Intelligent contract dynamic security threat detection method, system and device and storage medium

Abstract

The invention provides an intelligent contract dynamic security threat detection method, system and device, and a storage medium. The method comprises the following steps: acquiring contract transaction execution transaction tracking information, mining an operation code instruction, and generating a contract operation log record operation code sequence; a self-supervised convolutional neural network is adopted to convert an operation code sequence into a feature vector, then the feature vector is input into a deep recurrent neural network formed by LSTM units, and a threat detection model for distinguishing malicious and normal transactions is trained. According to the method, by collecting the tracking information, extracting the security features and training by using the neural network, the detection calculation overhead is reduced, the comprehensive coverage of the complex smart contract is realized, and the detection performance in diversified attack scenes is improved.

Description

Technical Field

[0001] The present application relates to the field of blockchain security detection, and in particular to a method, system, device and storage medium for dynamic security threat detection of smart contracts. Background Art

[0002] Smart contracts play a core role in blockchain technology, however, they face serious security threats. The traditional static security optimization method, which is to detect smart contracts before they are deployed, can identify some vulnerabilities, but their types are limited and the missed detection rate is high. In contrast, dynamic security optimization is performed after smart contracts are deployed, which can be closer to real business scenarios, detect attacks from the bottom layer, and provide more comprehensive and effective security protection for smart contracts.

[0003] However, the dynamic security optimization of smart contracts is limited by the size of the blockchain virtual machine (EVM) bytecode, which makes it impossible to cover all smart contracts; multiple attacks may occur at the same time, making it difficult for the detection mechanism to cover multiple different types of attacks at the same time; the model has low generalization ability, low detection efficiency, and supports a single type of vulnerability. Summary of the invention

[0004] The purpose of this application is to overcome the defects in the above-mentioned prior art and provide a data management system, publishing and subscription method and system based on distributed digital identity.

[0005] This application provides a smart contract dynamic security threat detection method, including:

[0006] Get the execution transaction tracking information of the contract transaction in the blockchain;

[0007] Performing information mining on the execution transaction tracking information to obtain different types of operation code instructions for the contract transaction;

[0008] Generate a contract operation log according to the operation code instruction, wherein the contract operation log records the operation code sequence performed by the contract transaction in a single transaction process;

[0009] Representing the opcode sequence as a feature vector using a self-supervised convolutional neural network;

[0010] Using the feature vector as a sample, a deep recurrent neural network composed of LSTM units is trained to obtain a threat detection model that distinguishes malicious transactions from normal transactions;

[0011] Perform threat detection on the contract transaction according to the threat detection model.

[0012] Optionally, a self-supervised convolutional neural network is used to represent the opcode sequence as a feature vector, including:

[0013] Remove the convolutional decoder in self-supervised convolutional neural networks;

[0014] A self-supervised convolutional neural network based on removing the convolutional decoder inputs the operation code sequence and outputs the feature vector.

[0015] Optionally, the convolutional neural network includes a convolutional encoder, and the convolutional encoder includes:

[0016] Max pooling layer, batch normalization layer, activation function;

[0017] The convolution encoder is used to capture the long-term dependency features of the attack transaction bytecode sequence, and feature extraction is performed through a maximum pooling layer, a batch normalization layer and an activation function to output the feature vector.

[0018] Optionally, the training process of the deep recurrent neural network uses an Adam optimizer to reduce the loss of the deep recurrent neural network to optimize the hidden layer parameters.

[0019] Optionally, performing threat detection on the contract transaction according to the threat detection model includes:

[0020] Obtain the execution transaction tracking information of the contract transaction in the blockchain in real time during the contract transaction;

[0021] The real-time acquired execution transaction tracking information is input into the trained threat detection model to achieve real-time threat detection of contract transactions.

[0022] Optionally, obtain the execution transaction tracking information of the contract transaction in the blockchain, including:

[0023] Obtain execution transaction trace information from the blockchain node, including blockchain virtual machine execution opcodes, program counters, call stack depth, and stack current values.

[0024] Optionally, the method further comprises:

[0025] Based on the type of malicious transactions detected, smart contracts are optimized and repaired in a targeted manner.

