Non-homogeneous token smart contract permission control vulnerability detection method and system based on multi-modal learning

Abstract

The invention relates to a non-homogeneous token smart contract permission control vulnerability detection method and system based on multi-modal learning. The method comprises the following steps: acquiring a non-homogenized token smart contract source code and compiling the source code into a byte code; constructing a control flow chart of each contract function based on the byte code, and extracting a multi-modal control flow feature; performing feature fusion, reconstruction and enhancement processing on the multi-modal control flow features to obtain contract function features; generating an audit report by using a static analysis detection framework, screening out defect features and storing the defect features in a database; and calculating the similarity between the contract function feature and the defect feature by using a mixed similarity calculation method to obtain an intelligent contract permission control vulnerability detection result. The permission control vulnerability in the non-homogenized token smart contract can be effectively detected, and the method can be applied to the development and deployment stages of the smart contract to help developers to realize safer smart contracts.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular, to a method and system for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multi-modal learning. Background Art

[0002] Non-fungible tokens are digital certificates stored on a blockchain, and each token can prove the ownership of a unique digital asset. A non-fungible token contract is a type of smart contract. A smart contract is a computer protocol running on a blockchain, usually written in a Turing-complete programming language, and can also automatically execute specific operations such as transferring assets or recording information when predetermined conditions are met. However, due to the transparency and immutability of smart contracts and other characteristics, any code deployed on the blockchain can be easily reviewed and cannot be repaired. Once a vulnerability in the contract program is exploited, it may lead to significant financial losses. In the prior art, the security checks of smart contracts combine various methods such as static analysis, fuzz testing, symbolic execution, formal verification, and deep learning. However, these methods still pose many challenges in dealing with vulnerabilities in non-fungible token contracts. For example, they cannot cover diverse vulnerability types, have low detection efficiency, and single feature extraction.

[0003] In traditional tools for dealing with vulnerabilities in non-fungible token contracts, detection usually relies on predefined defect patterns, which limits the ability to detect unknown defects, and has poor applicability and scalability; a large amount of computing resources are consumed when detecting vulnerabilities, which limits the use scenarios of the tool for large-scale contract security checks; and some tools only extract single-modal contract function features for analysis, ignoring the potential of multi-modal feature fusion. Therefore, traditional methods for detecting vulnerabilities in the permission control of non-fungible token smart contracts often have problems of poor generality and low detection efficiency. Summary of the Invention

[0004] Based on this, in order to solve the above technical problems, a method and system for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multi-modal learning are provided, which can effectively detect vulnerabilities in the permission control of non-fungible token smart contracts, can be applied to the development and deployment stages of smart contracts, and help developers implement more secure smart contracts.

[0005] A method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multi-modal learning, the method comprising:

[0006] Obtain the source code of a non-fungible token smart contract and compile it into bytecode;

[0007] Construct a control flow graph for each contract function based on the bytecode, and extract multi-modal control flow features from each of the control flow graphs; the control flow features include sequence features and graph features;

[0008] Fuse the multi-modal control flow features to obtain intermediate features after fusion, and perform reconstruction and enhancement processing on the intermediate features to obtain contract function features;

[0009] Input the non-fungible token contract into the static analysis detection framework to generate an audit report, screen out defect features according to the audit report and store them in the feature vector database;

[0010] Use a hybrid similarity calculation method to calculate the similarity between the contract function features and each defect feature in the feature vector database to obtain the intelligent contract permission control vulnerability detection result.

[0011] In one embodiment, extracting multi-modal control flow features from each of the control flow graphs includes:

[0012] Perform a depth-first traversal on the control flow graph to obtain instruction sequences on each execution path of the same contract function;

[0013] Input the instruction sequence into a neural network language model, learn semantic relationships through the neural network language model, and convert the instruction sequence into a feature vector;

[0014] Capture the relationships between the elements in the feature vector based on the variant in the neural network language model, and extract the context representation to obtain sequence features.

[0015] In one embodiment, extracting multi-modal control flow features from each of the control flow graphs includes:

[0016] Map each instruction in the control flow graph to a fine-grained node, use the instruction feature as the node feature, the instruction attribute as the label of the node, and store the instruction feature and the instruction attribute in the form of a tuple;

[0017] Number each graph node according to the order in which the node features are stored, and determine the directed edges based on the control flow graph structure and the numbering result to obtain directed edge features;

[0018] Obtain graph features according to the node features and the directed edge features.

