Block chain intelligent contract vulnerability analysis system based on large language model
Through multi-model collaboration strategy based on large language models and fine-tuning training of own data sets, the problem of insufficient accuracy and interpretability of smart contract vulnerability detection is solved, and more efficient vulnerability identification and detailed analysis report generation is achieved, improving blockchain security.
Patent Information
- Application Number
- CN202510480866.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-17
- Publication Date
- 2025-08-01
AI Technical Summary
The existing smart contract vulnerability detection methods are difficult to adapt to the development and changes of blockchain technology, resulting in insufficient accuracy and interpretability of vulnerability detection, which affects the security and trust basis of blockchain.
A multi-model collaboration strategy based on large language models is adopted, and through contract classifiers, vulnerability classifiers and comprehensive analyzers, combined with fine-tuning training of their own data sets and multi-model voting mechanisms, the accuracy of vulnerability identification and analysis is improved, and a detailed vulnerability analysis report is generated.
It significantly improves the accuracy of smart contract vulnerability detection and the completeness and clarity of reporting, and improves the ability of large language models in vulnerability recognition tasks, which is better than traditional methods and a single large model.
Smart Images
Figure CN120408638A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of information security protection, and particularly relates to a blockchain smart contract vulnerability analysis system based on a large language model. Background Art
[0002] A smart contract is a computer protocol deployed on a blockchain, which has the characteristics of being tamper-proof and automatically executable, and can ensure secure and reliable interaction of data between nodes lacking trust. As the core technology in the blockchain 2.0 era, smart contracts have been widely used in many blockchain platforms such as Ethereum. However, due to the inevitable human errors in the design and coding of complex blockchain protocols, security vulnerabilities that can be exploited by attackers may appear in the contracts. In recent years, security incidents caused by smart contract vulnerabilities have occurred frequently, not only causing huge financial losses, but also seriously damaging the trust foundation of blockchain technology, and to a certain extent hindering the development and popularization of blockchain. Therefore, in order to prevent and reduce the occurrence of smart contract security incidents, designing and developing an effective smart contract security detection system has important research and application value.
[0003] Traditional smart contract vulnerability detection technologies are mainly divided into six categories: vulnerability detection technologies based on symbolic execution, fuzz testing, taint analysis, formal verification, machine learning, and other methods.
[0004] In recent years, with the rapid development of blockchain technology and smart contract applications, complex vulnerabilities, dynamic scenarios, and new types of vulnerabilities have emerged continuously. Traditional vulnerability detection methods have become difficult to adapt to the development and changes of vulnerabilities. Researchers have begun to explore detection methods based on deep learning, such as using graph neural networks, combining interpretable graph features with expert patterns, using pre-training techniques, and key data flow graphs to detect smart contract vulnerabilities, which has improved the accuracy and interpretability of detection results to a certain extent. With the development of large language model (LLM) technology, researchers have started to explore vulnerability detection methods based on large language models. Researchers have built dedicated architectures for source code vulnerability detection by fine-tuning pre-trained models such as BERT; developed new detection systems such as GPTScan and LLift by combining large language models with static analysis tools, significantly reducing the false positive rate; constructed SmartInv and PropertyGPT that can not only detect vulnerability types but also formally prove code security by integrating large language models with formal verification techniques. To further improve the performance of large language models in specific tasks, a multi-model collaboration strategy has been introduced. Through self-evaluation, knowledge transfer, memory enhancement, and multi-agent collaboration of large language models, the overall performance of systems based on large language models has been improved. The self-evolution of agents is achieved through cross-task knowledge transfer, and the Investigate-Consolidate-Exploit (ICE) strategy is designed; the RAISE framework is constructed by introducing a dual memory system (short-term memory and long-term memory) and a refined reasoning process, effectively improving the ability of large language models in context preservation and multi-turn interaction; the ProAgent framework is constructed by enabling each model to dynamically adjust strategies and complement each other when facing zero-shot coordination tasks. Summary of the Invention
[0005] To make up for the deficiencies of the prior art, the present invention provides a blockchain smart contract vulnerability analysis system based on a large language model, which improves the accuracy of the large language model in identifying vulnerabilities through fine-tuning the model on its own dataset; and adopts a multi-model collaboration strategy to effectively enhance the ability to identify smart contract vulnerabilities and optimize the accuracy, integrity, clarity, and overall satisfaction of the generated vulnerability analysis reports.