[0026] This application also provides a smart contract dynamic security threat detection system, including:

[0027] Acquisition module, obtains the execution transaction tracking information of contract transactions in the blockchain;

[0028] A mining module performs information mining on the execution transaction tracking information to obtain different types of operation code instructions of the contract transaction;

[0029] A log module generates a contract operation log according to the operation code instruction, wherein the contract operation log records the operation code sequence of the contract transaction performed in a single transaction process;

[0030] A feature module, which uses a self-supervised convolutional neural network to represent the opcode sequence as a feature vector;

[0031] A training module, which trains a deep recurrent neural network composed of LSTM units using the feature vector as a sample to obtain a threat detection model that distinguishes malicious transactions from normal transactions;

[0032] The detection module performs threat detection on the contract transaction according to the threat detection model.

[0033] Optionally, the feature module uses a self-supervised convolutional neural network to represent the opcode sequence as a feature vector, including:

[0034] Remove the convolutional decoder in self-supervised convolutional neural networks;

[0035] A self-supervised convolutional neural network based on removing the convolutional decoder inputs the operation code sequence and outputs the feature vector.

[0036] Optionally, the convolutional neural network includes a convolutional encoder, and the convolutional encoder includes:

[0037] Max pooling layer, batch normalization layer, activation function and fully connected layer;

[0038] The convolution encoder is used to capture the long-term dependency features of the attack transaction bytecode sequence, and feature extraction is performed through a maximum pooling layer, a batch normalization layer and an activation function to output the feature vector.

[0039] Optionally, the training process of the deep recurrent neural network uses an Adam optimizer to reduce the loss of the deep recurrent neural network to optimize the hidden layer parameters.

[0040] Optionally, the detection module performs threat detection on the contract transaction according to the threat detection model, including:

[0041] Obtain the execution transaction tracking information of the contract transaction in the blockchain in real time during the contract transaction;

[0042] The real-time acquired execution transaction tracking information is input into the trained threat detection model to achieve real-time threat detection of contract transactions.

[0043] Optionally, the acquisition module acquires the execution transaction tracking information of the contract transaction in the blockchain, including:

[0044] Obtain execution transaction trace information from the blockchain node, including blockchain virtual machine execution opcodes, program counters, call stack depth, and stack current values.

[0045] Optionally, the system further comprises:

[0046] The optimization module performs targeted optimization and repair of smart contracts based on the type of malicious transactions detected.

[0047] The present application also provides a smart contract dynamic security threat detection device, including:

[0048] Memory;

[0049] A processor is used to retrieve the computer executable program of the above-mentioned smart contract dynamic security threat detection method from the memory, and execute: obtaining execution transaction tracking information of contract transactions in the blockchain; performing information mining on the execution transaction tracking information to obtain different types of operation code instructions of the contract transaction; generating a contract operation log according to the operation code instructions, and the contract operation log records the operation code sequence performed by the contract transaction in a single transaction process; using a self-supervised convolutional neural network to represent the operation code sequence as a feature vector; using the feature vector as a sample to train a deep recurrent neural network composed of LSTM units to obtain a threat detection model that distinguishes malicious transactions from normal transactions; and performing threat detection on the contract transaction according to the threat detection model.

[0050] The present application also provides a storage medium, comprising: storing a computer executable program, which is used to be called by a processor to execute the steps of the above-mentioned smart contract dynamic security threat detection method.

[0051] The beneficial effects of this application are:

[0052] The present application provides a method for dynamic security threat detection of smart contracts, including: obtaining execution transaction tracking information of contract transactions in blockchain; performing information mining on the execution transaction tracking information to obtain different types of operation code instructions for the contract transactions; generating a contract operation log according to the operation code instructions, and the contract operation log records the operation code sequence performed by the contract transaction in a single transaction process; using a self-supervised convolutional neural network to represent the operation code sequence as a feature vector; using the feature vector as a sample to train a deep recurrent neural network composed of LSTM units to obtain a threat detection model that distinguishes malicious transactions from normal transactions; and performing threat detection on contract transactions according to the threat detection model. The present application collects the execution transaction tracking information of contract transactions, extracts features related to security threats, uses a self-supervised convolutional neural network to represent the operation code sequence as a feature vector, and inputs it into a deep recurrent neural network composed of LSTM units for training, and the ability to distinguish malicious transactions from normal transactions not only reduces the computational overhead of the dynamic detection mechanism, but also achieves comprehensive coverage of complex smart contracts and improves the detection performance in diverse attack scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of the data management system based on distributed digital identity in this application;