[0019] In one embodiment, fusing the multi-modal control flow features to obtain intermediate features after fusion includes:

[0020] Perform a depth - first traversal on the control flow diagram to identify each execution path in the control flow diagram;

[0021] Determine the node information corresponding to the same node located in different execution paths, and assign weights to the features corresponding to the same node in different execution paths according to the node information;

[0022] Normalize the weights through the Softmax function, and perform weighted combination on each feature to obtain the fused intermediate features.

[0023] In one embodiment, perform reconstruction and enhancement processing on the intermediate features to obtain contract function features, including:

[0024] Extract the fused intermediate features in each node, and assign the intermediate features to the tuples corresponding to the graph nodes in the graph features to complete feature reconstruction;

[0025] Input the reconstructed features into the graph representation learning model, and capture the graph structure and node features by learning the low - dimensional representation of the graph data through the graph representation learning model to complete feature enhancement;

[0026] Perform an attention pooling operation on the enhanced features to obtain contract function features.

[0027] In one embodiment, input the non - fungible token contract into the static analysis detection framework to generate an audit report, including:

[0028] Use the static analysis detection tool as the vulnerability detection framework, and write a detector for non - fungible token permission control vulnerabilities based on the vulnerability detection framework as the static analysis detection framework;

[0029] Input the non - fungible token contract into the static analysis detection framework, detect the vulnerability function information, and generate an audit report according to the vulnerability function information.

[0030] In one embodiment, screen out the defect features according to the audit report and store them in the feature vector database, including:

[0031] Mark the vulnerability types corresponding to the vulnerability functions in the audit report;

[0032] Screen out the defect features according to the vulnerability types and store them in the feature vector database.

[0033] In one embodiment, use a hybrid similarity calculation method to calculate the similarity between the contract function features and each defect feature in the feature vector database to obtain the intelligent contract permission control vulnerability detection result, including:

[0034] Calculate the similarity between the contract function features corresponding to each node in the control flow graph of the contract function calculated by the hybrid similarity calculation method and each defect feature in the defect feature database;

[0035] Extract the target similarity between all contract function features and defect features in the contract function;

[0036] When the target similarity is within the similarity threshold range, it indicates that there is a smart contract permission control vulnerability, and the smart contract permission control vulnerability detection result is obtained.

[0037] A non-fungible token smart contract permission control vulnerability detection system based on multimodal learning, the system includes:

[0038] A preprocessing module for obtaining the source code of the non-fungible token smart contract and compiling it into bytecode;

[0039] A feature extraction module for constructing a control flow graph of each contract function based on the bytecode, and extracting multimodal control flow features from each of the control flow graphs; the control flow features include sequence features and graph features;

[0040] A feature fusion and enhancement module for fusing the multimodal control flow features to obtain intermediate features after fusion, and performing reconstruction and enhancement processing on the intermediate features to obtain contract function features;

[0041] A defect marking module for inputting the non-fungible token contract into a static analysis detection framework to generate an audit report, screening out defect features according to the audit report and storing them in a defect feature database;

[0042] A vulnerability detection module for calculating the similarity between the contract function features and each defect feature in the defect feature database using a hybrid similarity calculation method to obtain a smart contract permission control vulnerability detection result.

[0043] In one embodiment, the feature extraction module is further configured to: perform a depth-first traversal on the control flow graph to obtain instruction sequences of the same contract function on each execution path; input the instruction sequences into a neural network language model, learn semantic relationships through the neural network language model, and convert the instruction sequences into feature vectors; capture the relationships between elements in the feature vectors based on variants in the neural network language model, and extract context representations to obtain sequence features.

