Intelligent contract vulnerability detection method based on code graph fusion analysis and graph matching network

Abstract

The invention relates to the field of intelligent contract vulnerability detection, in particular to an intelligent contract vulnerability detection method based on code graph fusion analysis and a graph matching network. The method comprises the steps of constructing an intelligent contract source code data set; through static analysis, extracting three different code feature information including a control flow diagram, a data flow diagram and an abstract syntax tree from the source code of the smart contract; carrying out information integration on the three extracted code features, and constructing a code graph covering wider features; on the basis of the generated code graph, a GraphCodeBerT model is used for pre-training; vectorizing a code graph which is output by the pre-training model and contains structural and semantic features through a graph embedding network; and learning the feature representation of the contract pair by using a cross-graph attention mechanism of a graph matching network to realize specific vulnerability detection of the smart contract source code. According to the invention, potential vulnerabilities can be accurately identified.

Description

Technical Field

[0001] The present invention relates to the field of smart contract vulnerability detection, and in particular to a smart contract vulnerability detection method based on code graph fusion analysis and graph matching network. Background Art

[0002] In the current wave of technological innovation, blockchain technology has been deeply applied to many fields such as finance, management, healthcare and the Internet of Things, and is playing an increasingly important role. However, as a core component in the blockchain ecosystem, smart contracts may pose security risks in actual operation due to design flaws in programming languages ​​or improper coding by developers. These vulnerabilities may be exploited by malicious attackers, leading to serious problems such as financial losses, data leakage or interruption of contract functions, directly threatening the stability and credibility of the blockchain system. Therefore, improving the security of smart contracts has become a key task to ensure the reliable development of blockchain technology.

[0003] As the demand for smart contract vulnerability detection increases, traditional detection methods face limitations. Deep learning technology, especially graph neural networks, shows great potential, but its application still faces challenges. Traditional smart contract vulnerability detection methods mainly rely on manual review and expert experience. For example, symbolic execution is difficult to handle complex semantic features and is easily affected by the path explosion problem, resulting in low detection efficiency; the degree of automation and test path coverage of fuzz testing are limited, and it is difficult to accurately locate the vulnerability location; formal verification requires manual writing and verification of its specifications and properties, and it is difficult to fully simulate the execution environment and randomness of the Ethereum virtual machine. In contrast, graph neural networks can capture both grammatical and semantic features in smart contracts, but existing methods still have shortcomings in feature extraction. On the one hand, the code structure of smart contracts is complex, containing multiple nodes and edges such as variables, functions, and call relationships. It is difficult for a single graph structure to fully express this information; on the other hand, these methods usually only focus on the analysis of a single contract, ignoring the similarities between multiple contracts, which may be closely related to certain vulnerability types. Therefore, improving feature expression capabilities and making full use of the similarities between contracts are key directions for further optimizing smart contract vulnerability detection methods based on graph neural networks. Summary of the invention

[0004] In order to solve the problem that the existing technology only relies on a single structure and is difficult to fully express the complexity of the code, improve the feature expression ability and make full use of the similarity between contracts, the present invention provides a smart contract vulnerability detection method based on code graph fusion analysis and graph matching network, which mainly includes:

[0005] A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network, comprising:

[0006] S1: Construct a smart contract source code dataset, which includes the target contract source code, the secure contract source code, and the vulnerable contract source code;

[0007] S2: Extract the grammatical features of three different codes, namely control flow graph, data flow graph and abstract syntax tree, from the smart contract source code through static analysis methods; integrate the information of the extracted grammatical features to construct a code graph covering a wider range of features;

[0008] S3: Based on the code graph generated by S2, it is pre-trained using the GraphCodeBerT model;

[0009] S4: Vectorize the code graph containing structural and semantic features output by the pre-trained GraphCodeBerT model through the graph embedding network;

[0010] S5: Utilize the cross-graph attention mechanism of the graph matching network to learn the feature representation of contract pairs and implement specific vulnerability detection in smart contract source code.

[0011] A smart contract vulnerability detection device based on code graph fusion analysis and graph matching network, comprising: a processor and a storage device; the processor loads and executes instructions and data in the storage device to implement a smart contract vulnerability detection method based on code graph fusion analysis and graph matching network.