[0054] Figure 2 This is a schematic diagram of the threat detection model architecture in this application;

[0055] Figure 3 A schematic diagram of the design architecture for dynamic information mining of smart contracts in this application;

[0056] Figure 4 This is a schematic diagram of the architecture of the self-supervised convolutional coding model for the smart contract transaction operation code sequence in this application;

[0057] Figure 5 This is a schematic diagram of the smart contract transaction security threat detection model architecture in this application. DETAILED DESCRIPTION

[0058] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that various forms of implementing the present disclosure should not be limited by the embodiments set forth herein. On the contrary, the embodiments are provided to more thoroughly understand the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0059] Please refer to Figures 1 to 5 As shown, the present application provides a method for detecting dynamic security threats of smart contracts, including:

[0060] S101. Obtain execution transaction tracking information of contract transactions in the blockchain.

[0061] Obtain the complete execution transaction tracking information of the contract transaction, wherein the blockchain node defines a single execution transaction tracking information including: blockchain virtual machine execution opcode, program counter, call stack depth, and stack current value.

[0062] The transaction tracking information will be executed through JSON-RPC calls. Specifically, the POST request shown in Table 1 will be constructed:

[0063] Table 1 RPC call requesting complete contract transaction execution transaction tracking information

[0064] RPC call parameters Parameter Value jsonrpc 2.0 id 1 method debug_traceTransaction params transaction_hash,{"tracer":tracer}

[0065] The jsonrpc parameter specifies the version of the JSON-RPC protocol; the id parameter specifies the call request number; the method parameter specifies the specific interface function supported by Geth; and the params parameter specifies the hash value of the requested transaction and the specified transaction tracker.

[0066] It should be noted that the complete contract transaction execution transaction tracking information is large and contains a lot of redundant transaction execution information. The default transaction tracking information requested by Geth cannot meet the time limit of dynamic real-time performance of this project. Therefore, a custom tracer is passed in the params parameter of the RPC call to greatly shorten the contract operation information collection time. The constructed custom tracer can be shown in Table 2:

[0067] Table 2 Custom Transaction Tracker

[0068]

[0069] The custom transaction tracker removes the recording of information irrelevant to transaction execution analysis, such as the opcode program counter, opcode gas consumption, and gas remaining. At the same time, for each opcode instruction feature, it only records the stack and memory information slice related to the opcode operation, rather than returning a snapshot of the entire stack and memory.

[0070] S102: Perform information mining on the transaction execution tracking information to obtain different types of operation code instructions for the contract transaction.

[0071] Conduct preliminary information mining on the collected contract transaction execution transaction tracking information and pre-process the information using prior knowledge.

[0072] Since some instruction operations in the contract transaction execution are irrelevant to the security threat judgment, only the following three types of operation code information are retained:

[0073] (1) Operation code instructions related to blockchain or transactions.

[0074] Such opcode instructions need to obtain relevant information from the blockchain network or the current transaction. For example, the TIME STAMP instruction will obtain the Unix timestamp from the current block, and the CALLER instruction will obtain the address of the current caller.

[0075] (2)Opcode instructions related to memory or external storage operations.

[0076] This type of opcode instruction needs to read or write data from memory or external storage, for example, MLOAD will read and write data from memory, and SLOAD will read and write data from external storage.

[0077] (3) Operation code instructions related to stack operations.

[0078] Such opcode instructions involve popping or pushing operations on the blockchain virtual machine stack, and are typically used to manage function calls, parameter passing, and storage and retrieval of temporary data.

