Block chain abnormal smart contract detection method and system based on multi-modal knowledge distillation

Abstract

The invention relates to the technical field of block chain abnormal behavior detection, in particular to a block chain abnormal smart contract detection method and system based on multi-modal knowledge distillation. The multi-dimensional feature data comprises smart contract source code static logic structure features, smart contract source code dynamic execution state features and smart contract transaction data transaction mode features; and inputting the multi-dimensional feature data into an intelligent contract detection model, and detecting and outputting the abnormal state of the to-be-detected block chain intelligent contract by using the intelligent contract detection model, the intelligent contract detection model performing knowledge distillation by using a teacher-student network model architecture. According to the method, the teacher contract detector is pre-trained by using the multi-source features, so that the student contract detector can still learn transaction behavior knowledge in the absence of transaction data, fraudulent behavior detection is realized in advance, and the detection performance of the abnormal contract is improved by integrating data of different modalities.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain abnormal behavior detection, and particularly relates to a method and system for detecting abnormal smart contracts in a blockchain based on multimodal knowledge distillation. Background Art

[0002] As a new distributed ledger technology, blockchain constructs an immutable data recording system by splitting data into blocks and connecting them in a chain structure. Its core value lies in realizing a decentralized trust mechanism and data exchange mode, effectively solving problems such as single point of failure, data tampering, and trust deficiency faced by traditional centralized systems. On the basis of blockchain technology, Ethereum provides a platform that supports the development of smart contracts and decentralized applications. Smart contracts are the core function of the Ethereum platform. They are self-executing protocols composed of code, written in Turing-complete languages such as Solidity, and deployed on the Ethereum public chain. Once deployed, smart contracts define specific terms and can be automatically triggered for execution when preset conditions are met, thereby ensuring that all parties can conduct trustworthy transactions without the need for a third-party intermediary. This process features transparency, immutability, and high security, bringing transformative solutions to multiple fields such as finance, supply chain management, Internet of Things, and social media.

[0003] The Ethereum platform demonstrates great value and potential, but at the same time, it has become a breeding ground for abnormal behaviors such as investment fraud. The core of abnormal behaviors such as investment fraud is to use the funds of new investors to pay early investors, creating an illusion of high returns to attract more funds to flow in. Attackers take advantage of the anonymity, decentralization of blockchain, and the automatic execution of smart contracts, making this abnormal behavior more concealed and difficult to trace. Currently, many fraud-related abnormal behaviors have emerged in the blockchain ecosystem, not only causing huge property losses to investors but also bringing great security risks to the operation of the blockchain platform. Therefore, the detection of abnormal smart contracts on the Ethereum platform is extremely urgent.

[0004] The current mainstream intelligent contract anomaly detection methods can be summarized into the following two aspects: 1) Anomaly detection based on code data, which designs matching rules with abnormal behavior patterns using expert knowledge, analyzes potential abnormal vulnerabilities through symbolic execution methods, or extracts contract semantic features such as N-gram and TF-IDF of opcode sequences to capture potential context information related to abnormal behavior in the contract. However, most of these methods currently analyze the dynamic execution state information of bytecode and ignore the attention to the static logical structure details of the source code. 2) Anomaly contract detection based on transaction data, which extracts a set of behavior patterns related to investment and dividend according to the fund allocation logic in the abnormal contract to identify abnormal contracts. However, this method has not fully paid attention to the prominent behavioral characteristics of abnormal contracts showing high profitability in the initial stage of transactions. In addition, since some contract accounts in the existing abnormal contract datasets have no transaction data, the trading behavior patterns of the contracts cannot be learned, reducing the detection performance of contract abnormal behavior. Summary of the Invention

[0005] Therefore, the present invention provides a blockchain abnormal intelligent contract detection method and system based on multi-modal knowledge distillation, which solves the problems of insufficient feature mining of contract accounts, low detection performance for abnormal contract accounts without transaction data, and inability to detect abnormal behaviors in advance in the existing solutions.

[0006] According to the design scheme provided by the present invention, on the one hand, a blockchain abnormal intelligent contract detection method based on multi-modal knowledge distillation is provided, including:

[0007] Extract multi-dimensional feature data of the cross-chain intelligent contract in the area to be detected, and the multi-dimensional feature data includes: static logical structure features of the intelligent contract source code, dynamic execution state features of the intelligent contract source code, and intelligent contract trading mode features;

[0008] Input the multi-dimensional feature data into the intelligent contract detection model, and use the intelligent contract detection model to detect and output the abnormal state of the blockchain intelligent contract to be detected. The intelligent contract detection model uses the teacher-student network model architecture for knowledge distillation. Among them, the teacher network is trained using the feature of the intelligent contract data sample, and the student network uses the intelligent contract data sample and is guided by the trained teacher network through knowledge distillation to learn the trading behavior knowledge in the case of lack of transaction data, so as to use the trained student network as the intelligent contract detection model.

[0009] As the blockchain abnormal intelligent contract detection method based on multi-modal knowledge distillation of the present invention, further, extracting the multi-dimensional feature data of the cross-chain intelligent contract in the area includes:

[0010] Construct a logical structure feature extractor for extracting static logical structure features, an execution state feature extractor for extracting dynamic execution state features, and a transaction pattern feature extractor for extracting transaction pattern features in transaction data. The logical structure feature extractor mines abnormal behavior-related paths for representing logical structure features by statically analyzing the logical structure of the smart contract and using code instrumentation. The execution state feature extractor obtains the attribute control flow graph of the smart contract through opcode slicing and obtains the compilation and running state of the smart contract by learning the behavior patterns of opcode sequences. The transaction pattern feature extractor extracts transaction pattern features containing time information by analyzing the transaction subgraph of the smart contract;

[0011] Use the logical structure feature extractor, the execution state feature extractor, and the transaction pattern feature extractor to extract multi-dimensional feature data of the blockchain smart contract to be detected.

[0012] As the blockchain abnormal smart contract detection method based on multi-modal knowledge distillation of the present invention, further, extract the static logical structure features of the smart contract source code, including:

[0013] Extract the inter-procedural control flow graph of the functions in the smart contract source code according to the function program statements and the control flow between the statements in the smart contract source code, and obtain the information flow facts, information flow functions in the smart contract source code, and the information flow functions on the edges of the control flow graph. And construct a formal representation of the smart contract source code based on the control flow graph, information flow facts, information flow functions, and information flow functions on the edges of the control flow graph;

[0014] Expand the nodes and edges in the control flow graph according to the information flow facts and path position keys of each node and the incoming and outgoing nodes corresponding to each node, and perform a breadth-first traversal on the expanded control flow graph to obtain all data flow paths from the sensitive source to the release point, where the sensitive source and the release point are set according to the behavior patterns of abnormal smart contracts;

[0015] Use a multi-level hash table to hierarchically store the classes, functions, key paths inside the functions, and instrumentation information in the smart contract source code, compile and parse the instrumented smart contract, and extract the contract logical structure features related to abnormal behaviors.

[0016] As the blockchain abnormal smart contract detection method based on multi-modal knowledge distillation of the present invention, further, extract the dynamic execution state features of the smart contract source code, including:

[0017] Compile the smart contract source code into bytecode, and parse it through a disassembler tool to obtain readable opcodes and instructions, so as to perform opcode slicing according to the control flow semantics of the opcodes to obtain a basic block sequence;

[0018] Match and retain the key opcode information representing the abnormal behavior pattern in the basic block to obtain an attribute control flow graph with opcode attributes. Use the pre-trained graph attention neural network to extract the attention coefficients between each node and its neighbor nodes in the attribute control flow graph, and obtain the local and global features in the attribute control flow graph through the normalized attention coefficients, so as to obtain the dynamic execution state features of the corresponding smart contract source code through the local and global features.

