Vulnerability detection method and system for smart contract control flow based on multi-modal deep learning model

Abstract

The invention relates to an intelligent contract control flow vulnerability detection method and system based on a multi-modal deep learning model. The method comprises the following steps: acquiring an intelligent contract source code, converting the source code into a byte code and a control flow graph, and extracting a graph feature vector by using a deep learning model; generating an abstract syntax tree according to the smart contract source code and generating an abstract syntax feature vector; extracting annotations and generating annotation feature vectors; vertically stacking the graph feature vector, the abstract grammar feature vector and the annotation feature vector to obtain a comprehensive feature representation matrix; the contract similarity between the comprehensive feature representation matrixes is calculated in a mode of combining a multiplied RBF kernel function and cosine similarity; and performing clone detection and vulnerability detection on the to-be-detected smart contract. By extracting the graph feature vector, the abstract grammar feature vector and the annotation feature vector, contract clone analysis and vulnerability detection are performed, contract details can be comprehensively captured, and vulnerability detection accuracy and generalization ability can be improved.

Description

Technical Field

[0001] The present invention relates to the field of smart contract security technology, and in particular to a smart contract control flow vulnerability detection method and system based on a multimodal deep learning model. Background Art

[0002] In the field of blockchain, smart contracts face security threats throughout their life cycle due to their unique characteristics. Although there are many studies on smart contract security, existing smart contract vulnerability detection technologies have made some progress, but there are still significant deficiencies. Current smart contract vulnerability detection methods usually rely on a single modality and only analyze source code or bytecode, which makes it difficult to fully capture the structure, syntax and semantic information of the contract, resulting in limited accuracy and generalization ability when detecting complex or new vulnerabilities. Although deep learning models based on control flow graphs or abstract syntax trees improve the detection effect, they fail to fully capture the semantic and structural information of the contract. Similarly, existing code clone detection tools are insufficient in retaining code structure and semantics, resulting in performance degradation. For example, traditional vulnerability detection technology is based on the word2vec embedding method, which uses a simple deep learning model to learn the model of smart contracts with vulnerabilities, so that vulnerabilities in specific patterns can be automatically detected relatively quickly and effectively. In addition, tools that rely on expert-defined rules are time-consuming and labor-intensive, and it is difficult to effectively respond to rapidly changing vulnerability types.

[0003] Therefore, traditional vulnerability detection technologies often have problems with low detection accuracy and generalization ability. Summary of the invention

[0004] Based on this, in order to solve the above technical problems, a vulnerability detection method and system for smart contract control flow based on a multimodal deep learning model are provided, which can improve the accuracy and generalization ability of vulnerability detection.

[0005] A method for detecting vulnerabilities in smart contract control flow based on a multimodal deep learning model, the method comprising:

[0006] Obtain the smart contract source code and convert it into bytecode, generate a control flow graph based on the extracted bytecode, and use the deep learning model GRU-GCN to extract the graph feature vector in the control flow graph;

[0007] Generate an abstract syntax tree according to the smart contract source code, extract node information in the abstract syntax tree, and use the deep learning model to generate an abstract syntax feature vector according to the node information;

[0008] Extracting comments from the smart contract source code, preprocessing the comments, and using a convolutional neural network to generate comment feature vectors based on the preprocessed comments;

[0009] The graph feature vector, the abstract syntax feature vector, and the annotation feature vector are stacked vertically to obtain a comprehensive feature representation matrix and store the matrix;

[0010] Determine the smart contract to be detected, calculate the corresponding target comprehensive feature representation matrix, and calculate the contract similarity between the target comprehensive feature representation and the comprehensive feature representation matrix by multiplying the RBF kernel function combined with the cosine similarity;

[0011] The smart contract to be detected is subjected to cloning detection and vulnerability detection according to the contract similarity.

[0012] In one embodiment, generating a control flow graph based on extracting the bytecode, and extracting a graph feature vector in the control flow graph using a deep learning model GRU-GCN, includes:

[0013] Use the fine-tuned BERT model to perform BERT embedding on the nodes in the control flow graph and extract node features;

[0014] According to the node features, the final hidden state of each node is calculated using the deep learning model GRU-GCN;

[0015] The deep learning model GRU-GCN generates a graph feature vector in the control flow graph based on the final hidden state.

[0016] In one embodiment, using the deep learning model to generate an abstract syntax feature vector according to the node information includes:

[0017] Inputting each of the node information into the deep learning model respectively, and generating each vector representing the abstract syntax feature through the deep learning model;

[0018] An abstract syntax feature vector is generated based on each of the vectors representing the abstract syntax features.