[0006] The objectives achieved by the present invention can be realized through the following specific technical solutions:
[0007] A blockchain smart contract vulnerability analysis system based on a large language model includes a contract classifier, a vulnerability classifier, a vulnerability locator, and a comprehensive analyzer, where
[0008] The contract classifier is used to classify smart contracts into secure contracts or non-secure contracts, and includes a multi-model voting mechanism and two fine-tuned models, where the fine-tuned models are fine-tuned large language models;
[0009] The vulnerability classifier is used to identify the types of vulnerabilities included in non-secure contracts, and includes a vulnerability identification unit based on a large language model, a vulnerability identification unit based on rule matching, a detection unit, and a regular processing unit. The vulnerability identification unit based on a large language model and the vulnerability identification unit based on rule matching are used for vulnerability detection, and the detection unit and the regular processing unit are used for extracting output content;
[0010] The vulnerability locator is used to locate the specific location of vulnerabilities in contract code;
[0011] The comprehensive analyzer is used to generate a vulnerability analysis report.
[0012] Furthermore, for the contract classifier:
[0013] The fine-tuned model is used to obtain the ability to distinguish secure contracts from non-secure contracts for the fine-tuned large language model through fine-tuning training on its own dataset;
[0014] The multi-model voting mechanism is used to take the classification result that accounts for the majority in the output as the final contract classification result by comprehensively analyzing the multiple output results of two fine-tuned models with different temperatures, so as to improve the accuracy of model contract classification.
[0015] Furthermore, the working process of the vulnerability classifier is as follows:
[0016] (1) Use the self-owned dataset to fine-tune and train the identification unit based on the large language model, so that the fine-tuned large language model obtains the ability to distinguish all SWC vulnerabilities;
[0017] (2) Use the vulnerability identification unit based on the large language model to classify the vulnerabilities of non-secure contracts, and output the specific vulnerability type names according to the list of vulnerability types given in the prompt words;
[0018] (3) The detection unit will detect the output result of the vulnerability identification unit based on the large language model through regular expressions; if it outputs specific vulnerability type names, go to step (4); if it does not output specific vulnerability type names, use the vulnerability identification unit based on rule matching to identify the vulnerabilities in the contract through predefined vulnerability matching rules, and then go to step (4);
[0019] (4) The regular processing unit is used to extract the specific vulnerability type names from the content output by the vulnerability identification unit based on the large language model through regular expression matching.
[0020] Furthermore, in the step (1), the loss function for fine-tuning training adopts the loss of the large language model (Negative Log-Likelihood), and its formula is as follows:
[0021]
[0022] where y pred,i is the prediction probability of the large language model for each token in the vocabulary, y true,i is the index of the true token (e.g., the token ID of "safe"), and n is the number of tokens in the output sequence.
[0023] Furthermore, the vulnerability locator is based on the DeepSeek-R1-671B model, and according to the specific vulnerability type name given by the vulnerability classifier, it outputs the specific vulnerability location information in the contract code.
[0024] Furthermore, the comprehensive analyzer is based on the Qwen-plus model, and combines the latest research results on smart contract security and vulnerability repair suggestions obtained from network searches, the vulnerability type names given by the vulnerability classifier, the vulnerability location information given by the vulnerability locator, and the source code of the detected vulnerable contract to generate a comprehensive analysis report containing vulnerability information.
[0025] Compared with the prior art, the present invention has the following advantages:
[0026] 1) The present invention effectively improves the ability of the large language model to detect and analyze smart contract vulnerabilities based on a multi-model collaborative strategy, providing a new idea for the field of smart contract vulnerability detection and analysis. Specifically in terms of vulnerability detection, the present invention abstracts the vulnerability identification task into two tasks: contract security classification (secure contract and insecure contract) and vulnerability classification, reducing the complexity of the model in processing the vulnerability identification task and effectively enhancing the ability of the large language model in the vulnerability identification task; at the same time, in order to enable the system to have a stronger vulnerability identification ability, fine-tuning training of the contract classifier and the vulnerability classifier is carried out on the basis of the self-owned dataset; in addition, by designing a multi-model voting mechanism and a rule matching unit for the contract classifier and the vulnerability classifier respectively, the vulnerability detection ability of the system is further enhanced.