[0019] As the blockchain abnormal smart contract detection method based on multi-modal knowledge distillation of the present invention, further, extract the smart contract transaction mode features, including:

[0020] Search all external transactions of the smart contract, sort the external transactions in chronological order, and establish a transaction subgraph for each external transaction;

[0021] Use the sending address of the external transaction as the starting point, the contract address of the external transaction as the next node, and the internal transactions triggered by the external transaction as the edges, so as to add all the internal transactions triggered by the external transaction to the transaction subgraph. Process the information of each transaction subgraph to obtain a sequence of smart contract transaction subgraphs;

[0022] Use the pre-trained long short-term memory network to perform temporal processing on the sequence of smart contract transaction subgraphs to obtain the transaction mode features reflecting the early time behavior information of the smart contract. The long short-term memory network adopts an early stopping LSTM with a dual attention mechanism, and constructs a loss function for network model training through an early loss function composed of a classification prediction loss and an early reward loss and a stopping function for taking into account the decision-making timing of each time point. Among them, the dual attention mechanism heads of the early stopping LSTM include a main prediction head for converting the hidden state into transaction mode features using the softmax function and an early stopping head for converting the hidden state into a stopping probability using the sigmoid function.

[0023] As the blockchain abnormal smart contract detection method based on multi-modal knowledge distillation of the present invention, further, the smart contract detection model adopts a teacher-student network model architecture for knowledge distillation, including:

[0024] Construct a teacher network and a student network based on a convolutional neural network. The convolutional neural network includes a convolutional layer for feature extraction and a fully connected layer for detection output. The convolutional layer includes three layers, and each convolutional layer uses a convolutional kernel of a specified size. After each layer of convolution, batch normalization, ReLU activation function and max pooling operations are used for processing;

[0025] Extract the features of the static logic structure, dynamic execution state, and transaction pattern of the smart contract in the smart contract data sample using the convolutional layer in the teacher network, and use the features of the static logic structure, dynamic execution state, and transaction pattern of the smart contract as the input of the fully connected layer of the teacher network to obtain the prediction labels of the teacher network;

[0026] Extract the features of the static logic structure and dynamic execution state of the smart contract using the convolutional layer in the student network, and reconstruct the prediction features regarding the transaction behavior based on the features of the static logic structure and dynamic execution state of the smart contract extracted by the student network. Use the features of the static logic structure, dynamic execution state, and prediction features of the smart contract as the input of the fully connected layer of the student network to obtain the prediction labels of the student network;

[0027] Take the cross-entropy loss between the prediction labels of the teacher network and the student network as the soft loss, take the cross-entropy loss between the prediction labels of the student network and the true labels in the smart contract data sample as the hard loss, and use the cosine similarity to obtain the code feature loss and transaction feature loss between the student network and the teacher network, so as to construct the total loss function in the training process of the student network using the soft loss, hard loss, code feature loss, and transaction feature loss;

[0028] Use the smart contract data sample and based on the total loss function to make the network model prompt the student network to learn the transaction behavior knowledge of the teacher network in the case of lack of transaction data during the training process.

[0029] As the blockchain abnormal smart contract detection method based on multi-modal knowledge distillation of the present invention, further, the total loss function in the training process of the student network is expressed as: where α, β, γ are hyperparameters used to adjust the constraint ability of each part of the loss on the model, L soft is the soft loss, L hard is the hard loss, is the code feature loss, is the transaction feature loss, and

[0030] M is the number of feature vectors, h s,j is the concatenated vector of the output features of the j-th layer CNN in the student network, h t,j is the concatenated vector of the output features of the j-th layer CNN in the teacher network, and LSFs, ESFs, and TPFs are the identification of the logical structure feature, execution state feature, and transaction pattern feature respectively.

[0031] On the other hand, the present invention also provides a blockchain abnormal smart contract detection system based on multi-modal knowledge distillation, including: a feature extraction module and an anomaly detection module, where,

[0032] A feature extraction module for extracting multi-dimensional feature data of cross-chain smart contracts in the area to be detected, where the multi-dimensional feature data includes: static logical structure features of smart contract source code, dynamic execution status features of smart contract source code, and smart contract transaction mode features;

[0033] An anomaly detection module for inputting the multi-dimensional feature data into a smart contract detection model, and using the smart contract detection model to detect and output the abnormal state of the blockchain smart contract to be detected. The smart contract detection model uses the teacher-student network model architecture for knowledge distillation. Among them, the teacher network is trained using the feature of the smart contract data sample, and the student network uses the smart contract data sample and is guided by the trained teacher network through knowledge distillation to learn the transaction behavior knowledge in the case of lack of transaction data, so as to use the trained student network as the smart contract detection model.

[0034] Advantages of the present invention:

[0035] 1. The present invention comprehensively captures multi-dimensional information of the contract by extracting the execution status features of the contract source code, the logical structure features based on the contract bytecode, and the transaction mode features based on the transaction data, and uses these features to pre-train the teacher contract detector to guide the student contract detector to still learn the transaction behavior knowledge in the case of lack of transaction data, so as to realize the detection of prior fraud behavior, and improve the detection performance of abnormal contracts by integrating different modal data. And it is evaluated on a real blockchain abnormal contract dataset, and the experimental results show that the solution of this case can significantly improve the detection performance of abnormal contracts.

[0036] 2. The present invention conducts multi-dimensional behavioral analysis on the multi-modal data of contract accounts, including source code, bytecode, and transaction data, to enhance the characterization ability of abnormal contract features. By inserting monitoring code to record the logical paths and rule details of abnormal contracts, and statically analyzing the key nodes and structural changes in the source code of smart contracts, the abnormal contract logic vulnerabilities in the source code of smart contracts can be effectively mined. By introducing a dual attention head mechanism into the LSTM model and reconstructing the early loss function and stop function of the model, while learning the contract transaction behavior patterns, pay attention to their early prominent features to enhance the characterization ability of abnormal transaction behaviors of smart contracts. Based on the teacher-student architecture T-S, construct a smart contract detector PCD, and use a convolutional neural network (including a student network and a teacher network) to deeply mine the potential correlation relationships of abnormal features. During the model training process, through knowledge distillation, realize the transfer of abstract feature knowledge between the teacher network and the student network, and use the abnormal behavior knowledge learned by the teacher contract detector PCD-T to guide the training process of the student contract detector PCD-S in the no-transaction data set, effectively improving the detection performance of the detection model for abnormal contract accounts with no-transaction data, realizing the behavior detection of abnormal contracts, and improving the detection performance of abnormal behaviors of contract accounts with no-transaction data. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Schematic diagram of the blockchain abnormal smart contract detection process based on multi-modal knowledge distillation in the embodiment;

[0038] Figure 2 Schematic diagram of the structure of the multi-modal knowledge distillation structure MMKD model in the embodiment;

[0039] Figure 3 Example of the control flow graph CFG and the corresponding attribute control flow graph ACFG in the embodiment;

[0040] Figure 4 Schematic diagram of the analysis of abnormal contract transaction behavior patterns in the embodiment;

[0041] Figure 5 Schematic diagram of the machine training process of the smart contract detector in the embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0042] To make the objectives, technical solutions, and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the drawings and technical solutions.