[0079] This application redefines the encoding format of the opcode, and uses a deep neural network method to detect security threats on the opcode sequence. The small word bag size will more effectively help the neural network to extract and learn the features of the opcode sequence of transaction execution transaction tracking information, thereby redefining the opcode encoding rules shown in Table 3:

[0080] Table 3 Custom operation code encoding rules

[0081] Operation Code Opcode encoding value "ADDRESS"->"GASLIMIT" Decimal(opcode_number)-48 "POP" -> "JUMPDEST" Decimal(opcode_number)-58 "PUSHx" 34 "DUPx" 35 "SWAPx" 36 "LOGx" 37 "CREATE"->"CREATE2" Decimal(opcode_number)-202 "STATICCALL" 44 "REVERT" 45 "SELFDESTRUCT" 46

[0082] After redefining the encoding rules, the encoding bag size of the opcode is reduced to 47, which is convenient for deep neural network processing.

[0083] S103. Generate a contract operation log according to the operation code instruction, and the contract operation log records the operation code sequence performed by the contract transaction in a single transaction process.

[0084] Using the pre-processed smart contract transaction execution transaction tracking information, the contract operation log is generated according to different types of operation code instructions, which can more clearly display the operation transaction status of the smart contract and facilitate the subsequent manual audit by the administrator. The smart contract operation status log can be shown in Table 4.

[0085] Table 4 Smart contract running status log

[0086]

[0087]

[0088] A single smart contract operation status log consists of 9 log files. Each log file records the detailed information of a certain type of operation code sequence performed by the contract transaction in a single transaction process:

[0089] (1) The arithmetic operation code sub-log records all arithmetic instruction operations and their related detailed information in the transaction tracking information of a single transaction execution, including operands, operation results, etc.

[0090] (2) The storage operation opcode sub-log records all storage instruction operations and their related detailed information in the transaction tracking information of a single transaction execution, including the caller address, storage content, stack depth changes, etc.

[0091] (3) The conditional operation code sub-log records all conditional instruction operations in the transaction tracking information of a single transaction execution.

[0092] (4) The transfer operation code sub-log records all relevant instructions and detailed information related to the transfer operation in the transaction tracking information of a single transaction execution, including transaction hash, contract address, initiator address, recipient address, etc.

[0093] (5) The call operation code sub-log records all relevant instructions involving function calls and their detailed information in the transaction tracking information of a single transaction execution, including the caller address, the callee address, input information, stack depth changes, etc.

[0094] (6) The exception throwing operation code sub-log records all related instructions involved in the exception throwing and their detailed information in the transaction tracking information of a single transaction execution, including the caller address where the exception occurred, the stack depth change, etc.

[0095] (7) The self-destruction operation code sub-log records all relevant instructions and detailed information related to the contract self-destruction operation in the single transaction execution transaction tracking information, including the contract caller address and contract balance at the time of self-destruction.

[0096] (8) The block information sub-log records the detailed information about the block to which the transaction belongs, including the block number, block gas usage, block maximum gas limit, block timestamp, etc.

[0097] (9) The transaction information sub-log records the relevant detailed information of the transaction, including transaction hash, transaction code, transaction initiator, transaction recipient, transaction gas usage, etc.

[0098] S104: Use a self-supervised convolutional neural network to represent the operation code sequence as a feature vector.

[0099] Reference Figure 4As shown, the smart contract transaction operation code sequence is self-supervised convolutional encoded, as follows:

[0100] Since it is difficult for RNN to capture the long-term dependencies between long sequences of opcodes, the opcode sequence will be encoded first, including: using a self-supervised convolutional neural network to represent the opcode sequence as a feature vector to shorten the feature representation of the opcode sequence.

[0101] The opcode sequence in the model architecture is the opcode sequence after transaction preprocessing. The opcode sequence length is set to L, the opcode encoding type is set to k, and the opcode sequence is a digital sequence with values ​​from 0 to k-1. Then, one-hot encoding and word embedding are used on the opcode sequence in turn to convert it into a one-hot vector and a dense word embedding vector. Here, the unit encoding length of the convolutional encoding is defined as l, and the one-hot vector and the dense word embedding vector are finally reshaped into a vector of (L / l×l). The former is used as the target output of the model self-supervised training, and the latter is used as the input of the model training.