[0019] In one embodiment, extracting comments from the smart contract source code, preprocessing the comments, and using a convolutional neural network to generate comment feature vectors based on the preprocessed comments includes:

[0020] Extracting all comments from the smart contract source code and performing a cleaning operation on the comments to obtain preprocessed comments;

[0021] BERT embedding feature extraction is performed on the preprocessed annotations, and annotation feature vectors are extracted from the preprocessed annotations using the convolutional neural network combined with a self-attention mechanism.

[0022] In one embodiment, the method further comprises:

[0023] Extracting each annotation keyword from the preprocessed annotations by combining the convolutional neural network with a self-attention mechanism;

[0024] Summarize the annotation keywords to generate a word cloud;

[0025] The most commonly used words in the annotations are determined according to the word cloud, and the usage frequencies corresponding to the most commonly used words are calculated.

[0026] In one embodiment, the graph feature vector, the abstract syntax feature vector, and the annotation feature vector are vertically stacked to obtain a comprehensive feature representation matrix and store the matrix, including:

[0027] Vertically stacking the graph feature vector, abstract syntax feature vector, and annotation feature vector corresponding to the smart contract to obtain a comprehensive feature representation matrix of the smart contract;

[0028] The comprehensive feature representation matrix includes the control flow, grammatical structure, and semantic information of the smart contract;

[0029] The comprehensive feature representation matrix is ​​stored in a csv file.

[0030] In one embodiment, performing clone detection on the smart contract to be detected according to the contract similarity includes:

[0031] Based on the contract similarity, the target comprehensive feature representation is compared with the comprehensive feature representation matrix to obtain a similarity;

[0032] Compare the similarity with a similarity threshold, and if the similarity is greater than the similarity threshold, there is clone code between the smart contract to be detected and the smart contract;

[0033] Find the clone code and output it.

[0034] In one embodiment, performing vulnerability detection on the smart contract to be detected according to the contract similarity includes:

[0035] Based on the contract similarity, the target comprehensive feature representation and the comprehensive feature representation matrix are measured for similarity to obtain a similarity measurement result;

[0036] Identify, according to the similarity measurement result, a vulnerability code in the smart contract to be detected that corresponds to the control flow vulnerability of the smart contract;

[0037] The vulnerability existing in the smart contract to be detected is detected according to the vulnerability code.

[0038] A vulnerability detection system for smart contract control flow based on a multimodal deep learning model, the system comprising:

[0039] A control flow feature extraction module is used to obtain the smart contract source code and convert it into bytecode, generate a control flow graph based on the extracted bytecode, and use the deep learning model GRU-GCN to extract the graph feature vector in the control flow graph;

[0040] An abstract syntax feature extraction module is used to generate an abstract syntax tree according to the smart contract source code, extract node information in the abstract syntax tree, and use the deep learning model to generate an abstract syntax feature vector according to the node information;

[0041] An annotation feature extraction module, used to extract annotations in the smart contract source code, preprocess the annotations, and use a convolutional neural network to generate an annotation feature vector based on the preprocessed annotations;

[0042] A feature matrix calculation module, used for vertically stacking the graph feature vector, the abstract syntax feature vector, and the annotation feature vector to obtain a comprehensive feature representation matrix and store it;

[0043] A contract similarity calculation module is used to determine the smart contract to be detected, calculate the corresponding target comprehensive feature representation matrix, and calculate the contract similarity between the target comprehensive feature representation and the comprehensive feature representation matrix by multiplying the RBF kernel function combined with the cosine similarity;

[0044] The clone analysis and vulnerability detection module is used to perform clone detection and vulnerability detection on the smart contract to be detected based on the contract similarity.

[0045] The above-mentioned vulnerability detection method and system for smart contract control flow based on multimodal deep learning model can comprehensively capture the semantics, structure and execution details of the contract by extracting graph feature vectors, abstract syntax feature vectors and annotation feature vectors in the control flow graph, which is particularly important for accurately detecting these vulnerabilities; and by information processing of multiple features in bytecode, source code and annotations, it is possible to more intuitively analyze and understand vulnerability features and their changes, and further perform contract cloning analysis and vulnerability detection, which can improve the accuracy and generalization ability of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 An application environment diagram of a vulnerability detection method for a smart contract control flow based on a multimodal deep learning model in one embodiment;

[0047] Figure 2It is a flowchart of a vulnerability detection method of a smart contract control flow based on a multimodal deep learning model in one embodiment;

[0048] Figure 3 A schematic diagram of an interface display of an annotation word cloud in one embodiment;

[0049] Figure 4 is a Venn diagram with thresholds of 0.95 and 1.00 in one embodiment;

[0050] Figure 5 A schematic diagram of a ROC curve of a vulnerability detection result in an embodiment;