[0043] Due to the characteristics of blockchain such as anonymity, decentralization, and immutability, anomaly detection of smart contracts faces many challenges. Traditional detection methods often suffer from insufficient feature mining of contract accounts, low detection performance for abnormal contract accounts without transaction data, and the inability to detect abnormal fraud behaviors in advance. Therefore, in the embodiments of this case, a blockchain anomaly smart contract detection method based on multi-modal knowledge distillation is provided, as Figure 1 shown, and specifically includes the following contents:

[0044] S101. Extract multi-dimensional feature data of cross-chain smart contracts in the area to be detected. The multi-dimensional feature data includes: static logic structure features of smart contract source code, dynamic execution state features of smart contract source code, and transaction mode features of smart contracts.

[0045] Specifically, the extraction of multi-dimensional feature data of cross-chain smart contracts in the area can be designed to include:

[0046] Construct a logical structure feature extractor for extracting static logic structure features, an execution state feature extractor for extracting dynamic execution state features, and a transaction mode feature extractor for extracting transaction mode features in transaction data. The logical structure feature extractor mines abnormal behavior-related paths for representing logical structure features by statically analyzing the logical structure of the smart contract and using code instrumentation. The execution state feature extractor obtains the attribute control flow chart of the smart contract through opcode slicing and obtains the compilation and running state of the smart contract by learning the behavior pattern of the opcode sequence. The transaction mode feature extractor extracts transaction mode features including time information by analyzing the transaction subgraph of the smart contract;

[0047] Use the logical structure feature extractor, the execution state feature extractor, and the transaction mode feature extractor to extract multi-dimensional feature data of the blockchain smart contract to be detected.

[0048] According to the characteristics of the code data and transaction data of the smart contract, the feature extractor, as Figure 2 shown in the structure, respectively uses code instrumentation, slicing technology, and sequence neural network to construct extractors for smart contract logical structure features, execution state features, and transaction mode features, namely FE-LSFs, FE-ESFs, and FE-TPFs.

[0049] Among them, the extraction of static logic structure features of smart contract source code can be designed to include:

[0050] Extract the inter - procedural control flow graph of the functions in the smart contract source code based on the function program statements and the control flow between statements in the smart contract source code, and obtain the information flow facts, information flow functions in the smart contract source code, and the information flow functions on the edges of the control flow graph. Then, construct a formal representation of the smart contract source code based on the control flow graph, information flow facts, information flow functions, and information flow functions on the edges of the control flow graph.

[0051] Expand the nodes and edges in the control flow graph according to the information flow facts and path - location keys of each node and the entering / leaving nodes corresponding to each node, and perform a breadth - first traversal on the expanded control flow graph to obtain all data - flow paths from the sensitive source to the release point, where the sensitive source and the release point are set according to the behavior patterns of abnormal smart contracts.

[0052] Use a multi - level hash table to hierarchically store the classes, functions, critical paths inside functions, and instrumentation information in the smart contract source code, compile and parse the instrumented smart contract, and extract the contract logic structure features related to abnormal behaviors.

[0053] In order to capture the design defects and logical vulnerabilities of smart contracts from abnormal contract source - code data, in the embodiments of this case, a logical - structure feature extractor FE - LSFs is constructed. It determines the instrumentation positions by statically analyzing the key logical structures of the contract, including function calls, loops, and branch statements, etc. Then, it deploys and runs the instrumentation code at the corresponding monitoring points to obtain the critical paths potentially related to abnormal behaviors, that is, the logical - structure features LSFs. The following analyzes from four aspects: problem definition, determining instrumentation positions, inserting monitoring code, and extracting LSFs features.

[0054] (1) Problem definition. To perform static analysis on the source - code data of smart contracts, a formal model ContractCode=(G, D, F, M, ó) is constructed, where G=(N, E) is the inter - procedural control flow graph of the code functions, N is the set of nodes representing all program statements of the functions, E is the set of edges representing the control flow between statements, and G={G1, G2,...} is the set of functions of the contract. D is a finite set of information - flow facts representing the polluted variables. F is the set of information - flow functions that define the impact of each statement on a set of information - flow facts. M: E→F is the mapping from edges to flow functions, representing the information - flow functions on each edge, and the mapping relationship satisfies the taint operation.

[0055] To facilitate subsequent instrumentation, it is necessary to record the critical information - flow paths of the source code. Therefore, G is extended to G # =(N # , E # ), where N #= N × D × Keys, representing each node as a triple <n, d, k>. E # represents the extended control flow, specifically as follows

[0056] E # = {<n i , d x , k> → <n i+1 , d y , k'> | (n i , n i+1 ) ∈ E, d y ∈ f ni (d x )} (1)

[0057] where n i and n i+1 are nodes in the original graph, d x and d y are the information flow facts entering and leaving node n i respectively, and k and k' are keys marking the positions of critical paths, such as positions of branches / call statements, etc.

[0058] (2) Determine the instrumentation positions. By performing a breadth - first search (BFS) on the extended control flow graph G#, all data flow paths from the sensitive source (the statement where funds flow in) to the release point (the point where funds are allocated and flow out) can be searched, that is, the paths from node to node <n end : sink(x), keys>. Among them, source(x) and sink(x) are the sensitive source and release point defined according to the behavior pattern of the abnormal smart contract, and keys represent all possible positions of critical paths with abnormal behavior, which are also the positions for code instrumentation for monitoring.

[0059] Algorithm 1 specifically describes the above - mentioned static analysis process.

[0060]

[0061]

[0062] In Algorithm 1, first, define the input sensitive sources and release points according to the behavior patterns of abnormal smart contracts, and call the SOOT method to generate G#. Subsequently, search all source statements of G#, traverse starting from each source statement (lines 1 - 3), find all suspicious abnormal paths keys to the release points, and mark their positions with kloc. When extracting the key information of different statement types (lines 4 - 26), mainly analyze and record the key information of four types of statements: function calls (lines 5 - 12), function returns (lines 13 - 17), branch statements (lines 18 - 23), and release points (lines 24 - 26).

[0063] (3) Insert monitoring code. To implement code instrumentation, a multi - level hash table HashPaths can be used to manage the contract code, storing the contract classes, functions, critical paths inside functions, and their specific instrumentation information hierarchically. Its data structure is represented as <classID, <methodID, <pathID, pathfrag>>>. At the same time, design a code instrumentation template according to the types of information to be collected, such as recording the values of fund variables, the call times of branch and loop functions, etc.

[0064] As shown in Algorithm 2, HashPaths loads and parses all contract files item by item, finds the critical instrumentation positions in each method, inserts the corresponding monitoring code before the statements according to the statement types (source points, branches, release points), and finally realizes the comprehensive monitoring of the key node information related to abnormal scams in all paths.

[0065]

[0066] (4) Extract logical structure features. Compile the contract source code after inserting the instrumentation code, parse the generated log files, extract the contract execution status features related to abnormal scam behaviors, and use the Glove model to learn the semantic information in them. Glove is a natural language model that learns word vectors based on global corpus statistical information. Compared with methods such as Word2Vec, Glove can balance the relationship between local context windows and global statistical information and can capture richer semantic information. The model first constructs a co - occurrence matrix C, where the element C i,j represents the number of times words i and j co - occur in the same context window, and its loss function is calculated as follows

[0067]

[0068] where, w i and w j are the vector representations of words i and j respectively, b i and b jis the bias term, and f is the weight function, which is used to weight the impacts of different co-occurrence frequencies. Finally, the contract execution state features FEs are obtained by minimizing the loss function.