[0044] The above non-fungible token smart contract permission control vulnerability detection method and system based on multimodal learning compile the source code of the non-fungible token smart contract into bytecode, construct the control flow of each contract function, extract multimodal features for feature fusion enhancement processing, use a static analysis detection framework to generate an audit report to screen out defective features, use a hybrid similarity calculation method to calculate the similarity between features, apply multimodal learning and static analysis detection technologies to the detection of non-fungible token contract permission control vulnerabilities, effectively solve the limitations of existing technologies in smart contract feature extraction, and can effectively detect permission control vulnerabilities in non-fungible token smart contracts. It can be applied to the development and deployment stages of smart contracts to help developers implement more secure smart contracts. Description of the Drawings

[0045] Figure 1 It is an application environment diagram of the non-fungible token smart contract permission control vulnerability detection method based on multimodal learning in an embodiment;

[0046] Figure 2 It is a flowchart of the non-fungible token smart contract permission control vulnerability detection method based on multimodal learning in an embodiment;

[0047] Figure 3 It is a schematic diagram of the control flow chart in an embodiment;

[0048] Figure 4 It is a schematic diagram of sequence feature processing in an embodiment;

[0049] Figure 5 It is a schematic diagram of feature fusion in an embodiment;

[0050] Figure 6 It is a structural block diagram of the non-fungible token smart contract permission control vulnerability detection system based on multimodal learning in an embodiment;

[0051] Figure 7 It is an internal structure diagram of a computer device in an embodiment. Detailed Embodiments

[0052] In order to make the objectives, technical solutions and advantages of the present application clearer and more understandable, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The non-fungible token smart contract permission control vulnerability detection method based on multimodal learning provided by the embodiments of the present application can be applied to an application environment as Figure 1 shown. As Figure 1As shown, the application environment includes a computer device 110. The computer device 110 can obtain the source code of the non-fungible token smart contract and compile it into bytecode; the computer device 110 can construct a control flow graph for each contract function based on the bytecode and extract multi-modal control flow features from each control flow graph; the control flow features include sequence features and graph features; the computer device 110 can fuse the multi-modal control flow features to obtain intermediate features after fusion, and perform reconstruction and enhancement processing on the intermediate features to obtain contract function features; the computer device 110 can input the non-fungible token contract into a static analysis detection framework to generate an audit report, screen out defect features according to the audit report and store them in a feature vector database; the computer device 110 can use a hybrid similarity calculation method to calculate the similarity between the contract function features and each defect feature in the feature vector database to obtain the detection result of the smart contract permission control vulnerability. Among them, the computer device 110 can be, but is not limited to, various personal computers, laptop computers, smartphones, robots, tablet computers and other devices.

[0054] In one embodiment, as Figure 2 shown, a method for detecting non-fungible token smart contract permission control vulnerabilities based on multi-modal learning is provided, including the following steps:

[0055] Step 202, obtain the source code of the non-fungible token smart contract and compile it into bytecode.

[0056] During the smart contract development stage or before deployment, the computer device can obtain the source code of the non-fungible token smart contract, and then use the crytic-compile tool to compile the source code of the non-fungible token smart contract to obtain bytecode. Bytecode is the basic instruction for the smart contract to execute operations, contains a low-level representation of the contract logic, and is also the necessary input data for constructing the control flow graph.

[0057] Step 204, construct a control flow graph for each contract function based on the bytecode, and extract multi-modal control flow features from each control flow graph; the control flow features include sequence features and graph features.

[0058] Among them, the sequence feature captures the sequential relationship between nodes, while the graph feature reflects the overall structural information of the control flow graph. By combining these two features, the static execution logic of the program can be represented more comprehensively.

[0059] As Figure 3As shown, all possible instructions during program execution can be seen from the control flow graph. The starting position of program execution can be inferred from the number of incoming edges of the graph, and the complexity of the program can be inferred by calculating the number of nodes and edges in the graph. Each node in the control flow graph represents a basic block of the program, that is, a set of sequentially executed instructions without branches; the edges of the graph are directed edges representing the transfer of control flow, such as conditional jumps, loops, or function calls, etc. The control flow graph can clearly display the logical structures such as conditional branches, loops, and function calls in the program. After obtaining the bytecode, the computer device can use the evm-cfg-builder tool to further construct the control flow graph of each contract function, and extract two-modal control flow features from each control flow graph, including sequence features and graph features. Among them, the sequence feature is the opcode sequence feature obtained by depth-first traversing the nodes of the control flow graph; the graph feature includes the features of each node and its edges in the control flow graph.

