Multi-index feedback driven intelligent contract fuzzy test method and related device

Abstract

The invention provides a multi-index feedback-driven intelligent contract fuzzy test method and a related device, and the method comprises the steps: obtaining a given intelligent contract, extracting the semantic information of the given intelligent contract through employing a static analysis technology, and generating a transaction sequence seed, and putting the transaction sequence seed into a seed pool; then, a test transaction sequence is taken out from the pool, a test is executed on the instrumentation EVM, multi-index execution feedback information is collected, the fitness of the test transaction sequence is calculated by integrating the information, seeds meeting set conditions are screened out to serve as next-generation seeds, the rest seeds are discarded, then the seeds are subjected to random variation to complement the number, and then combination is conducted to obtain a new seed pool. And continuously and circularly repeating the test steps until a stop condition is met, and completing the test of the smart contract. Through multi-index feedback driving, the test case can be more comprehensively and accurately generated, complex code branches of the smart contract are effectively covered, the vulnerability detection efficiency is improved, economic losses caused by smart contract vulnerabilities are reduced, and the security and reliability of smart contract application are enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of Ethereum smart contract security technology, and specifically relates to a multi-indicator feedback driven smart contract fuzz testing method and related devices. Background Art

[0002] Due to the immutable and decentralized nature of blockchain and smart contracts, many applications have begun to be built using smart contracts, such as decentralized finance, supply chain, voting, and gaming. These smart contracts manage a large number of assets on the blockchain. For example, the total market value of Ethereum and the smart contracts running on it has exceeded $100 billion. However, as the functionality of smart contracts and the businesses they support become increasingly complex, the code size of smart contracts has increased, and the vulnerabilities in smart contracts have also become more diverse and complex, causing hundreds of millions of dollars in economic losses. Therefore, the vulnerability problem of smart contracts has become an important and urgent problem that needs to be solved.

[0003] As a common method for software vulnerability mining, fuzz testing has become an important technical route for vulnerability detection of smart contracts. Fuzz testing framework is a method for automatically testing smart contract vulnerabilities. The framework analyzes the interface of the smart contract to generate inputs that conform to the call syntax of the smart contract under test. Then, the framework generates a series of random inputs according to the algorithm and initiates transactions to the corresponding contract, trying to cover as many contract code branches as possible, and combines manually defined rules called oracles to analyze whether the input sequence triggers contract vulnerabilities. However, most of the current fuzz testing tools for smart contracts still have some problems. For example, many branches with strict protection conditions require a very long time to generate test cases that can be covered or cannot be covered, which reduces the vulnerability detection rate and practicality of fuzz testing, and thus makes the results of fuzz testing unguaranteed. At present, many research works have proposed some feedback indicators to enable the algorithm to generate test cases more purposefully and improve the efficiency of the tool to cover branches with strict conditions. However, the feedback indicators used by the existing methods are based on different considerations, and there is still a certain inefficiency. Summary of the invention

[0004] In view of this, the present invention proposes a multi-indicator feedback-driven smart contract fuzz testing method and related devices to address the feedback indicator limitations of various current studies, so as to help fuzz testing tools cover smart contract code branches more efficiently and improve vulnerability detection efficiency.

[0005] In order to achieve the above object, the technical solution provided by the present invention is as follows:

[0006] In a first aspect, the present invention provides a multi-indicator feedback driven smart contract fuzz testing method, comprising the following steps:

[0007] Get the given smart contract;

[0008] Use static analysis techniques to extract semantic information of smart contracts;

[0009] Generate a number of transaction sequence seeds based on semantic information and put them into the initial transaction sequence seed pool;

[0010] Take the test transaction sequence from the transaction sequence seed pool, execute the test on the stub EVM and collect multi-indicator execution feedback information;

[0011] Calculate the fitness for each test trading sequence taking into account the execution feedback information of multiple indicators;

[0012] Select the test transaction sequences whose fitness meets the set conditions as the seeds of the next generation of test cases, and discard the rest;

[0013] Randomly mutate the test case seeds to generate several new test cases to make up for the number of discarded test cases;

[0014] Combine all current test case seeds to obtain a new transaction sequence seed pool;

[0015] Based on the new transaction sequence seed pool, the test steps are repeated until the set stop condition is reached, completing the test of the given smart contract.