[0069] Among them, to extract the dynamic execution state features of the smart contract source code, it can be designed to include:

[0070] Compile the smart contract source code into bytecode, and use a disassembler tool to parse and obtain readable opcodes and instructions, so as to perform opcode slicing according to the control flow semantics of the opcodes and obtain a basic block sequence;

[0071] Match and retain the key opcode information representing the abnormal behavior pattern in the basic block to obtain an attribute control flow graph with opcode attributes. Use the pre-trained graph attention neural network to extract the attention coefficients between each node and its neighbor nodes in the attribute control flow graph, and obtain the local features and global features in the attribute control flow graph through the normalized attention coefficients, so as to obtain the corresponding dynamic execution state features of the smart contract source code through the local features and global features.

[0072] The FE-LSFs extractor mainly focuses on the static logical structure details of the contract code, but ignores its dynamic runtime execution state information. In the embodiments of this case, slicing technology can be used to construct an attribute control flow graph (ACFG) based on basic blocks (opcode slicing), and capture the actual running situation during the contract compilation process by learning the behavior patterns in the opcode sequence. It can be specifically summarized as the following steps:

[0073] (1) Construct a CFG at the basic block level. A specific example of the CFG is shown in (a) of Figure 3 The specific steps to construct the CFG are as follows: Compile the contract source code into bytecode, and use a disassembler tool to parse it into readable opcodes and instructions; Cut it according to the control flow semantics of the opcodes to obtain opcode slices. For example, the starting position of the function and the position of the JUMPDEST label are the entry points of the basic block, and the terminating opcodes (STOP, RETURN, REVERT, INVALID, SELFDESTRUCT) and jump opcodes (JUMP / JUMPI) are used as the exit points of the basic block, and the code within the basic block is executed sequentially without jumps or branches; Establish the connection relationship between basic blocks as the edges of the control flow graph, as shown in Table 1 specifically.

[0074] Table 1 Edge types between basic blocks

[0075]

[0076]

[0077] (2) Match the node attribute information of the control flow graph. In smart contracts implementing abnormal behaviors, specific opcodes may be frequently used to handle functions such as fund inflow, fund allocation, and transfer. Table 2 shows the specific opcodes and sensitive opcodes related to the abnormal behaviors of smart contracts. By matching and retaining the key opcode information in the basic blocks, partial behavioral patterns of abnormal scams can be effectively characterized. Finally, a control flow graph with opcode attributes is obtained, that is, an attribute control flow graph, as shown in Figure 3 as shown in (b) of

[0078] (3) Extract the contract logic structure features. The Graph Attention Networks (GAT) can effectively capture local and global features in the graph by adaptively learning the relationship weights between nodes, and can effectively process the ACFG constructed above to extract its logic and structure information. Specifically, GAT calculates the attention coefficient between node u and each neighbor node v as follows

[0079] e uv [[ID=¹⁰]]= α(Wh u || Wh v ) (3)

[0080] where α is a learnable attention coefficient function, and || represents the concatenation operation of feature vectors. Then, normalize all the attention coefficients e uv of node u to obtain

[0081]

[0082] where N(u) is the set of neighbor nodes of node u. Use the normalized attention coefficients to perform weighted aggregation on the features of neighbor nodes

[0083] h' u = σ(∑ v∈N(u)∪{u} a uv Wh v ) (5)

[0084] where σ is the activation function, and h' u is the feature vector of node u in the next layer.

[0085] Table 2 Opcodes related to contract abnormal behaviors

[0086]

[0087] To enhance the expressive power of the model, a multi-head attention mechanism is introduced in GAT. Each head has an independent weight matrix W and attention coefficient function α. Repeat the above process in different attention heads, and concatenate the results of multiple heads, denoted as

[0088]

[0089] Among them, M is the number of attention heads. Therefore, the GAT model takes the ACFG as input data and uses binary cross-entropy as the loss function, and can obtain the execution state features ESFs with a fixed dimension by minimizing the loss function.

[0090] Among them, to extract the intelligent contract transaction pattern features, it can be designed to include:

[0091] Search all external transactions of the intelligent contract, sort the external transactions in chronological order, and establish a transaction subgraph for each external transaction;

[0092] Taking the sending address of the external transaction as the starting point, taking the contract address of the external transaction as the next node, and taking the internal transactions triggered by the external transaction as edges, so as to add all the internal transactions triggered by the external transaction to the transaction subgraph, and perform operations on the information of each transaction subgraph to obtain the intelligent contract transaction subgraph sequence;

[0093] Use the pre-trained long short-term memory network to perform temporal processing on the intelligent contract transaction subgraph sequence to obtain the transaction pattern features reflecting the early time behavior information of the intelligent contract. The long short-term memory network adopts the early stopping LSTM with a dual-head attention mechanism, and constructs a loss function for network model training through an early loss function composed of a classification prediction loss and an early reward loss and a stopping function for taking into account the decision-making timing of each time point. Among them, the dual attention mechanism heads of the early stopping LSTM include a main prediction head for converting the hidden state into transaction pattern features using the softmax function and an early stopping head for converting the hidden state into a stopping probability using the sigmoid function.

[0094] In addition to fully obtaining the abnormal behavior features in the contract code data, it is also necessary to consider the fund allocation behavior features in the contract transaction data that can reflect the abnormal fraud logic. Therefore, in the embodiments of this case, the abnormal behavior of the intelligent contract is analyzed to generate a series of transaction subgraphs, and the transaction pattern features containing time information are extracted, which can be specifically summarized as including the following steps:

[0095] (1) Analysis of abnormal transaction behavior of intelligent contracts. The account types in Ethereum are mainly divided into externally owned accounts and contract accounts. Externally owned accounts are controlled by private keys and can initiate external transactions; while contract accounts are controlled by intelligent contract code and can only trigger contract logic by receiving transactions, thereby generating internal transactions. Figure 4Four trading behavior patterns of abnormal contracts are presented: (a) The chain abnormal contract accumulates funds and stores them up to a fixed amount, and pays high returns to investors at one time according to the investment order; (b) The tree abnormal contract stores investment users in a tree structure according to the invitation relationship, and the new investment is distributed to the predecessor nodes in proportion; (c) The waterfall abnormal contract stores users in sequence in a list, and distributes each sum of funds to early investors in a certain proportion in sequence; (d) The handover abnormal contract allows only one investor to obtain returns each time, and the returns are paid by new investors, and the privilege is transferred as the entrance fee increases. From the above analysis, it can be seen that abnormal contracts have common characteristics: high-return promises, which usually attract investors in the form of promising higher market rates of return; inflow and outflow of funds, where the inflow of funds is usually new investment, and the outflow of funds is the "profits" paid to early investors; pyramid structure, with early investors at the top of the pyramid and new investors constantly joining at the bottom of the pyramid.

[0096] (2) Generate a sequence of trading subgraphs. According to the historical trading records of the contract, track a series of internal trading flows triggered by it starting from external transactions, and obtain the sequence of trading subgraphs of the contract. The specific process is shown in Algorithm 3.

[0097]

[0098] This algorithm first searches for all external transactions of the smart contract, sorts them in chronological order, and starts to build a trading subgraph for each external transaction (lines 2-4). Secondly, the external transaction is added to the subgraph, with the starting point being the sending address of the external transaction and the next node being the receiving address (contract address) of the external transaction. The transaction serves as an edge and has attributes such as timestamp and amount (lines 6-8). Then, all internal transactions triggered by this external transaction are added to the subgraph (lines 9-14). Next, calculate the statistical information of each trading subgraph, including the number of nodes, transaction amount, and transaction frequency, etc., and finally obtain the sequence of trading subgraphs of the contract (lines 15-16).