[0027] 2) The results of the evaluation experiment of the vulnerability analysis report show that compared with a single large model, the present invention has significant advantages in the ability to identify smart contract vulnerabilities. The generated vulnerability analysis report comprehensively leads a single large model in four dimensions: accuracy, integrity, clarity, and overall satisfaction, and even significantly surpasses a model with a larger number of parameters and deep thinking ability. In terms of vulnerability analysis, the present invention effectively improves the readability of the output analysis content by integrating the deep thinking and online learning functions of existing domestic large models.
[0028] 3) The results of the accuracy comparison experiment prove the effectiveness of the method design. The dataset contains the source code and deployed bytecode of Solidity smart contracts verified on Etherscan.io, as well as the classification of their vulnerabilities according to the Slither static analysis framework. Brief Description of the Drawings
[0029] Figure 1 It is the system module block diagram of the present invention;
[0030] Figure 2 It is the flowchart of the contract classifier of the present invention;
[0031] Figure 3 It is the flowchart of the vulnerability classifier of the present invention;
[0032] Figure 4 It is the flowchart of the comprehensive analyzer of the present invention. Detailed Embodiment
[0033] In order to make the purpose, technical solution and advantages of the present invention clearer, the following further details the present invention in combination with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.
[0034] As Figure 1 shown, a blockchain smart contract vulnerability analysis system based on a large language model includes a contract classifier, a vulnerability classifier, a vulnerability locator, and a comprehensive analyzer. The specific content is as follows:
[0035] (1) Contract Classifier
[0036] As Figure 2 shown, the contract classifier is used to classify smart contracts into secure contracts or non-secure contracts, and includes a multi-model voting mechanism and two fine-tuned large language models (hereinafter referred to as fine-tuned models). The fine-tuned models are fine-tuned and trained based on their own datasets using the open-source fine-tuning platform LLaMA-Factory. During training, conventional methods are used to adjust the parameters so that the fine-tuned models obtain the ability to distinguish between secure contracts and non-secure contracts.
[0037] In the design of the multi-model voting mechanism, by comprehensively analyzing the multiple output results of two fine-tuned models set at different temperatures, the classification result that accounts for the majority in the output is used as the final contract classification result. The specific process is as follows: First, to ensure the diversity of the output results of the fine-tuned models, Fine-tuned Model 1 is set to a low temperature (0.5), and Fine-tuned Model 2 is set to a high temperature (0.8). Each result generated by the fine-tuned models is regarded as a vote. Subsequently, since the model has shown an obvious marginal effect when outputting 5 results, two fine-tuned models are set to generate 5 results respectively. Based on these 10 votes, the system uses the majority voting result as the final classification result of the contract classifier (the output label for a safe contract is safe, and the output label for an unsafe contract is unsafe).
[0038] The present invention improves the accuracy of the fine-tuned large language model in the contract classification task by setting a multi-model voting mechanism based on the output results of the fine-tuned models.
[0039] (II) Vulnerability Classifier
[0040] As Figure 3 shown, the vulnerability classifier is used to identify the specific types of vulnerabilities contained in unsafe contracts, including a large language model-based vulnerability identification unit, a rule-matching-based vulnerability identification unit, a detection unit, and a regular processing unit. The large language model-based vulnerability identification unit and the rule-matching-based vulnerability identification unit are used for vulnerability detection, and the detection unit and the regular processing unit are used for extracting the output content. The working process of the vulnerability classifier is as follows:
[0041] (1) Use the self-owned dataset to fine-tune and train the large language model-based identification unit, so that the fine-tuned model obtains the ability to distinguish all SWC (Smart Contract Weakness Classification) vulnerabilities.
[0042] The loss function for fine-tuning training uses the large language model loss (Negative Log-Likelihood), and its formula is as follows:
[0043]
[0044] where y pred,i is the prediction probability of the large language model for each token in the vocabulary, y true,i is the index of the true token (such as the token ID of "safe"), and n is the number of tokens in the output sequence.
[0045] (2) Use the large language model-based vulnerability identification unit to classify the vulnerabilities of the unsafe contract, and output the specific vulnerability type names according to the list of vulnerability types given in the prompt words.