[0051] Figure 6 It is a flowchart of a vulnerability detection method for smart contract control flow based on a multimodal deep learning model in another embodiment;

[0052] Figure 7 It is a structural block diagram of a vulnerability detection system for smart contract control flow based on a multimodal deep learning model in one embodiment;

[0053] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The vulnerability detection method of smart contract control flow based on multimodal deep learning model provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1As shown, the application environment includes a computer device 110. The computer device 110 can obtain the smart contract source code and convert it into bytecode, generate a control flow graph according to the extracted bytecode, and use the deep learning model GRU-GCN to extract the graph feature vector in the control flow graph; the computer device 110 can generate an abstract syntax tree according to the smart contract source code, extract the node information in the abstract syntax tree, and use the deep learning model to generate an abstract syntax feature vector according to the node information; the computer device 110 can extract the comments in the smart contract source code, preprocess the comments, and use a convolutional neural network to generate an annotation feature vector according to the preprocessed comments; the computer device 110 can vertically stack the graph feature vector, the abstract syntax feature vector, and the annotation feature vector to obtain a comprehensive feature representation matrix and store it; the computer device 110 can determine the smart contract to be detected, calculate the corresponding target comprehensive feature representation matrix, and calculate the contract similarity between the target comprehensive feature representation and the comprehensive feature representation matrix by multiplying the RBF kernel function and the cosine similarity; the computer device 110 can perform clone detection and vulnerability detection on the smart contract to be detected according to the contract similarity. The computer device 110 may be, but is not limited to, various personal computers, laptop computers, smart phones, robots, unmanned aerial vehicles and other devices.

[0056] In one embodiment, Figure 2 As shown, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided, comprising the following steps:

[0057] Step 202: Obtain the smart contract source code and convert it into bytecode, generate a control flow graph based on the extracted bytecode, and use the deep learning model GRU-GCN to extract the graph feature vector in the control flow graph.

[0058] The computer device can obtain the source code of the smart contract. There may be vulnerabilities in the smart contract for subsequent vulnerability detection. The computer device can use a public encoder to convert the source code of the smart contract into bytecode.

[0059] Next, the computer device can use Python to develop and use the automated tool "Graphextractor" to extract the control flow graph from the compiled bytecode. In this embodiment, the process of the computer device operating the operation generates a control flow graph, in which nodes represent bytecode blocks and edges represent control flow transitions between these blocks.

[0060] In one embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided, which may also include a process of generating a graph feature vector, and the specific process includes: using a fine-tuned BERT model to perform BERT embedding on the nodes in the control flow graph and extracting node features; based on the node features, using the deep learning model GRU-GCN to calculate the final hidden state of each node; the deep learning model GRU-GCN generates a graph feature vector in the control flow graph based on the final hidden state.

[0061] The computer device can use a fine-tuned BERT model to process Ethereum Virtual Machine (EVM) instructions in the control flow graph. Unlike the simple word2vec embedding method in traditional deep learning methods, the BERT model can capture contextual dependencies and complex semantic details of named blocks in the control flow graph. Moreover, in this embodiment, contracts with different vulnerabilities are embedded separately, so that the BERT model has a more accurate understanding of each vulnerability, and the obtained embedding vector is more accurate and effective. Then, the computer device can use BERT embedding to extract features for each CFG node, and obtain a 256-dimensional vector, which represents the features of the bytecode block.

[0062] Specifically, the computer device can convert the control flow graph into a graph representation. The control flow information is represented as a tuple O cfg =(G,NF,CN), where G represents the graph containing all bytecode blocks and their control flow edges, and the expression formula is: G = {(u,g,v)u,v∈V,g∈G1}, where V is the node set and G1 is the edge set; NF represents the feature set of all bytecode blocks, represented by a 256-dimensional vector, and the expression formula is: NF = (f1,f2,f3,f4……f N ) T , where N is the total number of nodes, f is the 128-dimensional node feature vector, T represents the matrix transpose; CN refers to the contract file name, ending with .sol.

[0063] The computer device can use GRU-GCN for graph embedding. In this embodiment, a graph convolutional network (GCN) is used, which is based on graph embedding learning. It can update node representation by aggregating information of neighboring nodes, capture local structural information and encode topological relationships in the graph. The node feature matrix is ​​calculated using the formula: in is the normalized adjacency matrix, W (1) is the weight matrix of the graph convolutional layer.