[0012] The technical solution provided by the present invention has the following beneficial effects: the present invention constructs a new code graph representation method by comprehensively utilizing abstract syntax trees, control flow graphs, and data flow graphs, which can fully capture the syntax and semantic features of smart contract codes. Unlike the limitations of existing methods that rely only on a single structure to represent code, this method integrates the syntax and semantic features of smart contracts in multiple dimensions, and can more comprehensively and accurately reflect the actual operation logic of the contract. The present invention combines the GraphCodeBerT pre-training technology, makes full use of the structured information of the code, learns deep syntax and semantic features, and greatly improves the model's ability to understand complex code graphs. Compared with the existing detection method based on graph neural networks, the present invention pioneered the cross-graph attention mechanism of the graph matching network, breaking through the limitation of only analyzing a single contract code graph in the prior art, and can not only capture the internal features of a single code graph, but also perform similarity analysis through cross-graph features between contracts, and can accurately calculate the similarity of graph features between smart contracts, and extract potential vulnerability information from similar structures between multiple contracts. This cross-graph analysis method breaks through the limitations of single contract detection and provides higher accuracy and reliability for vulnerability detection. This combination of multi-graph fusion and cross-graph feature matching not only makes vulnerability detection closer to the actual operation logic of smart contracts, but also significantly improves the accuracy, robustness and comprehensiveness of detection, providing a more efficient and reliable solution to the problems of insufficient feature expression and insufficient multi-contract analysis capabilities in traditional methods. Compared with traditional methods, this invention has significant advantages in feature expression and vulnerability detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0014] Figure 1 It is a flow chart of a smart contract vulnerability detection method based on code graph fusion analysis and graph matching network in an embodiment of the present invention;

[0015] Figure 2 is a schematic diagram of a code graph construction method in an embodiment of the present invention;

[0016] Figure 3 is a schematic diagram of the Skip-Gram model in an embodiment of the present invention;

[0017] Figure 4 It is a schematic diagram of the construction and workflow of the detection model in an embodiment of the present invention;

[0018] Figure 5 It is a schematic diagram of the operation of the hardware device in the embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described in detail with reference to the accompanying drawings.

[0020] Example 1

[0021] Please refer to Figure 1 , Figure 1 It is a flow chart of a smart contract vulnerability detection method based on code graph fusion analysis and graph matching network in an embodiment of the present invention, which specifically includes:

[0022] S1: Construct a smart contract source code dataset, which includes the target contract source code, the secure contract source code, and the vulnerable contract source code.

[0023] The smart contract source code dataset is a publicly available large-scale, Solidity-based smart contract vulnerability dataset, containing 47,398 real and unique sol files, with a total of approximately 203,716 contracts. Among the 47,398 contract files, 2,742 contracts do not contain any vulnerabilities. 680 contracts were found to exist, 2,242 contracts had timestamp dependency vulnerabilities, and 1,368 contracts were found to have integer overflow / underflow vulnerabilities. These vulnerabilities are common in Ethereum smart contracts.

[0024] S2, through static analysis method, from the smart contract source code (i.e. Figure 2 The three different code feature information, namely control flow graph CFG, data flow graph DFG and abstract syntax tree AST, are extracted from the source code in the source code; the information of the three extracted code features is integrated to construct a code graph CG covering a wider range of features.

[0025] S2.1.1, use the Solidity static analysis tool Slither to generate a control flow graph. Each node of the control flow graph represents a statement, and each edge represents the control flow between statements;

[0026] S2.1.2, based on the control flow graph, extract the data flow between statements through the definition and use of each variable;

[0027] S2.1.3, use the Solidity syntax analysis tool solc-typed-ast to extract the abstract syntax tree of each statement to reflect the grammatical characteristics of the code.

[0028] The type information of each statement can be obtained from the "nodeType" field of the root node of the AST subtree. These type information carry certain semantic meanings, for example, the "ForStatement" type represents the beginning of a loop structure, and the "VariableDeclaration" type indicates the definition of a new variable.

[0029] S2.2.1, introduces two types of virtual nodes: "v_fun" and "v_loop", which are used to connect nodes of different ranges in the graph. Virtual nodes have no content;

[0030] The "v_fun" node is connected to all nodes in the control flow graph through directed edges from all nodes in the control flow graph to the "v_fun" node, and the "v_loop" node is connected to all nodes in the loop block through directed edges from nodes inside the loop block.

[0031] S2.2.2, use the abstract syntax tree of each statement to replace the content of the corresponding node in the control flow graph to preserve the tree structure of the grammatical features;

[0032] S2.2.3, merge the type of each statement into the corresponding node in the graph, complete the merging of the three code information, and form a code graph covering a wider range of features. Figure 2 , Figure 2 This is a schematic diagram of the code graph construction method.