[0046] The list of vulnerability types details all 37 SWC vulnerability types, which are the specific vulnerability type names to be output. The specific content is as follows: Unencrypted private data on the chain, code with no actual effect, message calls with hardcoded gas amounts, hash collisions of multiple variable-length parameters, unexpected Ethereum balances, unused variables, right-to-left override control character (U+202E), typos, denial-of-service attacks leveraging the block gas limit, arbitrary jumps using function type variables, malicious attacks with insufficient gas fees, incorrect inheritance order, writing to arbitrary storage locations, violation of requirements, lack of proper signature verification, lack of protection against signature replay attacks, weak randomness source from chain attributes, shadow state variables, incorrect constructor name, signature mutability, using block values as a proxy for time, authorization via tx.origin, transaction order dependence, denial-of-service attacks with failed calls, delegate calls to untrusted callers, using deprecated Solidity functions, assertion violations, uninitialized storage pointers, default visibility of state variables, reentrancy attacks, unprotected SELFDESTRUCT instructions, unprotected Ethereum withdrawals, not checking call return values, floating compiler version declarations, using outdated compiler versions, integer overflows and underflows, default visibility of functions.
[0047] (3) The detection unit will detect the output results of the vulnerability identification unit based on the large language model through regular expressions; if the detection unit identifies that the vulnerability identification unit based on the large language model outputs specific vulnerability type names, it will enter step (4); if the detection unit identifies that the vulnerability identification unit based on the large language model does not output specific vulnerability type names, it will use the vulnerability identification unit based on rule matching to identify vulnerabilities in the contract through predefined vulnerability matching rules, and then enter step (4).
[0048] The content of the regular expression defined in the detection unit is as follows: pattern = re.compile("|".join(re.escape(vuln) for vuln in self.vuln_types)). Here, self.vuln_types is a list containing all predefined vulnerability type names.
[0049] The vulnerability identification unit based on rule matching conducts vulnerability detection through predefined vulnerability matching rules. Specifically, it checks whether the code contains specific strings that match specific vulnerabilities. If there are strings that match the rules, the corresponding specific vulnerability names are output to the regular expression processing unit in step (4). For example, it checks whether ".call{gas:" exists in the code. If it exists, it is considered that there is a message call vulnerability with a hardcoded gas amount in the contract code, and the corresponding English vulnerability name is used as the input content for the regular expression processing unit described in step (4).
[0050] (4) The regular expression processing unit extracts the specific vulnerability type names from the content output by the vulnerability identification unit based on the large language model and the vulnerability identification unit based on rule matching through regular expression matching. The content of the regular expression used by the regular expression processing unit is the same as that of the detection unit in step (3).
[0051] (III) Vulnerability Locator
[0052] The vulnerability locator utilizes the deep thinking ability of the DeepSeek-R1-671B model and outputs the specific vulnerability location information in the contract code according to the specific vulnerability type names given by the vulnerability classifier. The vulnerability location information includes relevant information such as the line number where the vulnerability is located and the method name containing the vulnerability. The Prompt of the vulnerability locator is designed as follows: In the following smart contract code, locate the code segments where ‘"+vuln_name+"’ might exist and mark the specific line numbers. \n Code: \n+code+\n Output only plain text, in the format: \n Location: Lines X-Y\n Description: Detailed explanation\n (List all relevant locations in this format)\n。
[0053] (IV) Comprehensive Analyzer
[0054] Such as Figure 4As shown, the comprehensive analyzer generates a comprehensive analysis report containing information such as the vulnerability name, location of the vulnerability, analysis of the vulnerability principle, potential hazards, and repair suggestions by leveraging the online search ability of the Qwen-plus model, combining the latest research results on smart contract security and vulnerability repair suggestions obtained from network searches, the vulnerability type names given by the vulnerability classifier, the vulnerability location information given by the vulnerability locator, and the source code of the detected vulnerable contract. The Prompt of the comprehensive analyzer is designed as follows: Generate a detailed vulnerability analysis report based on the following information: Vulnerability Name: {vuln_name} {location_info} The report should include: Vulnerability Name, Location, Analysis, Impact, and Remediation Suggestions. Return the result in plain text format, and enhance the analysis by searching for the latest smart contract security knowledge online. Note: The location information may contain multiple code segments; please provide a comprehensive analysis of all locations.。
[0055] The results of the accuracy comparison experiment show that the present invention has achieved a significant improvement in the performance of smart contract vulnerability identification, verifying the effectiveness of the method design.