[0016] Furthermore, the multi-indicator execution feedback information includes at least:

[0017] Execution path constraints, code coverage, branch condition distances, read and write memory locations, and data flow relationships.

[0018] Furthermore, multiple indicators of execution feedback information are collected, including:

[0019] Use taint analysis technology to introduce conditional symbol constraints when executing conditional branch statements, and obtain the execution path constraints of smart contract code branches based on the conditional symbol constraints;

[0020] Track and record the program counter of the EVM during execution and calculate the coverage rate;

[0021] When a conditional branch statement is executed, the difference between the value of the branch condition variable and the value that the branch condition variable should satisfy is recorded, thereby calculating the branch condition distance;

[0022] When the storage read / write instruction is executed, the storage location corresponding to the read / write is recorded to obtain the read / write storage location;

[0023] The read and write storage positions of each transaction in the transaction sequence are compared and analyzed, and the data flow relationship between the transactions is obtained based on the overlapping parts of the read and write positions.

[0024] Furthermore, before obtaining a new transaction sequence seed pool, if the coverage rate does not improve after multiple iterations, it also includes:

[0025] The symbolic constraint solver is used to solve the conditional symbolic constraints collected when running the test cases, and the test input that can satisfy the conditional symbolic constraints is obtained and added to the next generation of test cases.

[0026] Furthermore, the transaction sequence seed includes a first transaction sequence seed generated using deep learning technology. The deep learning technology uses semantic information as model input and uses a pre-trained neural network model to generate key information of the transaction sequence, thereby obtaining the first transaction sequence seed.

[0027] Furthermore, the transaction sequence seed also includes a second transaction sequence seed generated using random combined with data flow analysis technology. The random combined with data flow analysis technology generates a number of transactions by randomly applying a binary interface, and then combines transactions that may have dependencies through data flow analysis technology to obtain a second transaction sequence seed.

[0028] Furthermore, all current test case seeds are combined, including:

[0029] Combine all current test case seeds in a random manner and / or use data flow relationships as input to the deep learning model to combine transaction sequences that the deep learning model believes are correlated.

[0030] In a second aspect, the present invention provides a multi-indicator feedback driven smart contract fuzz testing method, comprising the following steps:

[0031] The contract acquisition module is used to obtain a given smart contract;

[0032] Semantic information extraction module, used to extract semantic information of smart contracts using static analysis technology;

[0033] A seed pool generation module is used to generate a number of transaction sequence seeds based on semantic information and put them into an initial transaction sequence seed pool;

[0034] The test execution module is used to extract the test transaction sequence from the transaction sequence seed pool, execute the test on the stub EVM and collect multi-indicator execution feedback information;

[0035] The seed pool update module is used to calculate the fitness of each test transaction sequence taking into account the multi-indicator execution feedback information; it is also used to select the test transaction sequences whose fitness meets the set conditions as the next generation of test case seeds, and discard the rest; it is also used to randomly mutate the test case seeds to generate several new test cases to make up for the number of discarded test cases; it is also used to combine all the current test case seeds to obtain a new transaction sequence seed pool;

[0036] The loop test module is used to repeat the test steps based on the new transaction sequence seed pool until the set stop condition is reached, thus completing the test of the given smart contract.

[0037] In a third aspect, the present invention provides a computer device, the device comprising a processor and a memory:

[0038] The memory is used to store the computer program and send the instructions of the computer program to the processor;

[0039] The processor executes a multi-indicator feedback-driven smart contract fuzz testing method as described in the first aspect according to the instructions of the computer program.

[0040] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, a multi-indicator feedback-driven smart contract fuzz testing method as in the first aspect is implemented.