[0060] The evm-cfg-builder tool analyzes the bytecode to identify special instructions such as jumps and loops, thereby generating the control flow graph of the program. In this graph, each node represents a continuous sequence of instructions, and each edge represents the branches and jumps during the instruction execution, which not only provides a visual representation of the program execution path but also reveals the dynamic behavior characteristics of the contract during runtime.

[0061] Specifically, in one embodiment, a method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multi-modal learning may further include the process of extracting sequence features. The specific process includes: performing a depth-first traversal on the control flow graph to obtain the instruction sequences on each execution path of the same contract function; inputting the instruction sequences into a neural network language model, learning semantic relationships through the neural network language model, and converting the instruction sequences into feature vectors; based on the variants in the neural network language model to capture the relationships between the elements in the feature vectors, extracting the context representation to obtain the sequence features.

[0062] The computer device can use the Word2Vec model to convert the opcode sequence into a word feature sequence, and use the Performer model to extract the context representation of the word feature sequence to obtain the sequence features. In this embodiment, the execution logic of the code can be represented by the instructions in the control flow graph nodes. Therefore, the instruction sequences can be extracted to represent the sequence features of the code. The sequence features are crucial for accurately representing the operations during program execution. The instructions of the smart contract are composed of opcodes representing different operations. During the execution of the contract program, according to the different logical structures such as conditional branches, loops, and function calls in the program, the instruction sequences executed under specific conditions will also be different.

[0063] Specifically, the process of extracting sequence features is as Figure 4As shown, it may include: a control flow diagram of a depth-first traversal function to obtain instruction sequences of the same function on multiple execution paths; the Word2Vec model is a neural network language model that can learn semantic relationships between words and convert text data into vector format. In this embodiment, the Word2Vec model can be used to convert the obtained instruction text into feature vectors of each instruction; the Performer model is a variant of the neural network model Transformer, used to capture the relationships between each element in the sequence and other elements. In order to obtain a richer context feature representation, in this embodiment, the Performer model can be used to extract the context representation of the feature vectors to obtain sequence features.

[0064] In another embodiment, a method for detecting vulnerabilities in the permissions control of non-fungible token smart contracts based on multi-modal learning may further include a process of extracting graph features. The specific process includes: mapping each instruction in the control flow diagram to fine-grained nodes, using the instruction features as node features and the instruction attributes as labels of the nodes, and storing the instruction features and instruction attributes in the form of a tuple; numbering each graph node according to the storage order of each node feature, and determining directed edges based on the control flow graph structure and the numbering result to obtain directed edge features; obtaining graph features according to the node features and directed edge features.

[0065] The graph features can be composed of node features and directed edge features. In this embodiment, first, the features and attributes of each instruction in each node can be stored in the form of a tuple (N v , N c , N f , N id ), and the attributes of the instructions are used as labels for the instruction features. Among them, N v represents the sequence feature of each instruction; N c and N f respectively represent the contract name and function name where the instruction is located; N id represents the unique id of the node in the flow chart. This attribute describes the position mapping relationship of the instructions in the graph node in the entire contract, facilitating subsequent operations such as feature fusion, marking, and comparison. Then, each node can be numbered starting from 0 according to the storage order of each graph node, and each edge is represented as a list [E s , E e , where E s and E e respectively represent the numbers of its start and end nodes, used to record the execution path of the instruction.

[0066] Step 206: Perform feature fusion on the multi-modal control flow features to obtain the fused intermediate features, and perform reconstruction and enhancement processing on the intermediate features to obtain the contract function features.

[0067] The computer device can fuse the multi-modal control flow features into an intermediate feature representation and enhance the graph features of the intermediate representation.

[0068] In one embodiment, a method for detecting non-fungible token smart contract permission control vulnerabilities based on multi-modal learning may further include a process of feature fusion. The specific process includes: performing a depth-first traversal of the control flow graph to identify each execution path in the control flow graph; determining the node information corresponding to the same node located in different execution paths, and assigning weights to the features corresponding to the same node in different execution paths according to the node information; normalizing the weights through the Softmax function, and performing weighted combination on each feature to obtain the fused intermediate features.

[0069] As Figure 5 shown, after traversing the control flow graph through the depth-first traversal algorithm, the computer device can identify multiple potential execution paths in the graph. To facilitate subsequent feature processing, the features of the same node located in different paths can be integrated into a single representation. Specifically, the computer device can assign weights to the features of the same node in different paths according to the context information of the node in each path (such as the importance of the path or the position of the node in the path), and normalize the weights through the Softmax function, and finally perform weighted combination on the features to obtain the fused intermediate features.