[0056] The accuracy comparison experiment proves the superiority of the vulnerability identification performance of For-AIVA (Four AI-Agents Smart Contract Vulnerability Analyzer, i.e., the blockchain smart contract vulnerability analysis system based on large language models of the present invention) by comparing it with existing large models of the same or larger parameter scale. A total of 3 pre-trained large language models (qwen2.5-1.5b-instruct, qwen2.5-coder-1.5b-instruct, deepseek-r1-distill-llama-8b) were selected for the experiment. All models were called through the API interface of the Alibaba Cloud Baichuan platform, with the temperature set to 0.7 and the Prompt set to: Analyze the provided Solidity smart contract code and identify any vulnerabilities from the following list: [vul_list]. Return only the names of the vulnerabilities detected, each on a new line. If no vulnerabilities are identified, return 'None'. The experiment proves that, thanks to the fine-tuning training on its own dataset, For-AIVA's ability to identify smart contract vulnerabilities is significantly better than other large language models of similar parameter scale. The experimental results are shown in Table 1.
[0057] Table 1 Experimental data of accuracy comparison
[0058]
[0059]
[0060] The vulnerability analysis report evaluation experiment compared the differences in accuracy, completeness, clarity, and overall satisfaction of the analysis reports generated by For-AIVA (Tool 1), qwen2.5-1.5b-instruct (Tool 2), qwen2.5-coder-1.5b-instruct (Tool 3), and deepseek-r1-distill-llama-8b (Tool 4) through a questionnaire survey to prove the superiority of For-AIVA's ability to write vulnerability analysis reports. The questionnaire scoring used a 5-point system (1 being the lowest and 5 being the highest), and the assessors needed to give scores for the four dimensions of accuracy, completeness, clarity, and overall satisfaction for each report. A total of 25 professional players with network attack and defense experience were invited to participate in the evaluation anonymously, and finally 25 valid data were obtained. To improve credibility, a scoring guide was provided on the first page of the questionnaire, the tool name information corresponding to the analysis report was hidden, and the credibility of the experiment was verified through the intraclass correlation coefficient (ICC). The experiment used a multi-factor analysis of variance (ANOVA) to evaluate the scoring differences of the vulnerability analysis reports generated by each tool in the four dimensions. The experimental results showed that compared with other large language models with similar parameters, the vulnerability analysis reports generated by For-AIVA had obvious advantages in the four dimensions of accuracy, completeness, clarity, and overall satisfaction. The ICC statistical details are shown in Table 2, the mean statistics in the four dimensions are shown in Table 3, and the ANOVA statistical results are shown in Tables 4 to 7.
[0061] Table 2 Results of the inter-rater reliability test (ICC)
[0062]
[0063]
[0064] Table 3 Summary table of the means of each tool in different dimensions
[0065] Evaluation Index Tool 1 Tool 2 Tool 3 Tool 4 Accuracy 4.32 3.44 3.44 3.92 Integrity 4.72 3.44 3.28 3.88 Clarity 4.44 3.16 3.44 3.88 Overall Satisfaction 4.48 3.32 3.4 3.92
[0066] Table 4 Results of the multi-factor analysis of variance (accuracy)
[0067] Source Degree of Freedom Sum of Squares Mean Square F Value p Value Tool 3 13.56 4.52 4.95 0.0031 Error 96 87.6 0.9125 - - Total 99 101.16 - - -
[0068] Table 5 Results of the multi-factor analysis of variance (completeness)
[0069] Source Degree of Freedom Sum of Squares Mean Square F Value p Value Tool 3 31.23 10.41 12.06 <![CDATA[9.13×10 -7 > Error 96 82.88 0.863 - - Total 99 114.11 - - -
[0070] Table 6 Results of the multi-factor analysis of variance (clarity)
[0071]
[0072]
[0073] Table 7 Results of Multifactor Analysis of Variance (Overall Satisfaction)
[0074] Source Degree of Freedom Sum of Squares Mean Square F Value p Value Tool 3 21.64 7.2133 7.91 0.00009 Error 96 87.52 0.9117 - - Total 99 109.16 - - -
[0075] The ablation experiment analyzed the contribution and impact of the For-AIVA system's overall vulnerability identification and analysis capabilities by adjusting the configurations of its key components. The experimental results showed that when the contract classifier and vulnerability classifier of For-AIVA were used in full, the system had the strongest vulnerability detection ability. Secondly, relying solely on the rule matching method performed the worst, and the system performance only decreased slightly after removing the rule matching unit, indicating that in the task of intelligent contract vulnerability detection, large language models have more advantages than traditional rule matching methods and play a more core role in the intelligent contract vulnerability detection and classification tasks of For-AIVA. The experimental configurations are shown in Table 8, and the experimental results are shown in Table 9.