[0064] Next, the hidden state of each node can be calculated. The update gate z t Determines the ratio of the current hidden state to the previous hidden state and the new candidate hidden state. The update gate calculation formula is:t =σ(W z x t +U z h t-1 ), where σ is the nonlinear activation function, Wz is the weight matrix of the update gate input, and Uz is the weight matrix from the hidden state of the previous time step to the update gate; x t is the input of the current time step t, h t-1 Represents the hidden state of the previous time step t-1. The computer device can calculate the influence of the hidden state. The reset gate determines the influence of the previous hidden state on the calculation of the new candidate hidden state. The calculation formula of the reset gate is: t =σ(W r x t +U r h t-1 ), where Wr is the weight matrix of the reset gate input and Ur is the weight matrix from the hidden state of the previous time step to the reset gate. The computer device can calculate the new candidate state The calculation formula is: Where tanh is the hyperbolic tangent (tanh) activation function, W is the weight matrix used to calculate the new candidate hidden state, U is the weight matrix from the previous hidden state to the new candidate hidden state, and ⊙ represents element-by-element multiplication. The computer device can calculate the final hidden state h t , the calculation formula is: So the final hidden state of GRU is Among them, H (2) The matrix shape is a two-dimensional matrix with N_batch rows and D_hidden columns, and D_hidden = 512; N_batch represents the batch size, that is, the number of samples processed in one training; D_hidden represents the dimension of the hidden layer, that is, the dimension of the hidden state of each time step in GRU; in this embodiment, D_hidden can be set to 512, indicating that the vector length of each hidden state is 512; h1, h2, h3... represent the hidden state vectors of each time step, and the shape of these vectors is D_hidden = 512*1; (h1, h2, h3...) means that N hidden state vectors are arranged in columns to form a matrix of D_hidden = 512*N; T represents the transposition of the matrix, and the matrix of D_hidden*N is transposed to the matrix of N*D_hidden. Finally, the control flow graph feature vector is generated. H (2) Input into the fully connected and regression layers to generate the final control flow graph feature vector. The vector formula is: F cfg ∈R 512, where R represents a natural number. The superscript R represents that this is a 512 by 512 matrix, which is composed of natural numbers and represents the output control flow graph feature vector F cfg .

[0065] Step 204: Generate an abstract syntax tree based on the smart contract source code, extract node information in the abstract syntax tree, and use a deep learning model to generate an abstract syntax feature vector based on the node information.

[0066] The computer device can generate an abstract syntax tree based on the smart contract source code. Specifically, an automated tool "ast-generation" developed in python is used to generate an abstract syntax tree (AST) from the source code. The computer device can use an automated tool to convert the source code into an AST to capture the structure and syntax information of the code.

[0067] Next, the computer device can focus on the role of each node in the AST (such as variable declaration, function definition, etc.) and the role of its child nodes. Then use the "ast-generation" tool to extract key information in the AST. Among them, key information may include the type of node, the role of the node, the number of child nodes, the existence of variables, and input and output parameters. For example, the "type" field of the node specifies the specific role or category of the node, and the "kind" field provides more detailed node role or category information.

[0068] In one embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided, which may also include a process of generating an abstract syntax feature vector. The specific process includes: inputting each node information into the deep learning model respectively, generating each vector representing the abstract syntax feature through the deep learning model; and generating an abstract syntax feature vector based on each vector representing the abstract syntax feature.

[0069] The computer device can input the extracted node information into a simple deep learning model for processing and generate a vector representing the abstract syntax feature. The abstract syntax feature vector of each contract is generated using the deep learning model, denoted as F ast ∈R 512 ; This feature vector contains a detailed description of the abstract syntax structure of the contract.

[0070] Step 206: extract the comments in the smart contract source code, preprocess the comments, and use a convolutional neural network to generate comment feature vectors based on the preprocessed comments.

[0071] Different from the traditional smart contract vulnerability detection method, in this embodiment, by introducing comments, the function of the code and the author's intention can be more clearly understood and utilized.

[0072] Specifically, in one embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided, which may also include a process of extracting annotation feature vectors. The specific process includes: extracting all annotations from the smart contract source code, and cleaning the annotations to obtain preprocessed annotations; performing BERT embedding feature extraction on the preprocessed annotations, and using a convolutional neural network combined with a self-attention mechanism to extract annotation feature vectors from the preprocessed annotations.

[0073] Computer equipment can extract all comments from smart contracts, which contain descriptions of contract functions and other relevant information. Then, the extracted comments can be preprocessed to remove invalid and meaningless characters, symbols and words, and only useful comments are retained. BERT embedding helps capture more detailed semantic information. In addition, BERT embedding feature extraction is performed on the comments of different vulnerabilities to improve the accuracy and effectiveness of feature extraction. A convolutional neural network (CNN) called "com-extractor" is used in combination with a self-attention mechanism to extract keywords and feature vectors from the comments of each contract. Convolutional neural networks are used to identify and extract important keywords, while self-attention mechanisms help better understand contextual relationships. Then, a feature vector of comments for each contract is generated, denoted as F. comments ∈R 512 ; These feature vectors represent the core information of the annotation and are used for subsequent similarity detection and vulnerability analysis.