[0041] In summary, the present invention provides a multi-indicator feedback-driven smart contract fuzz testing method and related devices. By obtaining a given smart contract and using static analysis technology to extract its semantic information, a transaction sequence seed is generated and placed in a seed pool. Then the test transaction sequence is taken out from the pool, the test is performed on the stub EVM and multi-indicator execution feedback information is collected. The fitness of the test transaction sequence is calculated based on this information, and those that meet the set conditions are selected as the next generation of seeds. The rest are discarded, and then the seeds are randomly mutated to make up the number, and then combined to obtain a new seed pool. The test steps are repeated in a continuous cycle until the stop condition is met to complete the test of the smart contract. Driven by multi-indicator feedback, the present invention can generate test cases more comprehensively and accurately, effectively cover complex code branches of smart contracts, improve vulnerability detection efficiency, reduce economic losses caused by smart contract vulnerabilities, and enhance the security and reliability of smart contract applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A flowchart of a multi-indicator feedback-driven smart contract fuzz testing method provided by an embodiment of the present invention;

[0044] Figure 2 A test flow chart based on selected multi-indicator execution feedback information provided by an embodiment of the present invention;

[0045] Figure 3 A block diagram of a multi-indicator feedback-driven smart contract fuzz testing device provided by an embodiment of the present invention;

[0046] Figure 4 A block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] First, some technical terms involved in the technical solution of the present invention are explained as follows:

[0049] (1) Blockchain: It is a distributed ledger technology that packages transaction records into blocks and links them in chronological order to form an unalterable record chain. Each block contains the hash value of the previous block, thus ensuring the integrity and security of the data. The decentralized nature of blockchain technology enables all participating nodes to share ledger information, ensuring data transparency and tamper-proofing. It is widely used in cryptocurrency, finance, supply chain management and other fields.

[0050] (2) Smart contract: It is an automated protocol running on the blockchain that can automatically execute terms and operations when specific conditions are met. Smart contracts are written in a programming language and deployed on the blockchain network. The decentralization and immutability of the blockchain ensure the reliability and transparency of contract execution. Once a smart contract is deployed on the blockchain, it cannot be modified. Smart contracts are often used in scenarios such as automated transactions, protocol execution, and the development of decentralized applications.

[0051] (3) Fuzz testing: Generate transactions for executing smart contracts through certain rules (or randomly). In addition to the code coverage indicator, the execution process of the smart contract will also generate corresponding state changes and corresponding logs. These indicators can be used to detect vulnerabilities in smart contracts.

[0052] (4) Evolutionary Algorithms: In fuzz testing, evolutionary algorithms refer to a type of optimization technology that draws on the biological evolution process in nature and is used to automatically generate and improve fuzz test cases. This type of algorithm simulates biological phenomena such as natural selection, inheritance, and mutation, starting from initial random or predefined test cases, and through an iterative process, gradually evolves effective inputs that are more likely to trigger specific paths within the software or expose potential defects. Evolutionary algorithms can explore a wider input space without a clear vulnerability model, improve the coverage and efficiency of fuzz testing, and thus enhance the ability to detect software defects.

[0053] The present invention is only for smart contracts written in Solidity language and oriented to Ethereum blockchain, which are executed using EVM (Ethereum Virtual Machine).

[0054] See also Figure 1 , this embodiment provides a multi-indicator feedback driven smart contract fuzz testing method, including the following steps:

[0055] S1: Get the given smart contract.

[0056] It should be noted that this step obtains a given smart contract and determines it as the object of this test.

[0057] S2: Use static analysis techniques to extract semantic information of smart contracts.

[0058] It should be noted that static analysis technology refers to the technical means of analyzing the syntax structure, control flow, data dependency and other aspects of the code without actually executing the program code. Semantic information refers to the deep meaning contained in the smart contract code, such as the application binary interface (ABI, which describes the specification of how the contract interface is called), the storage variable list (the variables defined in the contract for storing data), the code abstract syntax tree (a tree structure represents the syntax structure of the code, which is convenient for analyzing the logical relationship of the code), and the code control flow graph (which shows the execution order of statements in the code and possible branch flow directions).