[0033] S3, based on the generated code graph, is pre-trained using the GraphCodeBerT model.

[0034] S3.1, get the set of variables and edges according to the code graph Where Var = {v 1 ,v 2 ,...,v k} is a variable set, v 1 ,v 2 ,...,v k Represents the variables in the code graph, Edge = {e 1 ,e 2 ,...,e l} is a directed edge set, indicating where the value of each variable comes from; e 1 ,e 2 ,...,e l Represents a directed edge in the code graph.

[0035] S3.2, concatenate the source code and the variable set into a sequence X, X = {[CLS], SC, [SEP], Var}, where [CLS] is a special symbol in front of the set of variables and edges, and [SEP] is a special symbol used to separate the smart contract source code SC and the variable set Var;

[0036] S3.3, convert the sequence into an input vector H 0 ;

[0037] For each token in X, it is represented by adding the token itself to the positional embedding of the token; for all variables in X, a special positional embedding is used to represent the data flow relationship.

[0038] S3.4, uses 12 Transformer layers to generate contextual representations for the input vector; including:

[0039] In the input vector H 0 12 Transformer layers are used to generate the context representation H n =transformer n (H n -1 ), n∈[1,N], the structure of each Transformer layer is the same, and the input H of the nth layer n-1 Generate vector G using multi-head self-attention operation n , whose expression is:

[0040] G n =LN(MultiAttn(H n-1 )+H n-1 )

[0041] Among them, MultiAttn is a multi-head self-attention mechanism.

[0042] Vector G n Then pass through a feedforward layer to output vector H n , whose expression is:

[0043] H n =LN(FFN(G n )+G n )

[0044] Among them, FFN is a two-layer feed-forward network, and LN represents the layer normalization operation.

[0045] Use the graph to guide the mask attention matrix M to filter irrelevant information. The matrix form is:

[0046]

[0047] in, Represents node var i Query, Is the node var i Edge′ is a set used to represent the relationship between source code tokens and data flow nodes. j The variable var is detected in i ,but i ​,code j > / j ,var i >∈Edge′.

[0048] If the node var i and node var j There is a direct edge between them, namely i ,var j >∈Edge, or they are the same node, that is, i=j, then Notice Otherwise, an infinite negative value is added to the attention score to mask the attention.

[0049] S3.5, pre-training based on GraphCodeBerT. The three pre-training tasks included in the GraphCodeBerT pre-training are: Task 1, masked language modeling, which aims to learn representations from source code; Task 2, data flow edge prediction, which is used to learn representation edges from data flow; Task 3, variable alignment across source code and data flow, which is used to align representations between source code and data flow and predict the identification position of variables.

[0050] S4, through the graph embedding network, the code graph containing structural and semantic features output by the pre-trained model is vectorized.

[0051] S4.1, extract the embedding representation of each node from the pre-trained model GraphCodeBerT, which contains the context information and graph structure information of the code; the node here represents the code graph, that is, the node in the merged code graph. In addition to the virtual nodes, there are other nodes in the merged code graph, which is an inclusion relationship.

[0052] S4.2, using Figure 3 The Skip-gram model shown converts node annotations and edge annotations in the code graph into dense vector representations. The Skip-Gram model includes an input layer, a hidden layer, and an output layer. The vector conversion process includes: building a corpus of the Skip-gram model with all node texts in the abstract syntax tree AST; performing one-hot encoding on the node text to generate a sparse vector (i.e. Figure 3 The Skip-gram model and Hierarchical Softmax-based multi-classifier are used to train the model to build a vector mapping table for all sentence texts.

[0053] S5, using the graph matching network (i.e. Figure 1 The cross-graph attention mechanism GMN of the detection model in is used to learn the feature representation of contract pairs and realize specific vulnerability detection in smart contract source code.​​

[0054] Instead of mapping each graph to a feature vector independently, the graph matching network simultaneously obtains a pair of graphs, embeds them into graph vectors by word2vec, and uses a cross-graph attention mechanism to learn the embedding. Figure 4 , Figure 4 It is a schematic diagram of the construction and workflow of the detection model.

[0055] S5.1, the smart contract source code dataset (i.e. Figure 4 The secure contract source code and the vulnerable contract source code in the training set (in the training set) are randomly combined into image pairs to obtain contract pairs;

[0056] S5.2, use the contract pair to train the cross-graph attention mechanism GMN, and combine the detection model to detect the target contract source code to achieve specific vulnerability detection of the smart contract source code. The process of specific vulnerability detection includes:

[0057] (1) Extract and encode nodes and edges in the code graph.