[0099] (3) Learn the characteristics of the contract trading mode. Long Short-Term Memory (LSTM) is a special type of Recurrent Neural Network (RNN) that can learn long-term dependence information and solve the problems of vanishing gradients or exploding gradients encountered by traditional RNNs when processing long sequence data. Since abnormal contracts are more likely to exhibit prominent trading behaviors with high-profit illusions in the initial stage, in the embodiments of this case, an early stopping LSTM based on a dual attention head mechanism is used to simultaneously focus on the temporal behavior patterns of trading data and their early prominent abnormal line features.

[0100] (4) Model and loss function. Given the current input x t and the hidden state h at the previous momentt-1 At time, the hidden state output h of the ES-LSTM model t is as follows

[0101]

[0102] where, θ h is the learnable parameter corresponding to the model training of h t and includes the weight matrix W h and the bias term b h .

[0103] The dual attention heads of the ES-LSTM model include the main prediction head and the early stopping head which are represented as follows respectively

[0104]

[0105] where, θ c and θ s are the learnable parameters for training and respectively. The Softmax function converts the hidden state h t into trading mode features, and the Sigmoid function converts the hidden state h t into the stopping probability.

[0106] The early loss function L of the ES-LSTM model e-lstm consists of two parts: the classification prediction loss and the early reward loss, and is represented as follows

[0107]

[0108] where, λ is used to balance the accuracy and earliness of the model feature learning. The classification prediction loss L feature is used to ensure that the model learns as accurately as possible at each time step, and its calculation is as follows

[0109]

[0110] The early reward loss L reward is used to encourage the model to learn more accurate features in the early part of the sequence, and its calculation is as follows

[0111]

[0112] where, τ t is a weight function used to emphasize the importance of the early time steps, and L reward shows a linear decrease as t → T. p t represents the probability of the correct class.

[0113] To ensure that the ES-LSTM model considers the information at all previous time points when making decisions and encourages the model to make decisions at the appropriate time, in the embodiments of this case, the constructed stop function S t can be expressed as follows:

[0114]

[0115] where represents the decision probability at each time point t, the probability that there is no decision at each time point i in the previous t - 1 time points, and the offset ε is used to prevent the model from falling into local minima.

[0116] Finally, the total loss function of the ES-LSTM model is composed of the stop function S t and the loss function L e-lstm jointly, which is expressed as

[0117]

[0118] By minimizing the objective loss function L ES-LSTM to fully capture the trading time series information, that is, performing temporal processing on the subgraph embedding sequence of the contract to obtain the fixed-dimensional features TPFs reflecting the information of the early time behavior of the contract.

[0119] S102. Input the multi-dimensional feature data into the intelligent contract detection model, and use the intelligent contract detection model to detect and output the abnormal state of the blockchain intelligent contract to be detected. The intelligent contract detection model adopts the teacher-student network model architecture for knowledge distillation. Among them, the teacher network is trained using the feature of the intelligent contract data sample, and the student network uses the intelligent contract data sample and is guided by the trained teacher network through knowledge distillation to learn the trading behavior knowledge in the case of lack of transaction data, so as to use the trained student network as the intelligent contract detection model.

[0120] As Figure 2 shown, use the multi-modal knowledge distillation structure (MMKD) as the main model architecture to achieve the ultimate goal of having no transaction data and only code data as the model input. Figure 2In the MMKD method shown, the knowledge distillation architecture consists of two parts: the teacher network T and the student network S. Each network contains a feature learning (feature extractor EF) and an anomaly detection (contract detector PCD) process. During the feature learning process, anomaly feature analysis is performed on multimodal data (source code, bytecode, and transaction data) to enhance the representation ability of abnormal contract behaviors. Among them, the source code, bytecode, and transaction data are input into the corresponding three extractors FE-LSFs, FE-ESFs, and FE-TPFs in the teacher network T for feature learning. When there is no transaction data for the contract account, the source code and bytecode are input into the corresponding two extractors FE-LSFs and FE-ESFs in the student network S for feature learning. Since there is no feature of transaction data in the student network S, the performance of the corresponding student network detector PCD-S will decline. Therefore, knowledge distillation is used to transfer the abstract feature knowledge learned in the teacher network detector PCD-T to the student network detector PCD-S, guiding the training process of the student network detector PCD-S, making up for the transaction behavior feature information and other detailed information learned by PCD-S in the absence of transaction data, thereby improving the detection performance of PCD-S.

[0121] Specifically, the intelligent contract detection model adopts the teacher-student network model architecture for knowledge distillation and can be designed to include:

[0122] Construct the teacher network and the student network based on the convolutional neural network. The convolutional neural network includes a convolutional layer for feature extraction and a fully connected layer for detection output. The convolutional layer contains three layers, and each convolutional layer uses a convolutional kernel of a specified size. After each layer of convolution, batch normalization, ReLU activation function, and max pooling operations are used for processing;

[0123] Use the convolutional layer in the teacher network to extract the static logic structure features, dynamic execution state features, and transaction pattern features of the intelligent contract data samples. Take the static logic structure features, dynamic execution state features, and transaction pattern features of the intelligent contract as the input of the fully connected layer of the teacher network and obtain the prediction labels of the teacher network;

[0124] Use the convolutional layer in the student network to extract the static logic structure features and dynamic execution state features of the intelligent contract, and reconstruct the prediction features regarding transaction behaviors based on the static logic structure features and dynamic execution state features of the intelligent contract extracted by the student network. Take the static logic structure features, dynamic execution state features, and prediction features of the intelligent contract as the input of the fully connected layer of the student network and obtain the prediction labels of the student network;

[0125] The cross-entropy loss between the predicted labels of the teacher network and the predicted labels of the student network is used as the soft loss, and the cross-entropy loss between the predicted labels of the student network and the true labels in the smart contract data samples is used as the hard loss. The cosine similarity is used to obtain the code feature loss and transaction feature loss of both the student network and the teacher network, so as to construct the total loss function in the training process of the student network by using the soft loss, hard loss, code feature loss and transaction feature loss;

[0126] Using the smart contract data samples and based on the total loss function, the network model promotes the student network to learn the transaction behavior knowledge of the teacher network during the training process in the case of lack of transaction data.

[0127] The abnormal contract detector is mainly used to learn the abnormal behavior patterns in the input features to detect abnormal contracts, such as Figure 5 shown. The abnormal contract detector consists of a teacher contract detector PCD-T and a student contract detector PCD-S, and uses the knowledge distillation technology to improve the detection performance and generalization ability of the student contract detector PCD-S.

[0128] The contract detectors of both the teacher and student networks use a convolutional neural network (CNN) to deeply process the smart contract features. This network uses three convolutional layers and one fully connected layer. Each convolutional layer uses a convolutional kernel of size 1×3, and the number of filters increases sequentially, which are 64, 128, and 256 respectively. After each convolutional operation, batch normalization, ReLU activation function, and max pooling operation are used for processing to enhance the expressiveness of important features and effectively prevent overfitting.

[0129] When training the teacher contract detector PCD-T, the LSFs, ESFs, and TPFs extracted by the FE are used as inputs. While the student contract detector PCD-S uses the LSFs and ESFs extracted by the FE as inputs. Obtained from the FE and Concatenate them into h t Input into PCD-T to get the teacher predicted label Y t ; Obtained from the EF and At the same time, a conversion layer is designed to achieve cross-modal knowledge transfer, and the code features Reconstructed into a predicted value about transaction behavior The calculation process is as follows

[0130]

[0131] Finally, and Concatenate to obtain h s Input PCD-S for training to obtain the student prediction label Y s .