[0070] That is, in this embodiment, the computer device can assign weights according to the sequence positions of the features for multiple different executable sequences corresponding to the same function, and fuse the sequence features of the same node in multiple paths into a single node feature.

[0071] In one embodiment, a method for detecting non-fungible token smart contract permission control vulnerabilities based on multi-modal learning may further include a process of feature reconstruction and enhancement. The specific process includes: extracting the fused intermediate features in each node, and assigning the intermediate features to the tuples corresponding to the graph nodes in the graph feature to complete feature reconstruction; inputting the reconstructed features into the graph representation learning model, and capturing the graph structure and node features by learning the low-dimensional representation of the graph data through the graph representation learning model to complete feature enhancement; performing an attention pooling operation on the enhanced features to obtain the contract function features.

[0072] Specifically, the computer device can reorganize the fused node features according to the control flow graph structure to obtain an intermediate feature representation. As Figure 5As shown, the fused node features will be reconstructed according to the structure of the graph features of the control flow diagram. By extracting the fused features of each instruction in each node and assigning the feature to the tuple corresponding to the graph node in the graph features, an intermediate feature representation of the control flow diagram can be constructed. Among them, the node features of the reconstructed graph still mainly represent the sequence context. To enable the nodes to better understand the structure of the entire graph, in this embodiment, a graph representation learning model called FastGAT is used. Graph representation learning is a machine learning technique that aims to capture the graph structure and node features by learning the low-dimensional representation of graph data, enabling each node to perceive the entire graph, not limited to its surrounding neighbor nodes. In this way, the features of the nodes not only contain local context information but also can perceive the structure of the entire graph.

[0073] Both the feature extraction and fusion stages process the single-instruction features. To facilitate subsequent feature comparison, attention pooling operations can be performed on the instructions in the same flowchart node according to the labels of the features. Pooling is an important dimensionality reduction operation in deep learning. By extracting the main features of the local area, it reduces the data size and retains key information, and will pool the features in the same node into a single feature for easy storage and comparison.

[0074] Step 208, input the non-fungible token contract into the static analysis detection framework to generate an audit report, screen out the defect features according to the audit report, and store them in the feature vector database.

[0075] The computer device can mark the features corresponding to the defective functions according to the detection results of the custom detector and store the defective function features in the feature vector database.

[0076] In one embodiment, a method for detecting non-fungible token smart contract permission control vulnerabilities based on multimodal learning may further include the process of static analysis detection. The specific process includes: using a static analysis detection tool as the vulnerability detection framework, and writing a detector for non-fungible token permission control vulnerabilities based on the vulnerability detection framework as the static analysis detection framework; inputting the non-fungible token contract into the static analysis detection framework to detect the vulnerability function information and generate an audit report according to the vulnerability function information.

[0077] The computer device can use a static analysis detection tool Slither as the vulnerability detection framework and write a detector for non-fungible token permission control vulnerabilities on this basis for analysis to generate an audit report.

[0078] In one embodiment, a method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning may further include a process of screening out defect features. The specific process includes: marking the vulnerability types corresponding to the vulnerable functions in the audit report; screening out the defect features according to the vulnerability types and storing them in the feature vector database.

[0079] Among them, permission control vulnerabilities can be divided into three categories, namely: weak permission verification: the contract fails to meet the permission requirements stipulated in the token standard or does not follow the development practice requirements not explicitly mentioned in the standard; loose permission management: the contract contains permission settings or revocation operations that may cause unexpected state changes; excessive weight re-entry: the contract allows unauthorized persons to access sensitive functions or operations without proper authorization checks.

[0080] In this embodiment, a contract that meets any one of the above three conditions is called a contract with a permission control vulnerability.

[0081] The audit report contains information such as the name, location, vulnerability type, and inheritance relationship of the vulnerable functions. By analyzing the audit report results, the vulnerability type corresponding to the function can be marked, and the defective code features can be screened out according to the function information with vulnerabilities.