[0059] This step uses static analysis technology to perform lexical and grammatical analysis on the smart contract code, and then constructs structures such as abstract syntax trees, and then extracts the above-mentioned semantic information from them, such as obtaining a list of storage variables by scanning the variable definition part in the code, and analyzing the function call relationship to obtain the application binary interface related content, etc. This provides a key data foundation for subsequent operations such as generating transaction sequence seeds, understanding contract logic, and judging test coverage, which helps to understand the internal structure and functional characteristics of the contract.

[0060] S3: Generate a number of transaction sequence seeds based on semantic information and put them into the initial transaction sequence seed pool.

[0061] It should be noted that the transaction sequence seed is an initial template or basic example of a series of transaction behaviors that simulate the interaction between users and smart contracts. These transaction behaviors are arranged in a certain order. The transaction sequence seed pool is a collection container for storing these seeds, which are used to select them for subsequent testing operations.

[0062] This step constructs a series of transaction sequences according to certain rules and strategies based on the semantic information extracted from the smart contract, such as the function interface and input and output parameter requirements provided by the contract, and puts them into a specially created transaction sequence seed pool as seeds. Through this step, a basic test material set for the start of fuzz testing can be constructed, and then the test case set can be enriched by continuously mutating and combining these seeds, so as to test the smart contract more comprehensively.

[0063] S4: Take the test transaction sequence from the transaction sequence seed pool, execute the test on the stub EVM and collect multi-indicator execution feedback information.

[0064] It should be noted that EVM is the operating environment in Ethereum for executing smart contract bytecode, and stub is a technical means of inserting specific code snippets (stub code) into program code or operating environment to realize information collection, monitoring and other functions. Stub EVM means obtaining various relevant information during the contract execution process through stub in the EVM operating environment.

[0065] Multi-indicator execution feedback information refers to the relevant feedback information collected from multiple dimensions during the execution of the smart contract test transaction sequence.

[0066] This step takes one or more test transaction sequences from the transaction sequence seed pool, and then runs them in the EVM environment after the stub processing. During the operation, the pre-inserted stub code is used to capture and record the multi-indicator execution feedback information mentioned above in real time. Through this step, the test transaction sequence can be executed to obtain multi-dimensional feedback information during the actual operation. This information will serve as an important basis for subsequent judgments on the quality of the test transaction sequence and whether to continue to adopt it, which will help to accurately guide the optimization and generation direction of test cases.

[0067] S5: Calculate the fitness considering multi-indicator execution feedback information for each test transaction sequence.

[0068] It should be noted that in the evolutionary algorithm, fitness is used to measure the quality of an individual (in this embodiment, the test transaction sequence) in the test environment. The collected multi-indicator execution feedback information is comprehensively considered, and a numerical value is assigned to each test transaction sequence to represent its fitness through a specific calculation method. The higher the value, the more the test transaction sequence meets the expected test goal.

[0069] This step uses the pre-set fitness calculation function, takes the collected multi-indicator execution feedback information as input parameters, and calculates the fitness value corresponding to each test transaction sequence according to the corresponding weighting, scoring and other rules. This step evaluates the quality of each test transaction sequence in a quantitative way, which facilitates the subsequent screening and selection of more valuable test transaction sequences to further expand the test case set.

[0070] S6: Select the test transaction sequences whose fitness reaches the set conditions as the next generation of test case seeds, and discard the rest.

[0071] It should be noted that this step compares the fitness of each test transaction sequence calculated in the previous step with pre-set conditions (such as fitness threshold, etc.). Those test transaction sequences that meet the set conditions (such as fitness greater than a certain threshold) are selected and recognized as having the value of continuing to serve as test case seeds for further expansion and evolution, while those that do not meet the conditions are discarded and no longer participate in subsequent operations.

[0072] This step can realize the screening of test transaction sequences, retaining the parts with the potential to better discover potential problems in smart contracts as core seeds, so that the subsequently generated test cases can focus more on valuable directions, avoid a large number of meaningless and invalid tests, and improve test efficiency and effectiveness.