[0132] The knowledge distillation of the contract detector mainly utilizes the knowledge pre-trained by the teacher contract detector PCD-T (including prediction labels and feature representations) to guide the learning process of the student contract detector PCD-S. The knowledge distillation technology enables PCD-S to perform well in the anomaly behavior detection tasks of both trading data accounts and non-trading data accounts, effectively solving the problem of poor detection performance of contract accounts without trading data, and achieving prior detection at the same time.

[0133] In the embodiments of this case, the knowledge distillation idea is used, and the soft loss L soft is defined as the cross-entropy loss between the student prediction label Y s and the teacher prediction label Y t in Equation (16), helping the student model PCD-S absorb the rich knowledge inside the teacher model PCD-T; the hard loss is defined as the cross-entropy loss between the student prediction value Y s and the true label Y, enabling PCD-S to learn the label information about abnormal contracts.

[0134]

[0135] Among them, N is the number of samples. Y t,i is the prediction label of the teacher model for the i-th sample. Y s,i is the prediction label of the student model for the i-th sample. Y i is the true label (0 or 1) of the i-th sample. Finally, the label knowledge loss is obtained,

[0136] L label = L soft + L hard (18)

[0137] However, only using label knowledge to learn the knowledge of the teacher model is not enough. Therefore, introducing feature loss can prompt the student detector PCD-S to better capture the feature knowledge of the teacher network. In the embodiments of this case, the cosine similarity loss function is used to calculate the LSFs, ESFs, and TPFs features at different scales, and the code feature loss function and the transaction feature loss function

[0138]

[0139] Among them, M is the number of feature vectors, h s,jis the concatenated vector of the output features of the j-th layer CNN in the student model. h t,j is the concatenated vector of the output features of the j-th layer CNN in the teacher model.

[0140] In summary, the total loss function L of the student model all consists of the soft label loss L soft , the hard label loss L hard , the code feature loss and the transaction feature loss , and can be specifically expressed as follows

[0141]

[0142] where α, β, γ are hyperparameters used to adjust the constraint ability of each part of the loss on the model.

[0143] Furthermore, based on the above method, the embodiment of the present invention also provides a blockchain abnormal smart contract detection system based on multi-modal knowledge distillation, including: a feature extraction module and an abnormal detection module, where

[0144] The feature extraction module is used to extract multi-dimensional feature data of the cross-chain smart contract in the area to be detected, and the multi-dimensional feature data includes: static logic structure features of the smart contract source code, dynamic execution state features of the smart contract source code, and smart contract transaction mode features;

[0145] The abnormal detection module is used to input the multi-dimensional feature data into the smart contract detection model, and use the smart contract detection model to detect and output the abnormal state of the blockchain smart contract to be detected. The smart contract detection model uses the teacher-student network model architecture for knowledge distillation. Among them, the teacher network is trained using the smart contract data sample features, and the student network uses the smart contract data samples and is guided by the trained teacher network through knowledge distillation to learn transaction behavior knowledge in the case of lack of transaction data, so as to use the trained student network as the smart contract detection model.

[0146] To verify the effectiveness of the solution in this case, the following further explains with experimental data:

[0147] Select the Ethereum smart contract abnormal behavior dataset for experimental verification.

[0148] Data collection: Obtained the labeled dataset of abnormal contract accounts and normal contract accounts from the publicly available blockchain data platform Xblock, and used the Ethplorer tool to crawl data such as the source code, bytecode, internal and external transactions of these labeled contract accounts, and creator information from the API provided by the ehterscan.io website. Finally, the obtained abnormal contract dataset contained a total of 3,845 smart contracts, among which 297 were abnormal contracts and the remaining 3,548 were non-abnormal contracts.

[0149] Data processing: When training and detecting the model performance, 70% of the dataset was used as training data and the remaining 30% as test data. Due to the class imbalance problem in the dataset, the SMOTE method was used to synthesize abnormal contract samples to improve the above problem. And the principal component analysis PCA dimensionality reduction algorithm was used to denoise the data and eliminate redundant information. At the same time, the transaction data of the contracts was statistically analyzed and sorted according to the timestamp. For each experiment, it was repeated 5 times and the average value was taken to ensure the effectiveness of the performance and results.

[0150] To illustrate the effectiveness of the MMKD method in this case, the MMKD method was compared with five existing Ponzi contract detection methods on Ethereum, including methods based on account features (Account features), opcode features (Opcode features), the combination of account features and opcode features (Account+Opcode features), term frequency-inverse document frequency features (Term Frequency-Inverse Document Frequency features, TF-IDF features), and their N-gram features (TF-IDF for N-gram).

[0151] (1) The method based on Account features designs basic account features according to the smart contract transaction data and conducts Ponzi contract detection from the perspective of transaction behavior features;

[0152] (2) The method based on Opcode features obtains the opcode information compiled after the deployment of the smart contract by statistically analyzing the occurrence frequency of all opcodes in the contract and conducts Ponzi behavior detection from the perspective of code features;

[0153] (3) The method based on Account+Opcode features is a commonly used Ponzi contract detection method that combines the account features related to smart contract transactions and the opcode features related to the contract code running status information to identify contract fraud behaviors;

[0154] (4) The TF-IDF feature-based method estimates the importance of opcodes by calculating the occurrence frequency and distribution position of opcodes in smart contract texts. The larger the TF-IDF value of an opcode, the more discriminative it is, and further explores the context information of contract opcode features;

[0155] (5) The TF-IDF for N-gram feature-based method takes consecutive n values in the opcode TF-IDF sequence as a feature, additionally considering the local dependence of opcodes while focusing on importance, and obtaining more representation information of Ponzi contracts for detection.

[0156] The above methods all use the LightGBM binary classifier for identification.

[0157] The following three metrics are used to comprehensively evaluate the performance of different methods in detecting Ethereum abnormal contract frauds: (1) Recall, which represents the proportion of successfully detected known abnormal contract samples; (2) Precision, which represents the proportion of actually abnormal contracts among the contracts predicted as abnormal; (3) F1-score, which comprehensively considers precision and recall to evaluate the comprehensive performance of the model.

[0158] The output embedding vector size of all models is 16. The window size of Golve in the MMKD method is 5, the hidden size of GAT is 2, and the learning rate is set to 0.01. The dimension size and number of layers of ES-LSTM are 32. The α, β, γ parameters in the CNN loss function are respectively set to 1.0. For the remaining comparison methods, the number of learning times and learning rate of the LightGBM model are respectively set to 50 and 0.03 according to experience.

[0159] 1. Effectiveness evaluation

[0160] The performance of all existing abnormal contract detection methods was evaluated and compared for RQ1, and the experimental results are shown in Table 3.

[0161] Table 3 Performance comparison results of the MMKD model and other methods

[0162]

[0163] The following conclusions can be drawn from Table 3:

[0164] (1) The MMKD method in this case significantly outperforms other methods in all evaluation metrics. The values of its Precision, Recall, and F1-score metrics reach 84.9%, 83.9%, and 84.4% respectively. Secondly, the method with the second-best performance is the TF-IDF for N-gram method, with an F1-score value of 79.2%. The methods based on Opcode features, Account+Opcode features, and TF-IDF features have similar performance, with their F1-score values all around 75%. Among all the methods, the classification performance of the method based on Account features is the worst, with an F1-score of only 56.7%.