[0082] In this embodiment, the vector database tool Hnswlib can be used to store and manage the defective code features. A vector database is a database system specifically designed to store and retrieve high-dimensional vector data, supporting fast similarity search and capable of finding the most similar vectors among a large number of vectors.

[0083] Step 210, use the hybrid similarity calculation method to calculate the similarity between the contract function features and each defective feature in the feature vector database to obtain the detection result of the permission control vulnerability of the smart contract.

[0084] The computer device can use the similarity detection method to compare the similarity between the defective function features and the contract function features to determine whether the contract has vulnerabilities.

[0085] In one embodiment, a method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning may further include a process of calculating similarity. The specific process includes: using the hybrid similarity calculation method to calculate the similarity between the contract function features corresponding to each node in the control flow graph of the contract function and each defective feature in the feature vector database; extracting the target similarity between all contract function features and defective features in the contract function; when the target similarity is within the similarity threshold range, it indicates that there is a permission control vulnerability in the smart contract, and the detection result of the permission control vulnerability of the smart contract is obtained.

[0086] In a vector database of features, the similarity between the instruction features of each node in the control flow graphs corresponding to two functions can be measured by using a hybrid similarity calculation method. If the similarity between all the features of one function and the features of another function meets a certain threshold and the labels of the features are the same, the two functions are considered similar.

[0087] Specifically, the hybrid similarity calculation method used in this embodiment can be a hybrid similarity calculation method based on cosine similarity and Jensen-Shannon divergence.

[0088] When detecting new contract vulnerabilities, repeat steps such as preprocessing, feature extraction, and feature fusion to extract contract function features. Then, compare the embedded function features with the features stored in the database. According to the comparison results, determine whether the function has a certain vulnerability and output a detection result report to the user interface.

[0089] In a method for detecting non-fungible token smart contract permission control vulnerabilities based on multimodal learning provided by this application, first, compile the source code of the non-fungible token smart contract to obtain bytecode, thereby constructing the control flow graph of each contract function; then, extract two-modal control flow features from each control flow graph, including sequence features and graph features; after completing these operations, use an algorithm to fuse the features of the two modalities into an intermediate feature representation and enhance the graph features of the intermediate representation; then, according to the detection results of a custom detector, mark the features corresponding to the defective functions and store the defective function features in the feature database; finally, use a similarity detection method to compare the similarity between the defective function features and the contract function features to determine whether the contract has vulnerabilities. By learning and understanding the complex patterns and features of smart contract functions, as well as learning the sequence features and graph features of graph-structured data, the permission control vulnerabilities of non-fungible token smart contracts can be accurately analyzed. It can effectively detect and identify permission control vulnerabilities in smart contracts; it can be applied to the development and deployment stages of smart contracts to help developers discover and fix potential security problems in advance, thereby realizing more secure smart contracts.

[0090] It should be understood that although the steps in the above flowcharts are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above flowcharts may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least a part of other steps or sub-steps or stages of other steps.

[0091] In one embodiment, as Figure 6 shown, a non-fungible token smart contract permission control vulnerability detection system based on multimodal learning is provided, including: a preprocessing module 610, a feature extraction module 620, a feature fusion and enhancement module 630, a defect marking module 640, and a vulnerability detection module 650, where:

[0092] The preprocessing module 610 is used to obtain the source code of the non-fungible token smart contract and compile it into bytecode;

[0093] The feature extraction module 620 is used to construct a control flow graph for each contract function based on the bytecode, and extract multimodal control flow features from each control flow graph; the control flow features include sequence features and graph features;

[0094] The feature fusion and enhancement module 630 is used to fuse the multimodal control flow features to obtain intermediate features after fusion, and perform reconstruction and enhancement processing on the intermediate features to obtain contract function features;

[0095] The defect marking module 640 is used to input the non-fungible token contract into a static analysis detection framework to generate an audit report, screen out defect features according to the audit report, and store them in a feature vector database;

[0096] The vulnerability detection module 650 is used to calculate the similarity between the contract function features and each defect feature in the feature vector database using a hybrid similarity calculation method to obtain the non-fungible token smart contract permission control vulnerability detection result.