[0074] In one embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided, which may also include a process of generating a word cloud, the specific process including: extracting each annotation keyword from the preprocessed annotation through a convolutional neural network combined with a self-attention mechanism; summarizing each annotation keyword to generate a word cloud; determining the most commonly used words in the annotation based on the word cloud, and calculating the usage frequency of the most commonly used words.

[0075] The computer equipment can summarize the keywords in all comments and generate word clouds. Most smart contracts use the SafeMath library, and most of the code content involves mathematical operations and mathematical operation checks. The generated comment word cloud is as follows: Figure 3 The word cloud provides an intuitive understanding of the most commonly used words and their frequency in the comments, which can provide useful information about the libraries and mathematical operations used in the contract, helping to understand the main functions of the contract and potential vulnerabilities.

[0076] Step 208: vertically stack the graph feature vector, the abstract syntax feature vector, and the annotation feature vector to obtain a comprehensive feature representation matrix and store it.

[0077] Among them, the computer device can convert the graph feature vector, abstract syntax feature vector, and annotation feature vector corresponding to the smart contract, that is, F cfg ∈R 512 , F ast ∈R 512 , F comments ∈R 512 Vertical stacking is performed to obtain the comprehensive feature representation matrix F of the smart contract; the comprehensive feature representation matrix is ​​stored in a csv file. Among them, the comprehensive feature representation matrix contains the control flow, grammatical structure, and semantic information of the smart contract. The comprehensive feature representation matrix F of all smart contracts is stored in a csv file to provide a basis for subsequent contract cloning detection and vulnerability analysis.

[0078] Step 210, determine the smart contract to be detected, calculate the corresponding target comprehensive feature representation matrix, and calculate the contract similarity between the target comprehensive feature representation and the comprehensive feature representation matrix by multiplying the RBF kernel function and the cosine similarity.

[0079] In order to detect code clones between contracts, the code similarity of the contracts is calculated by multiplying the RBF kernel function and the cosine similarity. Among them, the cosine similarity is used to evaluate the directional similarity of the contract feature vector, while the RBF kernel function helps to deal with the high-dimensional and sparsity problems of the data; combining the two can not only use the directional similarity of the cosine similarity to quickly calculate the basic similarity of the contract features, but also use the RBF kernel function to capture more complex nonlinear relationships; this combination is more comprehensive than using either one alone, and can improve the accuracy and robustness of the similarity calculation.

[0080] Step 212, perform clone detection and vulnerability detection on the smart contract to be detected based on contract similarity.

[0081] In one embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided, which may also include a process of performing clone detection, and the specific process includes: based on contract similarity, performing a similarity comparison between the target comprehensive feature representation and the comprehensive feature representation matrix to obtain the similarity; comparing the similarity with the similarity threshold, if the similarity is greater than the similarity threshold, then there is clone code between the smart contract to be detected and the smart contract; searching for the clone code and outputting it.

[0082] Specifically, for a newly input smart contract to be detected, its feature representation matrix Fc is compared with the existing contracts in the database for similarity. If the similarity exceeds the set threshold, it is considered that the input contract and some existing contracts are code clones, and similar code segments are output. In this embodiment, the clone detection result code can be displayed on the interface. Through the display interface, it can be intuitively understood that the clone detection process in this application can effectively detect codes with similar architectures or similar functions, and will not fail to detect cloned contracts due to differences in code variable names and contract names.

[0083] In this embodiment, the Venn diagram can be used to further demonstrate the code cloning capability. Figure 4 As shown in the figure, the similarity thresholds are set to 0.95 and 1.00 respectively, SE is the result of similarity detection, and Original is the dataset used for clone detection. Figure 4 It can be seen that clone detection is very effective. In addition, it can also effectively handle contracts that cannot be vectorized in other methods due to incompatible compiler versions or code formats.

[0084] In one embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided, which may also include a process of performing vulnerability detection, the specific process including: based on contract similarity, performing similarity measurement on the target comprehensive feature representation and the comprehensive feature representation matrix to obtain a similarity measurement result; identifying the vulnerability code corresponding to the smart contract control flow vulnerability in the smart contract to be detected according to the similarity measurement result; and detecting the vulnerability in the smart contract to be detected according to the vulnerability code.

[0085] In this embodiment, during the contract verification phase, the computer device can identify code similar to the erroneous control flow vulnerability in the existing contract by performing similarity measurement on the input contract features, thereby detecting potential vulnerabilities.