[0076] Table 8 Ablation Experiment Configurations
[0077]
[0078]
[0079] Table 9 Overall Performance Metrics
[0080] Index Configuration 1 Configuration 2 Configuration 3 Configuration 4 Configuration 5 Configuration 6 Configuration 7 Configuration 8 Accuracy Rate 0.964 0.958 0.959 0.960 0.962 0.965 0.890 0.963 Precision 0.699 0.588 0.607 0.657 0.666 0.689 0.160 0.693 Recall Rate 0.527 0.380 0.414 0.441 0.508 0.552 0.310 0.492 F1 Score 0.493 0.362 0.380 0.406 0.460 0.509 0.153 0.466
[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A blockchain smart contract vulnerability analysis system based on large language models, characterized in that, It includes a contract classifier, a vulnerability classifier, a vulnerability locator, and a comprehensive analyzer. Among them, the contract classifier is used to classify smart contracts into secure contracts or non-secure contracts, and includes a multi-model voting mechanism and two fine-tuned models, and the fine-tuned models are large language models after fine-tuning; the vulnerability classifier is used to identify the types of vulnerabilities included in non-secure contracts, and includes a vulnerability identification unit based on a large language model, a vulnerability identification unit based on rule matching, a detection unit, and a regular processing unit. The vulnerability identification unit based on a large language model and the vulnerability identification unit based on rule matching are used for vulnerability detection, and the detection unit and the regular processing unit are used for extracting output content; the vulnerability locator is used to locate the specific location of vulnerabilities in the contract code; the comprehensive analyzer is used to generate a vulnerability analysis report.
2. The blockchain smart contract vulnerability analysis system based on a large language model according to claim 1, wherein, Regarding the contract classifier: the fine-tuned model is used to obtain the ability to distinguish secure contracts from non-secure contracts for the fine-tuned large language model through fine-tuning training on its own dataset; the multi-model voting mechanism is used to take the classification result that accounts for the majority in the output as the final contract classification result by comprehensively analyzing the multiple output results of two fine-tuned models with different temperatures.
3. The blockchain smart contract vulnerability analysis system based on a large language model according to claim 1, wherein The working process of the vulnerability classifier is as follows: (1) Use its own dataset to fine-tune and train the identification unit based on a large language model, so that the fine-tuned large language model obtains the ability to distinguish all SWC vulnerabilities; (2) Use the vulnerability identification unit based on a large language model to classify the vulnerabilities of non-secure contracts, and output the specific vulnerability type name according to the list of vulnerability types given in the prompt words; (3) The detection unit will detect the output result of the vulnerability identification unit based on a large language model by means of regular expressions; if it outputs a specific vulnerability type name, go to step (4); if it does not output a specific vulnerability type name, use the vulnerability identification unit based on rule matching to identify the vulnerabilities in the contract through predefined vulnerability matching rules, and then go to step (4); (4) The regular processing unit is used to extract the specific vulnerability type name from the content output by the vulnerability identification unit based on a large language model by means of regular expression matching.
4. The blockchain intelligent contract vulnerability analysis system based on a large language model according to claim 3, wherein In step (1), the loss function of the fine-tuning training adopts the large language model loss, and its formula is as follows: where y pred,i is the predicted probability of each token in the vocabulary by the large language model, y true,i is the index of the true token, and n is the number of tokens in the output sequence.
5. The blockchain smart contract vulnerability analysis system based on a large language model according to claim 1, characterized in that, The vulnerability locator is based on the DeepSeek-R1-671B model, and outputs the specific vulnerability location information in the contract code according to the specific vulnerability type name given by the vulnerability classifier.
6. The blockchain intelligent contract vulnerability analysis system based on a large language model according to claim 1, wherein The comprehensive analyzer is based on the Qwen-plus model, and combines the latest research results on smart contract security and vulnerability repair suggestions obtained from network searches, the vulnerability type names given by the vulnerability classifier, the vulnerability location information given by the vulnerability locator, and the source code of the detected vulnerable contract to generate a comprehensive analysis report containing vulnerability information.