[0097] In one embodiment, the feature extraction module 620 is further used to: perform a depth-first traversal on the control flow graph to obtain the instruction sequence of the same contract function on each execution path; input the instruction sequence into a neural network language model, learn semantic relationships through the neural network language model, and convert the instruction sequence into a feature vector; based on the variant in the neural network language model, capture the relationships between the elements in the feature vector, and extract context representations to obtain sequence features.

[0098] In one embodiment, the feature extraction module 620 is further used to map each instruction in the control flow graph to a fine-grained node, use the instruction feature as the node feature, the instruction attribute as the label of the node, and store the instruction feature and the instruction attribute in the form of a tuple; number each graph node according to the order in which the node features are stored, and determine directed edges based on the control flow graph structure and the numbering result to obtain directed edge features; obtain graph features according to the node features and the directed edge features.

[0099] In one embodiment, the feature fusion enhancement module 630 is further configured to perform a depth-first traversal of the control flow diagram to identify each execution path in the control flow diagram; determine the node information corresponding to the same node located in different execution paths, and assign weights to the features corresponding to the same node in different execution paths according to the node information; perform normalization processing on the weights through the Softmax function, and perform weighted combination on each feature to obtain the fused intermediate feature.

[0100] In one embodiment, the feature fusion enhancement module 630 is further configured to extract the fused intermediate features in each node, and assign the intermediate features to the tuples corresponding to the graph nodes in the graph feature to complete feature reconstruction; input the reconstructed features into the graph representation learning model, and capture the graph structure and node features by learning the low-dimensional representation of the graph data through the graph representation learning model to complete feature enhancement; perform an attention pooling operation on the enhanced features to obtain the contract function features.

[0101] In one embodiment, the defect marking module 640 is further configured to use a static analysis detection tool as a vulnerability detection framework, and write a detector for non-fungible token permission control vulnerabilities based on the vulnerability detection framework as a static analysis detection framework; input the non-fungible token contract into the static analysis detection framework, detect the vulnerability function information, and generate an audit report according to the vulnerability function information.

[0102] In one embodiment, the defect marking module 640 is further configured to mark the vulnerability types corresponding to the vulnerability functions in the audit report; filter out the defect features according to the vulnerability types and store them in the feature vector database.

[0103] In one embodiment, the vulnerability detection module 650 is further configured to calculate the similarity between the contract function features corresponding to each node in the control flow diagram of the contract function and each defect feature in the feature vector database by using a hybrid similarity calculation method; extract the target similarity between all the contract function features and the defect features in the contract function; when the target similarity is within the similarity threshold range, it indicates that there is a smart contract permission control vulnerability, and obtain the smart contract permission control vulnerability detection result.

[0104] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as Figure 7As shown. The computer device includes a processor, a memory, a network interface, a display screen, and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements a method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or a button, trackball, or touchpad provided on the outer shell of the computer device, or an external keyboard, touchpad, or mouse, etc.

[0105] Those skilled in the art can understand that Figure 7 the structure shown in

[0106] is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0107] In one embodiment, a computer device is provided, including a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, it implements the steps of a method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning.

[0108] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memories. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0109] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0110] The above-described embodiments merely represent several implementation manners of the present application. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning, characterized in that, The method includes: Obtain the source code of the non-fungible token smart contract and compile it into bytecode; Construct a control flow graph for each contract function based on the bytecode, and extract multi-modal control flow features from each of the control flow graphs; the control flow features include sequence features and graph features; Fuse the multi-modal control flow features to obtain intermediate features after fusion, and perform reconstruction and enhancement processing on the intermediate features to obtain contract function features; Input the non-fungible token contract into a static analysis detection framework to generate an audit report, screen out defect features according to the audit report, and store them in a feature vector database; Use a hybrid similarity calculation method to calculate the similarity between the contract function features and each defect feature in the feature vector database to obtain the detection result of the smart contract permission control vulnerability.

2. The method for detecting non-fungible token smart contract permission control vulnerabilities based on multimodal learning according to claim 1, wherein, Extract multi-modal control flow features from each of the control flow graphs, including: Perform a depth-first traversal of the control flow graph to obtain the instruction sequences of the same contract function on each execution path; Input the instruction sequences into a neural network language model, learn semantic relationships through the neural network language model, and convert the instruction sequences into feature vectors; Capture the relationships between the elements in the feature vectors based on the variants in the neural network language model, and extract context representations to obtain sequence features.