[0058] The encoding layer uses a multilayer perceptron to extract and encode the features of nodes and edges CG = (Node, Edge):

[0059]

[0060] Among them, α i is node n i The eigenvector of ij It is edge ij The characteristic vector of i (0) is the initial embedding of the ith node, e ij is the initial embedding of the edge between the i-th and j-th nodes; MLP node Represents a neural network structure. The input of the structure is the feature vector of the node, and the output is the encoding vector of the node. Node represents the set of nodes in the code graph. Each node contains the smart contract statement information of the node. Edge represents the set of edges in the code graph. Each edge represents the control relationship and data relationship between two nodes.

[0061] (2) Update the edge vectors, node vectors and graph vectors in the graph network.

[0062] The attention mechanism is introduced in the propagation layer to interact information between the two code graphs. Given two code graphs CG 1 (Node 1 ,Edge 1 ) and CG 2 (Node 2 ,Edge 2), at the tth iteration, the propagation layer formula is:

[0063]

[0064]

[0065] Among them, η i (t) and η j (t) They are CG 1 and CG 2 The node hidden vector set of f m is a message function, from node n i The neighborhood collects messages; f c Used for cross-graph information calculation; function f u Acts as a node update mechanism, integrating these messages with the final hidden state of the node embedding; η i (t+1) Represents the node hidden vector set at the t+1th iteration.

[0066] Using the cross-graph attention mechanism, calculate the code graph CG 1 Node i in the code graph CG 2 The attention between any nodes in is given by:

[0067]

[0068] Among them, S η is the vector space similarity measure, a j→i is the attention weight, ∑ j v j→i It is code diagram CG 1 The node hidden vector set η i (t) With code diagram CG 2 The nearest neighbor η in j (T) The difference between Represents the code graph CG at time t 2 Any node in, j' represents the code graph CG 2 The sequence number of the midpoint.

[0069] After T rounds of updates, the aggregated code graph CG 1 And code diagram CG 2 The information of all nodes in to generate a vector representing the global graph structure information:

[0070]

[0071] Among them, f a is a graph aggregation function, Representation code diagram CG 1 The set of hidden state vectors of all nodes in , Representation code diagram CG 2 The set of hidden state vectors of all nodes in , Representation code diagram CG 1 The hidden state vector of the i-th node after T rounds of updates, Representation code diagram CG 2 The hidden state vector of the jth node after T rounds of updates, Node 1 Representation code diagram CG 1 Node collection, Node 2 Representation code diagram CG 2 A collection of nodes.

[0072] (3) Calculate the similarity of graph pairs in the aggregation layer to detect whether there are loopholes in the smart contract. The similarity calculation formula is:

[0073]

[0074] Where s is the similarity score, s∈[-1,1], f s yes and The closer s is to -1, the less similar the two code graphs are; the closer s is to 1, the more similar the two code graphs are.

[0075] By comparing the similarity coefficient with the preset threshold, if the similarity coefficient exceeds the threshold, it is determined that the contract has a vulnerability; otherwise, it continues to form a new graph structure data pair with other contracts in the training set and perform similarity calculations; when the similarity coefficients of all data pairs do not exceed the threshold, it is confirmed that the contract has no vulnerabilities.

[0076] The above method can achieve effective smart contract vulnerability detection. Table 1 is a comparison chart of the results of different methods in evaluating reentrancy, timestamp and integer overflow vulnerability detection indicators.

[0077] Table 1 Comparative analysis of the detection results of three vulnerabilities by different detection methods

[0078]

[0079] The present invention has a wide range of application value in all key stages of smart contracts. In the development stage, developers can use this method to perform static analysis on smart contracts, timely discover potential security vulnerabilities and optimize code design, thereby improving contract security from the source; in the deployment stage, this method can be used as an automated detection tool to comprehensively scan and verify smart contracts to prevent attacks caused by vulnerabilities, thereby protecting user funds and system stability; in the audit stage, auditors can use this method to conduct in-depth analysis of contracts, systematically explore potential risks and generate detailed repair suggestions to ensure that the contract meets high security standards. This applicability throughout the entire process of development, deployment and auditing enables the present invention to meet the actual needs in the field of smart contract vulnerability detection, and has significant promotion value and commercialization potential.