[0165] (2) Compared with the method based on Account+Opcode features, the F1-score metric of the MMKD method in this case is 8.8% higher, and the precision and recall have also increased significantly. The method based on Opcode features has significantly improved the F1-score metric by about 16% compared with the method based on Account features, indicating that the Opcode features can describe the abnormal contract behavior to a greater extent than the Account features. When the Opcode features and Account features are combined for training, the precision of the model will increase slightly, indicating that the Account features have a certain auxiliary role in detecting abnormal contract accounts. However, compared with the MMKD method in this case, these methods lack the learning of features such as the potential transaction timing behavior, execution status, and logical structure of smart contracts.

[0166] (3) The performance of the method based on TF-IDF features is lower than that of the MMKD method, with the precision, recall, and F1-score differing by 8.0%, 7.5%, and 7.8% respectively. The method based on TF-IDF features has improved the F1-score metric by 3.4% compared with the method based on Opcode features, indicating that the unique opcode features with high discriminability extracted by this method can more accurately describe the behavior of abnormal contracts. Using Ngram opcode tuples to expand the TF-IDF feature method, the improved TF-IDF for Ngram method has increased the F1-score metric by 2.6%, and can learn richer context information of N-gram opcode groups. Compared with the above methods, the MMKD method in this case not only mines the contract bytecode data, but also uses the knowledge distillation technology to absorb the time behavior patterns in the transaction data, which can improve the detection performance of abnormal contracts in the absence of transaction data and can achieve early prediction.

[0167] 2. Ablation Study

[0168] To illustrate the effectiveness of feature extraction, the execution status feature extractor (MMKD / e), the logical structure feature extractor (MMKD / s), and the transaction pattern feature extractor (MMKD / t) were eliminated respectively. In addition, the ES-LSTM in the transaction behavior extractor was replaced with LSTM to verify the effectiveness of the improved LSTM. The results of MMKD and its variants are shown in Table 4.

[0169] Table 4 Comparison of MMKD and Its Variants

[0170]

[0171] The following conclusions can be drawn from Table 4:

[0172] (1) After removing the logical structure feature extractor FE-LSFs, the F1-score of MMKD / s is 1.3% lower than that of the MMKD model. This result indicates that FE-FSs can effectively extract the logical structure information in the source code, and the key path information of the contract can be captured through static analysis to detect the logical details related to the Ponzi scheme in the contract. However, compared with the FE-ESFs and FE-TPFs feature extractors, the contribution of FE-LSFs is the smallest.

[0173] (2) Compared with MMKD, the precision, recall, and F1-score of MMKD / e are reduced by 2.3%, 5.5%, and 4.5% respectively. This result shows that the execution status feature extractor FE-ESFs can capture the relevant instructions and status information of the smart contract during runtime, not only learning the structural information of the opcode sequence but also paying attention to the weights of the key attributes of the nodes, which are important features for detecting contract Ponzi behavior.

[0174] (3) The F1-score value of the transaction pattern feature extractor FE-TPFs decreases by 2.9% compared with MMKD. This result indicates that the extracted transaction pattern features TPFs can effectively represent the Ponzi behavior pattern of the contract. At the same time, the F1-score of MMKD (with LSTM) decreases by 1.6% compared with MMKD (with ES-LSTM). This result shows that the improved ES-LSTM can improve the detection performance of the model when paying more attention to the prominent features in the early transaction behavior pattern.

[0175] (4) The F1-score of MMKD (with LSTM) decreases by 1.6% compared with MMKD. This result shows that the improved ES-LSTM can improve the detection performance of the model when paying more attention to the prominent features in the early transaction behavior pattern.

[0176] 3. Knowledge Distillation Analysis

[0177] To evaluate the effectiveness of the knowledge distillation strategy, for RQ3, the label loss function (MMKD / L), code feature loss (MMKD / C), transaction feature loss (MMKD / T), and total distillation loss (MMKD / A) in the knowledge distillation loss function were removed respectively to evaluate the effects of these three knowledge distillation losses. The experimental results are shown in Table 5.

[0178] Table 5 Knowledge Distillation Loss Analysis of MMKD

[0179]

[0180] The following conclusions can be drawn from Table 5:

[0181] (1) After removing the three losses separately, it can be found that removing the transaction feature loss MMKD / T leads to a significant decrease in the model performance, with the precision, recall, and F1-score decreasing by 1.1%, 2.6%, and 2.3% respectively. Secondly, removing the code feature loss MMKD / C also has a greater impact on the decrease in model performance, with the F1-score of MMKD decreasing by 1.5%. The one with a smaller impact on the model performance is removing the label distillation loss MMKD / L, with its F1-score decreasing relatively by 0.9%.

[0182] The above results all show that the student anomaly contract detector PCD-S does benefit from the teacher anomaly contract detector PCD-T, and the detection performance of the PCD-S model can be improved through the multi-modal knowledge distillation loss. At the same time, it can be found that although the code features (ESFs and LSFs) can more effectively represent the abnormal behavior of the contract than the transaction features (as analyzed in Table 4), the transaction feature loss has a greater impact on the performance of the detection model than the code feature loss, indicating that the transaction feature knowledge distillation plays a greater guiding role in the model's learning of the abnormal contract behavior pattern.

[0183] (2) After removing the three losses simultaneously, its performance decreases by 1.5%, 5.4%, and 4.1% in precision, recall, and F1-score respectively. Therefore, without knowledge distillation, PCD-S cannot obtain teacher knowledge such as transaction behavior patterns from PCD-T and can only be trained through code features (ESFs and LSFs). This shows that the multi-modal knowledge distillation strategy can effectively improve the detection performance of the model for abnormal contracts.

[0184] The above experimental data can show that the solution of this case can enhance the feature learning of abnormal contract behaviors, improve the detection performance of abnormal fraud contracts, contribute to promoting the research on identifying abnormal contracts on the Ethereum platform, protecting the interests of users, and promoting the healthy development of the blockchain.

[0185] Unless otherwise specifically stated, the relative steps, numerical expressions, and numerical values of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0186] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same and similar parts among the various embodiments, reference can be made to each other. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple. For related parts, reference can be made to the description in the method section.

[0187] The units and method steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation is not considered to exceed the scope of the present invention.

[0188] Those of ordinary skill in the art can understand that all or part of the steps in the above methods can be completed by instructing relevant hardware through a program. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disc, etc. Optionally, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits. Correspondingly, the various modules / units in the above embodiments can be implemented in the form of hardware or in the form of software functional modules. The present invention is not limited to any specific form of the combination of hardware and software.

[0189] Finally, it should be noted that the above-described embodiments are only specific embodiments of the present invention, used to illustrate the technical solutions of the present invention, and are not intended to limit them. The protection scope of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that any person skilled in the art within the technical scope disclosed by the present invention can still modify the technical solutions recorded in the foregoing embodiments, or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes, or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A blockchain abnormal intelligent contract detection method based on multimodal knowledge distillation, characterized in that, Including: Extract multi-dimensional feature data of the cross-chain smart contract in the area to be detected. The multi-dimensional feature data includes: static logical structure features of the smart contract source code, dynamic execution status features of the smart contract source code, and smart contract transaction mode features; Input the multi-dimensional feature data into the smart contract detection model, and use the smart contract detection model to detect and output the abnormal state of the blockchain smart contract to be detected. The smart contract detection model uses the teacher-student network model architecture for knowledge distillation. Among them, the teacher network is trained using the smart contract data sample features, and the student network uses the smart contract data samples and is guided by the trained teacher network through knowledge distillation to learn transaction behavior knowledge in the case of lack of transaction data, so as to use the trained student network as the smart contract detection model.