[0073] S7: Randomly mutate the test case seeds to generate several new test cases to make up for the number of discarded test cases.

[0074] It should be noted that for the selected test case seeds, new transaction sequences, that is, new test cases, are generated by using random modification operations on their transaction sequences (such as changing the input parameter values ​​of transactions, adjusting the order of transactions, adding or subtracting certain transactions, etc.). The number of generated test cases is based on the number of test cases discarded in the previous steps, ensuring that the size of the test case set is relatively stable and constantly updated.

[0075] This step enriches the diversity of test cases through mutation, simulates more different actual usage scenarios and possible abnormal situations, further expands the test coverage, and increases the probability of discovering hidden vulnerabilities in smart contracts and other problems.

[0076] S8: Combine all current test case seeds to obtain a new transaction sequence seed pool.

[0077] It should be noted that this step will reintegrate all the test case seeds that have been screened and mutated to form a new transaction sequence, and these new transaction sequences will constitute a new transaction sequence seed pool to prepare basic materials for the next round of test iterations.

[0078] This step further creates more complex and diverse test scenarios through combined operations, uncovering potential problems that may not be discovered by a single test case seed, making the test more comprehensive and in-depth.

[0079] S9: Based on the new transaction sequence seed pool, the test steps (i.e., S4-S8) are repeated continuously until the set stop condition is reached, thus completing the test of the given smart contract.

[0080] It should be noted that the stopping conditions are some pre-set judgment criteria, such as reaching a certain number of test rounds, reaching the upper limit of the test time, the number of problems found no longer increasing, etc.

[0081] This step continuously uses the newly generated transaction sequence seed pool to cyclically execute a series of operations, including extracting the test transaction sequence, executing the test to collect feedback, calculating fitness, screening, mutation, and combination. Each round of iteration will update the test case seed pool. During each iteration, it will check whether the set stop condition is met. Once it is met, the entire test process will be stopped.

[0082] Through continuous iteration, we continuously optimize and enrich the test case set, and gradually conduct comprehensive tests on smart contracts until the stopping conditions are met, ensuring that possible vulnerabilities, errors and other problems in smart contracts are detected as comprehensively as possible, thereby improving the quality and reliability of smart contracts.

[0083] The fuzzy testing method proposed in this embodiment is based on an evolutionary algorithm. It takes the initial transaction sequence seed as the starting point, continuously executes tests, collects multi-indicator feedback information, and calculates fitness based on feedback to screen out better seeds. Then, these seeds are mutated and combined to generate new test cases and seed pools. In this way, it is repeated and iterated to simulate a large number of different transaction scenarios to execute smart contracts. The evolution direction of test cases is guided by multi-indicator feedback information, thereby achieving comprehensive and in-depth testing of smart contracts and discovering various problems as much as possible. Different from the traditional testing method that only focuses on a single indicator (such as whether a crash occurs, etc.), this embodiment comprehensively considers multiple execution indicators to evaluate the quality of the test transaction sequence, making the evaluation of the test case more comprehensive and objective, and can more accurately guide the test case to evolve in the direction of discovering more types and more hidden problems. At the same time, an iterative method similar to the evolutionary algorithm is adopted to continuously optimize the test case set, continuously enrich the diversity of test scenarios and test cases, and can more deeply explore the potential problems of smart contracts and improve the effectiveness and adequacy of the test compared to the one-time generation of fixed test cases for testing. It is especially suitable for the test scenarios of complex smart contracts.

[0084] In one embodiment, the multi-index execution feedback information includes at least: execution path constraints, code coverage, branch condition distance, read and write storage locations, and data flow relationships.

[0085] This embodiment calculates the fitness of the test case by comprehensively considering feedback indicators from multiple angles, including code coverage, branch condition distance, storage location reading and writing, data flow relationship, etc., and can achieve good coverage efficiency for both strictly conditional branches in a single transaction and branches that need to be covered by combining multiple transactions.