[0080] Example 2

[0081] A smart contract vulnerability detection device 401 based on code graph fusion analysis and graph matching network, such as Figure 5 As shown, it includes: a processor 402 and a storage device 403; the processor 402 loads and executes instructions and data in the storage device 403 to implement the smart contract vulnerability detection method based on code graph fusion analysis and graph matching network.

[0082] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network, characterized in that: include: S1: Construct a smart contract source code dataset, which includes the target contract source code, the secure contract source code, and the vulnerable contract source code; S2: Extract the grammatical features of three different codes, namely control flow graph, data flow graph and abstract syntax tree, from the smart contract source code through static analysis methods; integrate the information of the extracted grammatical features to construct a code graph covering a wider range of features; S3: Based on the code graph generated by S2, it is pre-trained using the GraphCodeBerT model; S4: Vectorize the code graph containing structural and semantic features output by the pre-trained GraphCodeBerT model through the graph embedding network; S5: Using the cross-graph attention mechanism of the graph matching network, we learn the feature representation of the contract pair and implement specific vulnerability detection in the smart contract source code. The process of specific vulnerability detection is as follows: (1) Extract and encode nodes and edges in the code graph The encoding layer in the graph matching network uses a multilayer perceptron to extract and encode the features of nodes and edges CG = (Node, Edge): Among them, α i is node n i The eigenvector of ij It is edge ij The characteristic vector of i (0) is the initial embedding of the ith node, e ij is the initial embedding of the edge between the i-th and j-th nodes; MLP node Represents a neural network structure. The input of the structure is the feature vector of the node, and the output is the encoding vector of the node. Node represents the node set in the code graph. Each node contains the smart contract statement information of the node. Edge represents the edge set in the code graph. Each edge represents the control relationship and data relationship between two nodes. (2) Update the edge vectors, node vectors, and graph vectors in the graph matching network The attention mechanism is introduced into the propagation layer in the graph matching network to interact information between the two code graphs. Given two code graphs CG1 (Node1, Edge1) and CG2 (Node2, Edge2), at each iteration t, the propagation layer formula is: Among them, η i (t) and η j (t) are the node hidden vector sets of code graph CG1 and code graph CG2 respectively; f m is a message function, from node n i The neighborhood collects messages; f c Used for cross-graph information calculation; function f u Acts as a node update mechanism, integrating these messages with the final hidden state of the node embedding; η i (t+1) Represents the node hidden vector set at the t+1th iteration; Using the cross-graph attention mechanism, the attention between node i in code graph CG1 and any node in code graph CG2 is calculated, and the formula is: Among them, s η is the vector space similarity measure, a j→i is the attention weight, ∑ j v j→i is the node hidden vector set η of the code graph CG1 i (t) and the nearest neighbor η in the code graph CG2 j (t) The difference between represents any node in the code graph CG2 at time t, j' represents the sequence number of the node in the code graph CG2; After T rounds of updates, the information of all nodes in the code graph CG1 and the code graph CG2 is aggregated to generate a vector representing the global graph structure information: Among them, f a is a graph aggregation function; represents the set of hidden state vectors of all nodes in the code graph CG1, represents the set of hidden state vectors of all nodes in the code graph CG2, represents the hidden state vector of the i-th node in the code graph CG1 after T rounds of updates, represents the hidden state vector of the jth node in the code graph CG2 after T rounds of updates, Node1 represents the node set of the code graph CG1, and Node2 represents the node set of the code graph CG2; (3) Calculate the similarity of graph pairs in the aggregation layer to detect whether there are loopholes in the smart contract. The similarity calculation formula is: Among them, s is the similarity coefficient, s∈[-1,1], f s yes and The cosine similarity between them, the closer s is to -1, the less similar the two code graphs are; the closer s is to 1, the more similar the two code graphs are; by comparing the similarity coefficient with the preset threshold, if the similarity coefficient exceeds the threshold, it is determined that the contract has a vulnerability; otherwise, it continues to form a new graph structure data pair with other contracts in the training set and performs similarity calculations; when the similarity coefficients of all data pairs do not exceed the threshold, it is confirmed that the contract has no vulnerabilities.

2. A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network as claimed in claim 1, characterized in that: The specific implementation steps for extracting the grammatical features of the code in S2 are: S2.1.1: Use the Solidity static analysis tool Slither to generate a control flow graph. Each node in the control flow graph represents a statement, and each edge represents the control flow between statements. S2.1.2: Based on the control flow graph, extract the data flow between statements through the definition and use of each variable; S2.1.3: Use the Solidity syntax analysis tool solc-typed-ast to extract the abstract syntax tree of each statement to reflect the grammatical features of the code.