[0086] In order to verify the performance of smart contract vulnerability detection, an experiment was conducted on the vulnerability detection results. The ROC curve of the experimental results is shown in the figure below: Figure 5 The performance of vulnerability detection results in terms of accuracy, recall, precision and F1-score are shown in the following table:

[0087]

[0088] according to Figure 5 As shown in the above table, it can be seen that the vulnerability detection method for smart contract control flow based on the multimodal deep learning model provided in this application has good vulnerability detection capabilities under various indicators.

[0089] In one embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided. The specific process is as follows: Figure 6 As shown, including:

[0090] Get the smart contract source code and convert it into bytecode;

[0091] The bytecode generates a control flow graph CFG, and performs BERT embedding on the nodes in the data flow graph to extract node features;

[0092] The deep learning model GRU-GCN is used to extract the graph feature vector Fcfg of the entire data flow graph;

[0093] Generate an abstract syntax tree AST from the source code;

[0094] Use deep learning model to extract abstract syntax feature vector Fast from abstract syntax tree;

[0095] Then determine whether there are comments in the code. If not, fill the vector with 0 as the comment feature vector Fcom; if yes, extract and clean the comments in the source code, use the BERT model for embedding and the deep learning model to extract the comment feature Fcom;

[0096] The three feature vectors, graph feature vector, abstract syntax feature vector, and annotation feature vector, are vertically combined into a matrix, and the matrix of all contracts is recorded as a database;

[0097] Extract three feature vectors of the new smart contract and generate a feature matrix;

[0098] Similarity check: Check whether the contract has similar contracts or has control flow vulnerabilities.

[0099] In this embodiment, a vulnerability detection method for smart contract control flow based on a multimodal deep learning model is provided for smart contract cloning detection and vulnerability verification. By combining the control flow graph (CFG), abstract syntax tree (AST) and code comments, the characteristics of smart contracts are captured from multiple angles. This method overcomes the limitations of a single modality method. Specifically, deep learning technology is used to automatically learn the patterns and characteristics of smart contract vulnerabilities without relying on expert-defined detection rules, thereby improving detection efficiency and accuracy. By integrating multiple data sources, not only the detection accuracy is improved, but also the generalization ability of the model is enhanced.

[0100] Therefore, the technical key of this application lies in the application of a multimodal deep learning framework for vulnerability analysis and clone detection of contracts with control flow vulnerabilities using a multimodal deep learning model. Specifically, by integrating control flow graphs, abstract syntax trees and code comments, the problem that traditional single-modal methods cannot fully capture information is overcome; this framework can comprehensively analyze the behavioral logic and state transitions of smart contracts from multiple levels, thereby providing more accurate vulnerability detection. In addition, a deep learning model is also used to automatically identify vulnerability patterns in smart contracts, eliminating the reliance on expert-defined detection rules. The models include GRU-GCN, etc. Through this method, potential vulnerabilities in contracts can be processed and detected more quickly, while improving the comprehensiveness and accuracy of detection. At the same time, the RBF kernel function is introduced to multiply the cosine similarity to calculate the code similarity of the contract; finally, the embedding and utilization of code comments, specifically, the code comments are embedded as supplementary features for code vulnerability detection and clone analysis for the first time, thereby enhancing the model's grasp of contract functions and partial attention information, and improving the accuracy and overall performance of detection.

[0101] It should be understood that, although the steps in the above-mentioned flowcharts are shown in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flowcharts may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0102] In one embodiment, Figure 7 As shown, a vulnerability detection system for smart contract control flow based on a multimodal deep learning model is provided, including: a control flow feature extraction module 710, an abstract syntax feature extraction module 720, an annotation feature extraction module 730, a feature matrix calculation module 740, a contract similarity calculation module 750 and a clone analysis and vulnerability detection module 760, wherein:

[0103] A control flow feature extraction module 710 is used to obtain the smart contract source code and convert it into bytecode, generate a control flow graph according to the extracted bytecode, and use the deep learning model GRU-GCN to extract the graph feature vector in the control flow graph;

[0104] Abstract syntax feature extraction module 720, used to generate an abstract syntax tree according to the smart contract source code, extract node information in the abstract syntax tree, and use a deep learning model to generate an abstract syntax feature vector according to the node information;

[0105] Annotation feature extraction module 730, used to extract the annotations in the smart contract source code, pre-process the annotations, and use a convolutional neural network to generate an annotation feature vector based on the pre-processed annotations;

[0106] A feature matrix calculation module 740 is used to vertically stack the graph feature vector, the abstract syntax feature vector, and the annotation feature vector to obtain a comprehensive feature representation matrix and store it;

[0107] The contract similarity calculation module 750 is used to determine the smart contract to be detected, calculate the corresponding target comprehensive feature representation matrix, and calculate the contract similarity between the target comprehensive feature representation and the comprehensive feature representation matrix by multiplying the RBF kernel function and the cosine similarity.