[0102] The goal of self-supervised training of the model is to optimize the cross entropy loss between the model-generated vector and the one-hot vector by continuously updating the neural network parameters.

[0103] In order to formalize the model training and the model composition architecture, the one-hot vector is defined as Hot(π x )∈{0,1} L / l×l×K , the word embedding dense vector is Emb(π x )∈R L / l×l×E , the model generates a vector of O conv ∈{0,1} L / l×l×K , the opcode feature vector generated in the middle of the model is M c ∈R L / l×l×h , the convolutional layer in the neural network is defined as The maximum pooling layer is defined as p, the upsampling layer is defined as u, the batch normalization layer is defined as b, and the fully connected layer is defined as f β , the activation function is defined as δ, where and β are the network parameters of the convolutional layer and the fully connected layer.

[0104] The convolutional encoder in the model receives input as a dense word embedding vector Emb(π x ), the convolution layer, the maximum pooling layer, the batch normalization, and the activation function are used to repeatedly extract and learn features, and finally the opcode feature vector M is output with the help of the fully connected layer c , the formal definition of the convolutional encoder is:

[0105]

[0106] M c =f β (E i )

[0107] i=1,2,3.......

[0108] Among them, E i ∈R L / l×A×B (A<l, B<E) is the feature vector after the convolution encoder performs the i-th convolution, maximum pooling, batch normalization, and activation operations. When i=0, E 0 =Emb(π x ) is the dense embedding vector of the input word of the convolutional encoder.

[0109] The convolutional decoder in the model receives input as the opcode feature vector M c , the upsampling layer, convolution layer, batch normalization, and activation function are used to repeatedly extract features and learn, and finally the fully connected layer and the Soft max function are used to output the model to generate the vector O conv , the convolutional decoder is formally defined as:

[0110]

[0111] O conv =softmax(f β (D i ))

[0112] i=1,2,3.......

[0113] Among them, D i ∈R L / l×C×D (C<l,D<E) is the feature vector after the convolution decoder performs the i-th upsampling, maximum pooling, batch normalization, and activation operations. When i=0, D 0 =M c That is, the input opcode feature vector of the convolutional decoder.

[0114] Model training is the process of optimizing model parameters. The model generates vector O conv With one-hot vector Hot(π x ) is the model loss L conv , the Adam optimizer is used to continuously reduce the model loss to optimize the relevant parameters in the neural network. The model training formula is defined as:

[0115]

[0116] When the opcode sequence self-supervised convolutional coding model is trained, the convolutional decoder in the model is removed, leaving only the convolutional encoder in the model. As a result, the model receives the opcode sequence after transaction preprocessing as input, and the model output becomes the opcode feature vector M c , the latter will be used as the compressed contract transaction operation code feature representation, which is convenient for the network to further process to complete the threat binary classification detection of contract transactions.

[0117] S105. Using the feature vector as a sample, a deep recurrent neural network composed of LSTM units is trained to obtain a threat detection model that distinguishes malicious transactions from normal transactions.

[0118] refer to Figure 5 As shown in the figure, the threat detection model uses a deep recurrent neural network composed of LSTM units, and adopts a supervised method to learn malicious and normal transaction operation code sequences respectively. By continuously updating the model parameters in a cycle, it is trained to distinguish malicious transactions from normal transactions.

[0119] The opcode feature vector in the model architecture is the output M of the encoder of the self-supervised convolutional coding model of the smart contract transaction opcode sequence c , the contract transaction label is provided by human labeling, defined as y∈{0,1}, and only the contract transaction is marked as normal or malicious. The contract transaction polarity is the threat probability output of the deep recurrent neural network for the contract transaction sequence, defined as o drnn ∈[0,1], the contract transaction threat detection value is the final output of the model, indicating the model's judgment on whether the input transaction is normal or malicious, defined as R trans ∈{0,1}.