[0086] Based on the multi-indicator execution feedback information provided in the foregoing embodiment, in a further embodiment, collecting the multi-indicator execution feedback information includes:

[0087] 1) Use taint analysis technology to introduce conditional symbol constraints when executing conditional branch statements, and obtain the execution path constraints of the smart contract code branches based on the conditional symbol constraints.

[0088] Taint analysis technology is a technical means to analyze the data flow in a program and track whether the data is contaminated during transmission. In this step, by introducing symbolic tags in the input of the transaction contract and using a separate symbol stack to simulate the operation and track the calculation path according to the executed bytecode, the conditional symbol constraints on the input variables can be obtained when the conditional branch statement is executed.

[0089] 2) Track and record the program counter of the EVM during execution and calculate the coverage.

[0090] 3) When a conditional branch statement is executed, the difference between the value of the branch condition variable and the value that the branch condition variable should satisfy is recorded, thereby calculating the branch condition distance.

[0091] 4) When the storage read and write instructions are executed, the storage location corresponding to the read and write is recorded to obtain the read and write storage location.

[0092] 5) Compare and analyze the read and write storage locations of each transaction in the transaction sequence, and obtain the data flow relationship between transactions based on the overlapping parts of the read and write locations.

[0093] This embodiment selects the above information as multi-indicator execution feedback information, which can achieve accurate control of each key link of smart contract testing, and also helps to comprehensively cover different execution scenarios, accurately evaluate test adequacy, deeply explore boundary conditions, troubleshoot storage-related issues, and sort out data associations between transactions. Overall, it greatly improves the depth, breadth and accuracy of smart contract testing, and can more effectively discover potential vulnerabilities and problems and optimize test quality. The process of testing based on the multi-indicator execution feedback information selected above Figure 2 As shown in the figure, the testing method first uses data flow analysis and deep learning to generate a high-quality initial seed pool, and then uses the instrumented EVM to collect feedback indicators such as test case code coverage, branch condition distance, storage location reading and writing, and data flow relationship. Combined with symbolic execution and deep learning technology, the coverage efficiency of smart contract fuzz testing is further improved, which can increase the number of vulnerabilities detected by smart contract fuzz testing in the same time.

[0094] Please refer again Figure 2 In one embodiment, before obtaining a new transaction sequence seed pool, if the coverage rate does not improve after multiple iterations, the method further includes:

[0095] The symbolic constraint solver is used to solve the conditional symbolic constraints collected when running the test cases, and the test input that can satisfy the conditional symbolic constraints is obtained and added to the next generation of test cases.

[0096] For branches that are difficult to cover with random mutations, this embodiment uses symbolic execution technology to directly solve the corresponding test inputs (i.e., uses a symbolic constraint solver to solve the conditional symbolic constraints collected when running the test cases before), and uses new inputs to change the test path, so that the test cases can cover more contract code areas, thereby improving code coverage and enabling the test to detect smart contracts more comprehensively and deeply.

[0097] In one embodiment, the transaction sequence seed includes a first transaction sequence seed generated using deep learning technology. The deep learning technology uses semantic information as a model input and uses a pre-trained neural network model to generate key information of the transaction sequence, thereby obtaining the first transaction sequence seed.

[0098] Taking the multi-indicator feedback information provided in the aforementioned embodiment as an example, through deep learning technology, the application binary interface, storage variable list, code abstract syntax tree and code control flow graph are used as the input of the neural network model, so that the model outputs the contract interface called in the transaction sequence, the calling parameters, the caller address and the amount of ether sent in the transaction, thereby generating a certain number of transaction sequence seeds (i.e., the first transaction sequence seed).

[0099] In one embodiment, the transaction sequence seed also includes a second transaction sequence seed generated using a random combination of data flow analysis technology. The random combination of data flow analysis technology generates a number of transactions by randomly applying a binary interface, and then combines transactions that may have dependencies through data flow analysis technology to obtain a second transaction sequence seed.