3. A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network as claimed in claim 1, characterized in that: The specific implementation steps for constructing the code graph in S2 are: S2.2.1: Introduce two types of virtual nodes: "v_fun" and "v_loop", which are used to connect nodes of different ranges in the graph. Virtual nodes have no content; S2.2.2: Use the abstract syntax tree of each statement to replace the content of the corresponding node in the control flow graph to preserve the tree structure of the grammatical features; S2.2.3: Merge the type of each statement into the corresponding node in the code graph, complete the merging of the three code information, and form a code graph covering a wider range of features.

4. A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network as claimed in claim 1, characterized in that: The specific implementation steps of S3 are: S3.1: Get the set of variables and edges based on the code graph Where Var = {v1, v2, ..., v k } is a set of variables, v1,v2,...,v k Represents the variables in the code graph, Edge={e1,e2,...,e l } is a directed edge set, e1,e2,...,e l Represents directed edges in the code graph; S3.2: Concatenate the variable sets in the smart contract source code and the code graph into a sequence X, X = {[CLS], SC, [SEP], Var}, where [CLS] is a special symbol in front of the set of variables and edges, and [SEP] is a special symbol used to separate the smart contract source code SC and the variable set Var; S3.3: Convert sequence X into input vector H 0 ; S3.4: For the input vector H 0 Use 12 Transformer layers to generate the context representation H n ; S3.5: Pre-training based on GraphCodeBERT.

5. A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network as claimed in claim 4, characterized in that: In S3.4, the specific process of generating context representation is: In the input vector H 0 12 Transformer layers are used to generate the context representation H n =transformer n (H n-1 ), n∈[1,N], the structure of each Transformer layer is the same, and the input H of the nth layer n-1 Generate vector G using multi-head self-attention operation n , whose expression is: G n =LN(MultiAttn(H n-1 )+H n-1 ) Among them, MultiAttn is a multi-head self-attention mechanism, and LN represents the layer normalization operation; Vector G n After the feedforward layer, the output vector H n , whose expression is: H n =LN(FFN(G n ) + G n ) Among them, FFN is a two-layer feedforward network, and LN represents the layer normalization operation; Use the graph to guide the mask attention matrix M to filter irrelevant information. The matrix form is: Among them, M ij represents the graph-guided mask attention matrix with rows and columns ij, Represents node var i Query, Is the node var i The key of Edge represents the edge set in the code graph, and Edge' is a set used to represent the relationship between the smart contract source code SC and the data flow nodes.

6. A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network as claimed in claim 4, characterized in that: In S3.5, pre-training based on GraphCodeBERT specifically includes three pre-training tasks: Task 1, masked language modeling, is used to learn representations from source code; Task 2, data stream edge prediction, is used to learn representation edges from data streams; Task 3, variable alignment across source code and data streams, is used to align representations between source code and data streams, and predict the recognition position of variables.

7. A smart contract vulnerability detection method based on code graph fusion analysis and graph matching network as claimed in claim 3, characterized in that: The specific implementation steps of S4 are: S4.1: Use the pre-trained GraphCodeBerT model to extract the embedding representation of each node, which contains the contextual representation information and graph structure information of the smart contract source code; S4.2: Use the Skip-gram model to convert node annotations and edge annotations in the code graph into dense vector representations.

8. The method for detecting smart contract vulnerabilities based on code graph fusion analysis and graph matching network as claimed in claim 5, characterized in that: S4.2 includes: Construct the corpus of the Skip-gram model with all node texts in the abstract syntax tree; Perform one-hot encoding on the node text to generate a sparse vector; A multi-classifier based on Hierarchical Softmax is used to train the Skip-gram model to build a vector mapping table for all sentence texts.

9. The method for detecting smart contract vulnerabilities based on code graph fusion analysis and graph matching network as claimed in claim 1, characterized in that: The specific implementation steps of S5 include: S5.1, randomly combine the secure contract source code and the vulnerable contract source code in the smart contract source code dataset into graph pairs to obtain contract pairs; S5.2, use the contract pairs to train the cross-graph attention mechanism GMN, and combine it with the graph matching network to detect the target contract source code to achieve specific vulnerability detection of smart contract source code.

10. A smart contract vulnerability detection device based on code graph fusion analysis and graph matching network, characterized in that: include: Processor and storage device; the processor loads and executes instructions and data in the storage device to implement a smart contract vulnerability detection method based on code graph fusion analysis and graph matching network.

Images