[0120] The hidden layer of the network uses LSTM units to solve the long-term dependency and gradient vanishing problems of long sequence inputs, which is defined as l θ , where θ is the parameter of LSTM. The output of the deep recurrent neural network uses the Logistic function to control its distribution between [0,1]. The threat probability of the output contract transaction sequence is defined as o drnn , the detection network is formally defined as:

[0121] v t =(l θ )(M ct ,v t-1 )

[0122]

[0123] Among them, V t is the state vector of the hidden layer of the deep recurrent neural network at time step t, M ctis the tth eigenvalue of the opcode eigenvector. When t=0, V 0 Initialized to the zero vector.

[0124] The training of the network is the process of optimizing the hidden layer parameters, and the output of the model is defined as the threat probability of the contract transaction sequence. drnn The cross entropy between the contract transaction label y is the network loss L drnn , the Adam optimizer is used to continuously reduce the network loss to optimize the hidden layer parameters. The network training formula is defined as:

[0125] L drnn (O drnn ,y)=-((1-y)ln(1-O drnn )+ylnO drnn )

[0126] After the network is trained, it is necessary to determine whether the input contract transaction is a malicious threat transaction. The decision-making method is formally defined as:

[0127]

[0128] Among them, Θ is the decision boundary of malicious threat transactions, and the naive Bayes classifier is used to fit the network output o drnn With the contract transaction label y, the decision boundary of malicious threat transaction is determined. In this task, the formulation of the naive Bayes classifier is defined as:

[0129]

[0130] Since the network output drnn is a continuous variable. This task will further adopt the Gaussian Naive Bayes classifier, which assumes that the network output o drnn Under the Gaussian distribution of each category of contract transaction label y, the naive Bayes classifier will use the Gaussian distribution probability density function to calculate the relevant probability:

[0131]

[0132] This application also provides a self-supervised convolutional encoding technology for smart contract transaction opcode sequences, which solves the problem that RNN has difficulty in capturing long-term dependencies between long sequence opcodes. A self-supervised convolutional neural network is used to represent the opcode sequence as a feature vector to shorten the feature representation of the opcode sequence. At the same time, a smart contract transaction security threat detection technology is proposed, which can obtain relevant information during contract runtime and a large amount of feature information related to security threats, thereby effectively detecting numerous contract attacks, and the detection model is diverse.

[0133] S106: Perform threat detection on the contract transaction according to the threat detection model.

[0134] Obtain the execution transaction tracking information of the contract transaction in the blockchain in real time during the contract transaction;

[0135] The real-time acquired execution transaction tracking information is input into the trained threat detection model to achieve real-time threat detection of contract transactions. The input data can be processed through the above data preprocessing steps before input.

[0136] In this application, the automated mining of smart contract operation information in the contract transaction collection server includes the collection and preprocessing of contract transaction messages. The collection of contract operation information requires obtaining the complete execution transaction tracking information of the contract transaction.

[0137] The smart contract operation status log is automatically generated in the contract transaction collection server. The pre-processed smart contract transaction execution transaction tracking information is used to organize and generate the contract operation log according to different types of operation code instructions.

[0138] This application also provides a smart contract dynamic security threat detection system, including:

[0139] Acquisition module, obtains the execution transaction tracking information of contract transactions in the blockchain;

[0140] A mining module performs information mining on the execution transaction tracking information to obtain different types of operation code instructions of the contract transaction;

[0141] A log module generates a contract operation log according to the operation code instruction, wherein the contract operation log records the operation code sequence of the contract transaction performed in a single transaction process;

[0142] A feature module, which uses a self-supervised convolutional neural network to represent the opcode sequence as a feature vector;

[0143] A training module, which trains a deep recurrent neural network composed of LSTM units using the feature vector as a sample to obtain a threat detection model that distinguishes malicious transactions from normal transactions;

[0144] The detection module performs threat detection on the contract transaction according to the threat detection model.

[0145] Furthermore, the feature module uses a self-supervised convolutional neural network to represent the opcode sequence as a feature vector, including:

[0146] Remove the convolutional decoder in self-supervised convolutional neural networks;

[0147] A self-supervised convolutional neural network based on removing the convolutional decoder inputs the operation code sequence and outputs the feature vector.

[0148] Furthermore, the convolutional encoder comprises:

[0149] Max pooling layer, batch normalization layer, activation function and fully connected layer;

[0150] The convolution encoder is used to capture the long-term dependency features of the attack transaction bytecode sequence, and feature extraction is performed through a maximum pooling layer, a batch normalization layer and an activation function to output the feature vector.