2. The method for detecting abnormal smart contracts in a blockchain based on multimodal knowledge distillation according to claim 1, wherein Extract multi-dimensional feature data of the cross-chain smart contract in the area, including: Construct a logical structure feature extractor for extracting static logical structure features, an execution status feature extractor for extracting dynamic execution status features, and a transaction mode feature extractor for extracting transaction mode features in transaction data. The logical structure feature extractor mines abnormal behavior-related paths representing logical structure features by statically analyzing the smart contract logical structure and using code instrumentation. The execution status feature extractor obtains the control flow graph of the smart contract attributes by opcode slicing and obtains the compilation and running status of the smart contract by learning the behavior pattern of the opcode sequence. The transaction mode feature extractor extracts transaction mode features including time information by analyzing the smart contract transaction subgraph; Use the logical structure feature extractor, the execution status feature extractor, and the transaction mode feature extractor to extract multi-dimensional feature data of the blockchain smart contract to be detected.

3. The blockchain abnormal intelligent contract detection method based on multimodal knowledge distillation according to claim 1 or 2, characterized in that Extract static logical structure features of the smart contract source code, including: Extract the interprocedural control flow graph of the smart contract source code function according to the function program statements and the control flow between the statements in the smart contract source code, and obtain the information flow facts, information flow functions in the smart contract source code, and information flow functions on the edges of the control flow graph, and construct a formal representation of the smart contract source code based on the control flow graph, information flow facts, information flow functions, and information flow functions on the edges of the control flow graph; Expand the nodes and edges in the control flow graph according to the information flow facts and path position keys of each node and the incoming and outgoing nodes corresponding to each node, and perform a breadth-first traversal on the expanded control flow graph to obtain all data flow paths from the sensitive source to the release point, where the sensitive source and the release point are set according to the behavior pattern of the abnormal smart contract; Use a multi-level hash table to hierarchically store the classes, functions, key paths inside the functions, and instrumentation information in the smart contract source code, compile and parse the instrumented smart contract, and extract the contract logical structure features related to abnormal behavior.

4. The blockchain abnormal intelligent contract detection method based on multimodal knowledge distillation according to claim 1 or 2, characterized in that, Extract dynamic execution status features of the smart contract source code, including: Compile the smart contract source code into bytecode, and use a disassembler tool to parse and obtain readable opcodes and instructions, so as to perform opcode slicing according to the control flow semantics of the opcode to obtain a basic block sequence; Match and retain the key opcode information that characterizes the abnormal behavior pattern in the basic block, obtain an attribute control flow graph with opcode attributes, use a pre-trained graph attention neural network to extract the attention coefficients between each node and its neighbor nodes in the attribute control flow graph, and obtain the local and global features in the attribute control flow graph through the normalized attention coefficients, so as to obtain the dynamic execution state features of the corresponding smart contract source code through the local and global features.

5. The method for detecting abnormal smart contracts in a blockchain based on multimodal knowledge distillation according to claim 1 or 2, characterized in that, Extract the smart contract transaction pattern features, including: Search all external transactions of the smart contract, sort the external transactions in chronological order, and create a transaction subgraph for each external transaction; Taking the sender address of the external transaction as the starting point, the contract address of the external transaction as the next node, and the internal transactions triggered by the external transaction as the edges, add all the internal transactions triggered by the external transaction to the transaction subgraph, and process the information of each transaction subgraph to obtain a sequence of smart contract transaction subgraphs; Use a pre-trained long short-term memory network to perform temporal processing on the sequence of smart contract transaction subgraphs to obtain transaction pattern features that reflect the early time behavior information of the smart contract. The long short-term memory network uses an early stopping LSTM with a dual attention mechanism, and constructs a loss function for network model training through an early loss function composed of a classification prediction loss and an early reward loss and a stopping function for taking into account the decision-making timing at each time point. Among them, the dual attention mechanism heads of the early stopping LSTM include a main prediction head for converting the hidden state into transaction pattern features using the softmax function and an early stopping head for converting the hidden state into a stopping probability using the sigmoid function.

6. The blockchain abnormal smart contract detection method based on multimodal knowledge distillation according to claim 1, wherein, The smart contract detection model uses a teacher-student network model architecture for knowledge distillation, including: Construct a teacher network and a student network based on a convolutional neural network. The convolutional neural network includes a convolutional layer for feature extraction and a fully connected layer for detection output. The convolutional layer contains three layers, and each convolutional layer uses a convolutional kernel of a specified size. After each layer of convolution, batch normalization, ReLU activation function, and max pooling operations are used for processing; Use the convolutional layer in the teacher network to extract the static logic structure features, dynamic execution state features, and transaction pattern features of the smart contract in the smart contract data sample. Take the static logic structure features, dynamic execution state features, and transaction pattern features of the smart contract as the input of the fully connected layer of the teacher network and obtain the prediction label of the teacher network; Use the convolutional layer in the student network to extract the static logic structure features and dynamic execution state features of the smart contract, and reconstruct the prediction features regarding transaction behavior based on the static logic structure features and dynamic execution state features of the smart contract extracted by the student network. Take the static logic structure features, dynamic execution state features, and prediction features of the smart contract as the input of the fully connected layer of the student network and obtain the prediction label of the student network; The cross-entropy loss between the predicted labels of the teacher network and the predicted labels of the student network is used as the soft loss, and the cross-entropy loss between the predicted labels of the student network and the true labels in the smart contract data samples is used as the hard loss. The cosine similarity is used to obtain the code feature loss and the transaction feature loss of both the student network and the teacher network, so as to construct the total loss function in the training process of the student network by using the soft loss, the hard loss, the code feature loss, and the transaction feature loss; Using the smart contract data samples and based on the total loss function, the network model enables the student network to learn the trading behavior knowledge of the teacher network in the case of lack of transaction data during the training process.

7. The blockchain abnormal intelligent contract detection method based on multimodal knowledge distillation according to claim 6, wherein The total loss function during the training process of the student network is expressed as: where α, β, γ are hyperparameters used to adjust the constraint ability of each part of the loss on the model, L soft is the soft loss, L hard is the hard loss, is the code feature loss, is the transaction feature loss, and M is the number of feature vectors, h s,j is the concatenated vector of the output features of the j-th layer CNN in the student network, h t,j is the concatenated vector of the output features of the j-th layer CNN in the teacher network, and LSFs, ESFs, and TPFs are the logical structure feature, execution status feature, and transaction pattern feature identifiers, respectively.

8. A blockchain abnormal intelligent contract detection system based on multi-modal knowledge distillation, characterized in that, It includes: a feature extraction module and an anomaly detection module, where, The feature extraction module is used to extract multi-dimensional feature data of the cross-chain smart contract in the area to be detected. The multi-dimensional feature data includes: the static logic structure feature of the smart contract source code, the dynamic execution state feature of the smart contract source code, and the transaction mode feature of the smart contract; The anomaly detection module is used to input the multi-dimensional feature data into the smart contract detection model, and use the smart contract detection model to detect and output the abnormal state of the blockchain smart contract to be detected. The smart contract detection model adopts the teacher-student network model architecture for knowledge distillation. Among them, the teacher network is trained using the feature of the smart contract data sample, and the student network uses the smart contract data sample and is guided by the trained teacher network through knowledge distillation to learn the trading behavior knowledge in the case of lack of transaction data, so as to use the trained student network as the smart contract detection model.

9. An electronic device, characterized in that, It includes: At least one processor, and a memory coupled to the at least one processor; Wherein, the memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, and when the computer program is executed, it can implement the method according to any one of claims 1 to 7.

Images