3. The method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning according to claim 1, wherein, Extract multi-modal control flow features from each of the control flow graphs, including: Map each instruction in the control flow graph to a fine-grained node, use the instruction features as node features, and the instruction attributes as the labels of the nodes, and store the instruction features and instruction attributes in the form of tuples; Number each graph node according to the order in which the node features are stored, and determine directed edges based on the control flow graph structure and the numbering results to obtain directed edge features; Obtain graph features according to the node features and directed edge features.

4. The method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multi-modal learning according to claim 1, wherein, Fuse the multi-modal control flow features to obtain intermediate features after fusion, including: Perform a depth-first traversal of the control flow graph to identify each execution path in the control flow graph; Determine the node information corresponding to the same node located in different execution paths, and assign weights to the features corresponding to the same node in different execution paths according to the node information; Normalize the weights through the Softmax function, and perform weighted combination on each feature to obtain the intermediate features after fusion.

5. The method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning according to claim 1, characterized in that, Perform reconstruction and enhancement processing on the intermediate features to obtain contract function features, including: Extract the intermediate features after fusion in each node, and assign the intermediate features to the tuples corresponding to the graph nodes in the graph features to complete feature reconstruction; Input the reconstructed features into a graph representation learning model, and learn the low-dimensional representation of the graph data through the graph representation learning model to capture the graph structure and node features to complete feature enhancement; Perform an attention pooling operation on the enhanced features to obtain contract function features.

6. The method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multimodal learning according to claim 1, wherein Input the non-fungible token contract into a static analysis detection framework to generate an audit report, including: Use a static analysis detection tool as a vulnerability detection framework, and write a detector for non-fungible token permission control vulnerabilities based on the vulnerability detection framework, as the static analysis detection framework; Input the non-fungible token contract into the static analysis detection framework, detect the vulnerability function information, and generate an audit report based on the vulnerability function information.

7. The method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multi-modal learning according to claim 6, wherein Screen out the defect features according to the audit report and store them in the feature vector database, including: Mark the vulnerability types corresponding to the vulnerability functions in the audit report; Screen out the defect features according to the vulnerability types and store them in the feature vector database.

8. The method for detecting vulnerabilities in the permission control of non-fungible token smart contracts based on multi-modal learning according to claim 1, wherein Use a hybrid similarity calculation method to calculate the similarity between the contract function features and each defect feature in the feature vector database, and obtain the intelligent contract permission control vulnerability detection result, including: Use a hybrid similarity calculation method to calculate the similarity between the contract function features corresponding to each node in the control flow chart of the contract function and each defect feature in the feature vector database; Extract the target similarity between all contract function features and defect features in the contract function; When the target similarity is within the similarity threshold range, it indicates that there is an intelligent contract permission control vulnerability, and the intelligent contract permission control vulnerability detection result is obtained.

9. A vulnerability detection system for permission control of non-fungible token smart contracts based on multimodal learning, characterized in that, The system includes: A preprocessing module for obtaining the source code of the non-fungible token intelligent contract and compiling it into bytecode; A feature extraction module for constructing a control flow chart for each contract function based on the bytecode, and extracting multi-modal control flow features from each control flow chart; the control flow features include sequence features and graph features; A feature fusion and enhancement module for performing feature fusion on the multi-modal control flow features to obtain intermediate features after fusion, and performing reconstruction and enhancement processing on the intermediate features to obtain contract function features; A defect marking module for inputting the non-fungible token contract into the static analysis detection framework, generating an audit report, screening out defect features according to the audit report, and storing them in the feature vector database; A vulnerability detection module for using a hybrid similarity calculation method to calculate the similarity between the contract function features and each defect feature in the feature vector database, and obtaining the intelligent contract permission control vulnerability detection result.

10. The non-fungible token smart contract permission control vulnerability detection system based on multi-modal learning according to claim 9, characterized in that, The feature extraction module is further used for: performing a depth-first traversal on the control flow chart to obtain the instruction sequence of the same contract function on each execution path; inputting the instruction sequence into a neural network language model, learning semantic relationships through the neural network language model, and converting the instruction sequence into a feature vector; capturing the relationships between the elements in the feature vector based on the variants in the neural network language model, and extracting the context representation to obtain the sequence feature.

Images