[0100] The present invention generates an initial seed pool for fuzzy testing by statically analyzing smart contracts and combining data flow analysis with a deep learning model. The high-quality initial seed pool can effectively improve the code coverage of smart contracts.

[0101] In one embodiment, all current test case seeds are combined, including:

[0102] Combine all current test case seeds in a random manner and / or use data flow relationships as input to the deep learning model to combine transaction sequences that the deep learning model believes are correlated.

[0103] When combining test cases, this embodiment uses data flow relationships as input and uses deep learning models to guide transaction combinations, so that the combined transaction sequences can more easily cover complex contracts.

[0104] Based on the same inventive concept, the embodiment of the present application also provides a multi-indicator feedback-driven smart contract fuzzy testing device for implementing the multi-indicator feedback-driven smart contract fuzzy testing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiment of a multi-indicator feedback-driven smart contract fuzzy testing device provided below can be referred to the limitations of a multi-indicator feedback-driven smart contract fuzzy testing method above, and will not be repeated here.

[0105] See also Figure 3, an embodiment of the present invention provides a multi-indicator feedback driven smart contract fuzz testing device, comprising:

[0106] The contract acquisition module is used to obtain a given smart contract;

[0107] Semantic information extraction module, used to extract semantic information of smart contracts using static analysis technology;

[0108] A seed pool generation module is used to generate a number of transaction sequence seeds based on semantic information and put them into an initial transaction sequence seed pool;

[0109] The test execution module is used to extract the test transaction sequence from the transaction sequence seed pool, execute the test on the stub EVM and collect multi-indicator execution feedback information;

[0110] The seed pool update module is used to calculate the fitness of each test transaction sequence taking into account the multi-indicator execution feedback information; it is also used to select the test transaction sequences whose fitness meets the set conditions as the next generation of test case seeds, and discard the rest; it is also used to randomly mutate the test case seeds to generate several new test cases to make up for the number of discarded test cases; it is also used to combine all the current test case seeds to obtain a new transaction sequence seed pool;

[0111] The loop test module is used to repeat the test steps based on the new transaction sequence seed pool until the set stop condition is reached, thus completing the test of the given smart contract.

[0112] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0113] Reference Figure 4An embodiment of the present invention further provides a computer device, comprising: a memory and a processor and a computer program stored in the memory. When the computer program is executed on the processor, a multi-indicator feedback-driven smart contract fuzz testing method as described in any one of the above methods is implemented.

[0114] The computer device may be a desktop computer, a notebook, a PDA, a cloud server or other computing device. The computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will understand that Figure 4 It is only an example of a computer device and does not constitute a limitation of the computer device. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0115] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0116] In some embodiments, the memory may be an internal storage unit of the computer device, such as a hard disk or memory of the computer device. In other embodiments, the memory may also be an external storage device of the computer device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device. Further, the memory may include both an internal storage unit and an external storage device of the computer device. The memory is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory may also be used to temporarily store data that has been output or is to be output.

[0117] An embodiment of the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements a multi-indicator feedback-driven smart contract fuzz testing method as described in any one of the above methods.

[0118] In this embodiment, if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, USB flash drive, mobile hard disk, disk or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0119] An embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements a multi-indicator feedback-driven smart contract fuzz testing method as described in any one of the above methods.

[0120] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0121] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0122] In the embodiments disclosed in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0123] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-indicator feedback driven smart contract fuzz testing method, characterized in that: The steps include: Get the given smart contract; Extracting semantic information of the smart contract using static analysis techniques; Generate a number of transaction sequence seeds based on the semantic information and put them into an initial transaction sequence seed pool; Taking out a test transaction sequence from the transaction sequence seed pool, executing the test on the stub EVM and collecting multi-indicator execution feedback information; Calculating the fitness considering the multi-indicator execution feedback information for each of the test transaction sequences; Select the test transaction sequence whose fitness reaches the set condition as the next generation test case seed, and discard the rest; Randomly mutating the test case seed to generate a number of new test cases to make up for the number of discarded test cases; Combining all the current test case seeds to obtain a new transaction sequence seed pool; Based on the new transaction sequence seed pool, the test steps are repeated until the set stop condition is reached, thereby completing the test of the given smart contract.