[0108] The clone analysis and vulnerability detection module 760 is used to perform clone detection and vulnerability detection on the smart contract to be detected based on contract similarity.

[0109] In one embodiment, the control flow feature extraction module 710 is also used to use the fine-tuned BERT model to perform BERT embedding on the nodes in the control flow graph and extract node features; based on the node features, the deep learning model GRU-GCN is used to calculate the final hidden state of each node; the deep learning model GRU-GCN generates a graph feature vector in the control flow graph based on the final hidden state.

[0110] In one embodiment, the abstract syntax feature extraction module 720 is further used to input each node information into the deep learning model respectively, generate each vector representing the abstract syntax feature through the deep learning model; and generate an abstract syntax feature vector based on each vector representing the abstract syntax feature.

[0111] In one embodiment, the comment feature extraction module 730 is also used to extract all comments from the smart contract source code, and clean the comments to obtain preprocessed comments; perform BERT embedding feature extraction on the preprocessed comments, and use a convolutional neural network combined with a self-attention mechanism to extract comment feature vectors from the preprocessed comments.

[0112] In one embodiment, the annotation feature extraction module 730 is also used to extract various annotation keywords from the preprocessed annotations through a convolutional neural network combined with a self-attention mechanism; summarize the various annotation keywords to generate a word cloud; determine the most commonly used words in the annotations based on the word cloud, and calculate the usage frequency of the most commonly used words.

[0113] In one embodiment, the feature matrix calculation module 740 is also used to vertically stack the graph feature vectors, abstract syntax feature vectors, and annotation feature vectors corresponding to the smart contract to obtain a comprehensive feature representation matrix of the smart contract; wherein the comprehensive feature representation matrix includes the control flow, syntax structure, and semantic information of the smart contract; and the comprehensive feature representation matrix is ​​stored in a csv file.

[0114] In one embodiment, the clone analysis and vulnerability detection module 760 is also used to compare the target comprehensive feature representation with the comprehensive feature representation matrix based on contract similarity to obtain similarity; compare the similarity with the similarity threshold. If the similarity is greater than the similarity threshold, there is clone code between the smart contract to be detected and the smart contract; find the clone code and output it.

[0115] In one embodiment, the clone analysis and vulnerability detection module 760 is also used to measure the similarity between the target comprehensive feature representation and the comprehensive feature representation matrix based on contract similarity to obtain a similarity measurement result; identify the vulnerability code corresponding to the smart contract control flow vulnerability in the smart contract to be detected according to the similarity measurement result; and detect the vulnerability existing in the smart contract to be detected according to the vulnerability code.

[0116] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a vulnerability detection method for the control flow of a smart contract based on a multimodal deep learning model is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0117] Those skilled in the art will understand that Figure 8The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0118] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, steps of a method for vulnerability detection of smart contract control flow based on a multimodal deep learning model are implemented.

[0119] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of a vulnerability detection method for a smart contract control flow based on a multimodal deep learning model are implemented.

[0120] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0121] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A vulnerability detection method for smart contract control flow based on a multimodal deep learning model, characterized in that: The method comprises: Obtain the smart contract source code and convert it into bytecode, generate a control flow graph based on the extracted bytecode, and use the deep learning model GRU-GCN to extract the graph feature vector in the control flow graph; Generate an abstract syntax tree according to the smart contract source code, extract node information in the abstract syntax tree, and use the deep learning model to generate an abstract syntax feature vector according to the node information; Extracting comments from the smart contract source code, preprocessing the comments, and using a convolutional neural network to generate comment feature vectors based on the preprocessed comments; The graph feature vector, the abstract syntax feature vector, and the annotation feature vector are stacked vertically to obtain a comprehensive feature representation matrix and store the matrix; Determine the smart contract to be detected, calculate the corresponding target comprehensive feature representation matrix, and calculate the contract similarity between the target comprehensive feature representation and the comprehensive feature representation matrix by multiplying the RBF kernel function combined with the cosine similarity; The smart contract to be detected is subjected to cloning detection and vulnerability detection according to the contract similarity.

2. The vulnerability detection method for smart contract control flow based on multimodal deep learning model according to claim 1 is characterized in that: Generating a control flow graph according to the extracted bytecode, and extracting a graph feature vector in the control flow graph using a deep learning model GRU-GCN, including: Use the fine-tuned BERT model to perform BERT embedding on the nodes in the control flow graph and extract node features; According to the node features, the final hidden state of each node is calculated using the deep learning model GRU-GCN; The deep learning model GRU-GCN generates a graph feature vector in the control flow graph based on the final hidden state.

