in that: The construction process of the second behavior characteristic graph is as follows: Decompile the target smart contract, extract the external contract address and function call signature in the target smart contract, directly extract if the external contract address comes from hard coding, extract based on storage slot number and offset if the external contract address comes from contract storage, and extract based on parameter matching if the external contract address comes from function parameters, construct the call relationship of the target smart contract as a fourth type of edge set, and construct the second behavior feature graph based on the fourth type of edge set; The step of merging the first behavior characteristic graph and the second behavior characteristic graph comprises the following steps: The nodes in the first behavior characteristic graph and the nodes in the second behavior characteristic graph are normalized and identified, the nodes with the same identification in the first behavior characteristic graph and the second behavior characteristic graph are merged, the relationship between the first type of edge set, the second type of edge set, the third type of edge set and the fourth type of edge set is kept unchanged, and the behavior characteristic graph is constructed.

4. The smart contract attack detection method according to claim 3, characterized in that: Feature extraction and classification of the behavior feature graph are performed based on a graph neural network to obtain an attack risk classification result of the target smart contract, including the following steps: Using a bag-of-words model to perform feature encoding on the nodes in the behavior feature graph, and converting the address information and function signature information of the nodes into node feature vectors; Extract features from the node feature vector based on the graph attention network, perform weighted feature aggregation by calculating the attention coefficients between nodes, and generate an aggregated feature vector of the node. If there are multiple layers of the graph attention network, perform nonlinear transformation on the aggregated feature vector and repeat the feature aggregation process; The aggregated feature vectors are summarized by average pooling, and the attack risk classification result of the target smart contract is output after being processed by a random dropout layer and a fully connected layer.

5. The smart contract attack detection method according to claim 4, characterized in that: The aggregated feature vector is edge-set weighted; wherein, edge-set weight coefficients are calculated for the first to fourth edge sets respectively, and feature fusion is performed after the edge-set weight coefficients are multiplied by the aggregated feature vector to generate a fused feature vector of the target smart contract.

6. The smart contract attack detection method according to claim 5, characterized in that: Monitoring the newly created smart contract in the blockchain network, taking the newly created smart contract as the target smart contract, repeating the above steps, and outputting the attack detection result, including the following steps: Establish a communication connection with the blockchain node through the remote procedure call interface, traverse the transaction information in the block, and extract transaction data with smart contract creation characteristics; Parsing the smart contract bytecode in the transaction data, taking the smart contract corresponding to the smart contract bytecode as the target smart contract, and executing the steps of constructing a smart contract creation behavior graph and classifying attack risks; Generate smart contract security warning information based on the attack risk classification result. If the target smart contract is a state manipulation attack contract, output an attack warning, otherwise continue to execute the transaction information extraction step.

7. The smart contract attack detection method according to claim 6, characterized in that: The transaction information in the block is sorted according to the creation time to form a transaction sequence, and adjacent transactions in the transaction sequence are subjected to correlation analysis. If it is detected that continuously created smart contracts have similar bytecode features, these smart contracts are classified into the same attack group for risk assessment.

8. A smart contract attack detection system, based on the smart contract attack detection method according to any one of claims 1 to 7, characterized in that: include, A feature graph construction module, used to obtain historical transaction information of the creator of the target smart contract to construct a first behavior feature graph, decompile the target smart contract to extract the call relationship to construct a second behavior feature graph, and merge the first behavior feature graph with the second behavior feature graph; A risk classification module, used to extract and classify the behavior feature graph based on a graph neural network to obtain an attack risk classification result of the target smart contract; The real-time monitoring module is used to monitor the newly created smart contract in the blockchain network, take the newly created smart contract as the target smart contract, execute the feature graph construction and risk classification steps, and output the attack detection result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the smart contract attack detection method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the smart contract attack detection method described in any one of claims 1 to 7 are implemented.

Images