2. The multi-indicator feedback driven smart contract fuzz testing method according to claim 1 is characterized in that: The multi-indicator execution feedback information at least includes: Execution path constraints, code coverage, branch condition distances, read and write memory locations, and data flow relationships.

3. The multi-indicator feedback driven smart contract fuzz testing method according to claim 2 is characterized in that: Collect multi-indicator execution feedback information, including: Use taint analysis technology to introduce conditional symbol constraints when executing conditional branch statements, and obtain the execution path constraints of the smart contract code branches according to the conditional symbol constraints; Tracking and recording the program counter of the EVM plugged in during the execution process, and calculating the coverage rate; When a conditional branch statement is executed, the difference between the value of the branch condition variable and the value that the branch condition variable should satisfy is recorded, thereby calculating the branch condition distance; When a storage read / write instruction is executed, a storage location corresponding to the read / write is recorded to obtain the read / write storage location; The read and write storage positions of each transaction in the transaction sequence are compared and analyzed, and the data flow relationship between the transactions is obtained based on the overlapping parts of the read and write positions.

4. The multi-indicator feedback driven smart contract fuzz testing method according to claim 3 is characterized in that: Before obtaining the new transaction sequence seed pool, if the coverage rate does not improve after multiple iterations, the following steps are further included: The conditional symbolic constraints collected when running the test case are solved using a symbolic constraint solver to obtain a test input that can satisfy the conditional symbolic constraints and add it to the next generation of test cases.

5. The multi-indicator feedback driven smart contract fuzz testing method according to claim 1 is characterized in that: The transaction sequence seed includes a first transaction sequence seed generated using deep learning technology. The deep learning technology uses the semantic information as a model input and uses a pre-trained neural network model to generate key information of a transaction sequence, thereby obtaining the first transaction sequence seed.

6. The multi-indicator feedback driven smart contract fuzz testing method according to claim 1, characterized in that: The transaction sequence seed also includes a second transaction sequence seed generated using a random combination of data flow analysis technology. The random combination of data flow analysis technology is to generate a number of transactions by randomly applying the binary interface, and then combine transactions that may have dependencies through data flow analysis technology to obtain the second transaction sequence seed.

7. The multi-indicator feedback driven smart contract fuzz testing method according to claim 1 is characterized in that: Combine all the current test case seeds, including: All current test case seeds are combined in a random manner and / or data flow relationships are used as inputs to a deep learning model to combine transaction sequences that the deep learning model considers to be correlated.

8. A multi-indicator feedback driven smart contract fuzz testing method, characterized in that: The steps include: The contract acquisition module is used to obtain a given smart contract; A semantic information extraction module, used to extract the semantic information of the smart contract using static analysis technology; A seed pool generation module, used to generate a number of transaction sequence seeds based on the semantic information and put them into an initial transaction sequence seed pool; A test execution module, used to take out a test transaction sequence from the transaction sequence seed pool, execute the test on the stub EVM and collect multi-indicator execution feedback information; A seed pool update module is used to calculate the fitness of each test transaction sequence taking into account the multi-index execution feedback information; it is also used to select the test transaction sequence whose fitness meets the set conditions as the next generation of test case seeds, and discard the rest; it is also used to randomly mutate the test case seeds to generate a number of new test cases to make up for the number of discarded test cases; it is also used to combine all the current test case seeds to obtain a new transaction sequence seed pool; The loop test module is used to continuously repeat the test steps based on the new transaction sequence seed pool until the set stop condition is reached, thereby completing the test of the given smart contract.

9. A computer device, characterized in that: The device comprises a processor and a memory: The memory is used to store a computer program and send instructions of the computer program to the processor; The processor executes a multi-indicator feedback driven smart contract fuzz testing method as described in any one of claims 1-7 according to the instructions of the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements a multi-indicator feedback-driven smart contract fuzz testing method as described in any one of claims 1 to 7.

Images