[0151] Furthermore, the training process of the deep recurrent neural network uses an Adam optimizer to reduce the loss of the deep recurrent neural network to optimize the hidden layer parameters.

[0152] Furthermore, the detection module performs threat detection on the contract transaction according to the threat detection model, including:

[0153] Obtain the execution transaction tracking information of the contract transaction in the blockchain in real time during the contract transaction;

[0154] The real-time acquired execution transaction tracking information is input into the trained threat detection model to achieve real-time threat detection of contract transactions.

[0155] Furthermore, the acquisition module acquires the execution transaction tracking information of the contract transaction in the blockchain, including:

[0156] Obtain execution transaction trace information from the blockchain node, including blockchain virtual machine execution opcodes, program counters, call stack depth, and stack current values.

[0157] Furthermore, the device also includes:

[0158] The optimization module performs targeted optimization and repair of smart contracts based on the type of malicious transactions detected.

[0159] The present application also provides a smart contract dynamic security threat detection device, including:

[0160] Memory;

[0161] A processor is used to retrieve the computer executable program of the above-mentioned smart contract dynamic security threat detection method from the memory, and execute: obtaining execution transaction tracking information of contract transactions in the blockchain; performing information mining on the execution transaction tracking information to obtain different types of operation code instructions of the contract transaction; generating a contract operation log according to the operation code instructions, and the contract operation log records the operation code sequence performed by the contract transaction in a single transaction process; using a self-supervised convolutional neural network to represent the operation code sequence as a feature vector; using the feature vector as a sample to train a deep recurrent neural network composed of LSTM units to obtain a threat detection model that distinguishes malicious transactions from normal transactions; and performing threat detection on the contract transaction according to the threat detection model.

[0162] The present application also provides a storage medium, comprising: storing a computer executable program, which is used to be called by a processor to execute the steps of the above-mentioned smart contract dynamic security threat detection method.

[0163] Although the present invention is disclosed as above by the embodiments, it is not intended to limit the protection scope of the present invention. Any changes and modifications made by any technician familiar with the technology without departing from the concept and scope of the present invention should fall within the protection scope of the present invention.

Claims

1. A method for detecting dynamic security threats to smart contracts, characterized in that: include: Get the execution transaction tracking information of the contract transaction in the blockchain; Performing information mining on the execution transaction tracking information to obtain different types of operation code instructions for the contract transaction; Generate a contract operation log according to the operation code instruction, wherein the contract operation log records the operation code sequence performed by the contract transaction in a single transaction process; Representing the opcode sequence as a feature vector using a self-supervised convolutional neural network; Using the feature vector as a sample, a deep recurrent neural network composed of LSTM units is trained to obtain a threat detection model that distinguishes malicious transactions from normal transactions; Perform threat detection on the contract transaction according to the threat detection model.

2. According to claim 1, a smart contract dynamic security threat detection method is characterized in that: A self-supervised convolutional neural network is used to represent the opcode sequence as a feature vector, including: Remove the convolutional decoder in self-supervised convolutional neural networks; A self-supervised convolutional neural network based on removing the convolutional decoder inputs the operation code sequence and outputs the feature vector.

3. According to claim 2, a smart contract dynamic security threat detection method is characterized in that: The convolutional neural network includes a convolutional encoder, and the convolutional encoder includes: Max pooling layer, batch normalization layer and activation function; The convolution encoder is used to capture the long-term dependency features of the attack transaction bytecode sequence, and feature extraction is performed through a maximum pooling layer, a batch normalization layer and an activation function to output the feature vector.

4. According to claim 1, a smart contract dynamic security threat detection method is characterized in that: The training process of the deep recurrent neural network uses the Adam optimizer to reduce the loss of the deep recurrent neural network to optimize the hidden layer parameters.

5. According to claim 1, a smart contract dynamic security threat detection method is characterized in that: Performing threat detection on the contract transaction according to the threat detection model includes: Obtain the execution transaction tracking information of the contract transaction in the blockchain in real time during the contract transaction; The execution transaction tracking information obtained in real time is input into the threat detection model to achieve real-time threat detection of contract transactions.