3. The vulnerability detection method for smart contract control flow based on multimodal deep learning model according to claim 1 is characterized in that: Using the deep learning model to generate an abstract syntax feature vector according to the node information includes: Inputting each of the node information into the deep learning model respectively, and generating each vector representing the abstract syntax feature through the deep learning model; An abstract syntax feature vector is generated based on each of the vectors representing the abstract syntax features.

4. The vulnerability detection method for smart contract control flow based on multimodal deep learning model according to claim 1 is characterized in that: Extracting comments from the smart contract source code, preprocessing the comments, and using a convolutional neural network to generate comment feature vectors based on the preprocessed comments, including: Extracting all comments from the smart contract source code and performing a cleaning operation on the comments to obtain preprocessed comments; BERT embedding feature extraction is performed on the preprocessed annotations, and annotation feature vectors are extracted from the preprocessed annotations using the convolutional neural network combined with a self-attention mechanism.

5. The vulnerability detection method for smart contract control flow based on multimodal deep learning model according to claim 4 is characterized in that: The method further comprises: Extracting each annotation keyword from the preprocessed annotations by combining the convolutional neural network with a self-attention mechanism; Summarize the annotation keywords to generate a word cloud; The most commonly used words in the annotation are determined according to the word cloud, and the usage frequency corresponding to the most commonly used words is calculated.

6. The vulnerability detection method for smart contract control flow based on multimodal deep learning model according to claim 1 is characterized in that: The graph feature vector, the abstract syntax feature vector, and the annotation feature vector are stacked vertically to obtain a comprehensive feature representation matrix and store it, including: Vertically stacking the graph feature vector, abstract syntax feature vector, and annotation feature vector corresponding to the smart contract to obtain a comprehensive feature representation matrix of the smart contract; The comprehensive feature representation matrix includes the control flow, grammatical structure, and semantic information of the smart contract; The comprehensive feature representation matrix is ​​stored in a csv file.

7. The vulnerability detection method for smart contract control flow based on multimodal deep learning model according to claim 1 is characterized in that: Performing clone detection on the smart contract to be detected according to the contract similarity includes: Based on the contract similarity, the target comprehensive feature representation is compared with the comprehensive feature representation matrix to obtain a similarity; Compare the similarity with a similarity threshold, and if the similarity is greater than the similarity threshold, there is clone code between the smart contract to be detected and the smart contract; Find the clone code and output it.

8. The vulnerability detection method for smart contract control flow based on multimodal deep learning model according to claim 1 is characterized in that: Performing vulnerability detection on the smart contract to be detected according to the contract similarity, including: Based on the contract similarity, the target comprehensive feature representation and the comprehensive feature representation matrix are measured for similarity to obtain a similarity measurement result; Identify, according to the similarity measurement result, a vulnerability code in the smart contract to be detected that corresponds to the control flow vulnerability of the smart contract; The vulnerability existing in the smart contract to be detected is detected according to the vulnerability code.

9. A vulnerability detection system for smart contract control flow based on a multimodal deep learning model, characterized in that: The system comprises: A control flow feature extraction module is used to obtain the smart contract source code and convert it into bytecode, generate a control flow graph based on the extracted bytecode, and use the deep learning model GRU-GCN to extract the graph feature vector in the control flow graph; An abstract syntax feature extraction module is used to generate an abstract syntax tree according to the smart contract source code, extract node information in the abstract syntax tree, and use the deep learning model to generate an abstract syntax feature vector according to the node information; An annotation feature extraction module, used to extract annotations in the smart contract source code, preprocess the annotations, and use a convolutional neural network to generate an annotation feature vector based on the preprocessed annotations; A feature matrix calculation module, used for vertically stacking the graph feature vector, the abstract syntax feature vector, and the annotation feature vector to obtain a comprehensive feature representation matrix and store it; A contract similarity calculation module is used to determine the smart contract to be detected, calculate the corresponding target comprehensive feature representation matrix, and calculate the contract similarity between the target comprehensive feature representation and the comprehensive feature representation matrix by multiplying the RBF kernel function combined with the cosine similarity; The clone analysis and vulnerability detection module is used to perform clone detection and vulnerability detection on the smart contract to be detected based on the contract similarity.

10. The vulnerability detection system for smart contract control flow based on multimodal deep learning model according to claim 9 is characterized in that: The control flow feature extraction module is also used to: use the fine-tuned BERT model to perform BERT embedding on the nodes in the control flow graph and extract node features; According to the node features, the final hidden state of each node is calculated using the deep learning model GRU-GCN; The deep learning model GRU-GCN generates a graph feature vector in the control flow graph based on the final hidden state.

Images