6. According to claim 1, a smart contract dynamic security threat detection method is characterized in that: Get the execution transaction tracking information of the contract transaction in the blockchain, including: Obtain execution transaction trace information from the blockchain node, including blockchain virtual machine execution opcodes, program counters, call stack depth, and stack current values.

7. According to claim 1, a smart contract dynamic security threat detection method is characterized in that: The method further comprises: Based on the type of malicious transactions detected, smart contracts are optimized and repaired in a targeted manner.

8. A smart contract dynamic security threat detection system, characterized in that: include: Acquisition module, obtains the execution transaction tracking information of contract transactions in the blockchain; A mining module performs information mining on the execution transaction tracking information to obtain different types of operation code instructions of the contract transaction; A log module generates a contract operation log according to the operation code instruction, wherein the contract operation log records the operation code sequence of the contract transaction performed in a single transaction process; A feature module, which uses a self-supervised convolutional neural network to represent the opcode sequence as a feature vector; A training module, which trains a deep recurrent neural network composed of LSTM units using the feature vector as a sample to obtain a threat detection model that distinguishes malicious transactions from normal transactions; The detection module performs threat detection on the contract transaction according to the threat detection model.

9. According to claim 8, a smart contract dynamic security threat detection system is characterized in that: The feature module uses a self-supervised convolutional neural network to represent the opcode sequence as a feature vector, including: Remove the convolutional decoder in self-supervised convolutional neural networks; A self-supervised convolutional neural network based on removing the convolutional decoder inputs the operation code sequence and outputs the feature vector.

10. A smart contract dynamic security threat detection system according to claim 9, characterized in that: The convolutional neural network includes a convolutional encoder, and the convolutional encoder includes: Max pooling layer, batch normalization layer, activation function; The convolution encoder is used to capture the long-term dependency features of the attack transaction bytecode sequence, and feature extraction is performed through a maximum pooling layer, a batch normalization layer and an activation function to output the feature vector.

11. According to claim 8, a smart contract dynamic security threat detection system is characterized in that: The training process of the deep recurrent neural network uses the Adam optimizer to reduce the loss of the deep recurrent neural network to optimize the hidden layer parameters.

12. According to claim 8, a smart contract dynamic security threat detection system is characterized in that: The detection module performs threat detection on the contract transaction according to the threat detection model, including: Obtain the execution transaction tracking information of the contract transaction in the blockchain in real time during the contract transaction; The real-time acquired execution transaction tracking information is input into the trained threat detection model to achieve real-time threat detection of contract transactions.

13. According to claim 8, a smart contract dynamic security threat detection system is characterized in that: The acquisition module acquires the execution transaction tracking information of the contract transaction in the blockchain, including: Obtain execution transaction trace information from the blockchain node, including blockchain virtual machine execution opcodes, program counters, call stack depth, and stack current values.

14. According to claim 8, a smart contract dynamic security threat detection system is characterized in that: The system further comprises: The optimization module performs targeted optimization and repair of smart contracts based on the type of malicious transactions detected.

15. A smart contract dynamic security threat detection device, characterized in that: include: Memory; A processor, used to retrieve from the memory a computer executable program of a method for dynamic security threat detection of smart contracts as described in any one of claims 1 to 7, and execute: obtaining execution transaction tracking information of contract transactions in the blockchain; performing information mining on the execution transaction tracking information to obtain different types of operation code instructions for the contract transactions; generating a contract operation log according to the operation code instructions, wherein the contract operation log records the operation code sequence performed by the contract transaction in a single transaction process; using a self-supervised convolutional neural network to represent the operation code sequence as a feature vector; using the feature vector as a sample to train a deep recurrent neural network composed of LSTM units to obtain a threat detection model that distinguishes malicious transactions from normal transactions; and performing threat detection on contract transactions according to the threat detection model.

16. A storage medium, characterized in that: include: A computer executable program is stored, which is used to be called by a processor to execute the steps of a smart contract dynamic security threat detection method as described in any one of claims 1 to 7.

Images