Intelligent contract vulnerability detection and positioning method based on anchor point multi-spatial scale

Abstract

The invention discloses a smart contract vulnerability detection and positioning method based on anchor point multi-spatial scale, and belongs to the technical field of security detection of a block chain network. The problems that an existing method is poor in vulnerability positioning accuracy and cannot explain vulnerability generation reasons are solved. The method comprises the following steps: firstly, disassembling byte codes, outputting operation codes obtained by disassembling as a control flow chart, segmenting the control flow chart into a plurality of instances, generating a plurality of anchor chains with fixed lengths on each instance, and constructing anchor chain characteristics for each anchor chain; secondly, splicing features of all anchor chains on a spatial scale, processing the features of the anchor chains on a contract scale and a Block scale, and identifying potential vulnerabilities in the contract; when a single anchor chain in each instance is analyzed, splicing with global features on a contract scale is carried out, and a vulnerability position is positioned through a multi-layer perceptron; and finally, realizing vulnerability positioning on an instruction scale. The method can be applied to contract vulnerability detection and positioning.

Description

Technical Field

[0001] The present invention belongs to the technical field of security detection of blockchain networks, and particularly relates to a method for detecting and locating vulnerabilities in smart contracts based on multi-spatial scales of anchor points. Background Technique

[0002] Blockchain technology has become one of the core technologies in the digital age. Its characteristics of decentralization, distribution, and immutability provide important support for the construction of a global trust system and data security protection. However, with the complexity of the blockchain ecosystem, the security issues of smart contracts, as an important part of blockchain technology, have become increasingly prominent. A smart contract is a piece of code running on a blockchain, featuring automated execution, trustlessness, and high transparency, and is widely used in decentralized finance (DeFi), non-fungible tokens (NFTs), and other on-chain applications. Although the functionality and efficiency of smart contracts have been widely recognized, their potential vulnerabilities and security risks are still one of the weakest links most easily exploited in blockchain systems. In recent years, machine learning (ML) methods for program analysis have become a new trend in the field of security detection. Machine learning-based methods can extract hidden features from massive data (not limited to single information features) and have good scalability. However, most of the existing machine learning-based smart contract detection methods can only perform binary classification on vulnerabilities, that is, they can only distinguish between vulnerable and non-vulnerable contracts. There are relatively few detection methods that can locate vulnerabilities and determine their positions. Therefore, in order to accurately locate smart contract vulnerabilities and improve the accuracy and interpretability of the model, a locatable smart contract vulnerability detection model is urgently needed to be developed.

[0003] In addition, for a small part of the methods that can give vulnerability locations, the current methods can only give locations at the source code level and cannot further explain the causes of vulnerabilities at the bytecode level. Therefore, the existing vulnerability detection methods that can locate still have certain deficiencies, and the effect of accurate vulnerability location is still poor. There is a need for a bytecode-oriented method for detecting and locating smart contract vulnerabilities that can adapt to the learning of new types of vulnerabilities and maintain the accuracy and timeliness of vulnerability detection. Summary of the Invention

[0004] The purpose of the present invention is to solve the problems of poor accuracy in vulnerability location and inability to explain the causes of vulnerabilities in existing methods, and to propose a method for detecting and locating smart contract vulnerabilities based on multi-spatial scales of anchor points.

[0005] The technical solution adopted by the present invention to solve the above technical problems is: A method for detecting and locating smart contract vulnerabilities based on multi-spatial scales of anchor points, the method specifically includes the following steps:

[0006] Step 1: Output a control flow graph based on the bytecode of the smart contract. The control flow graph includes block nodes and control flow edges, and each block node contains a set of instructions;

[0007] Among them, the set of block nodes \(V = \{v_1, v_2, \ldots, v n \}\), where \(v i \) is the \(i\)-th block node, \(i = 1, 2, \ldots, n\), and \(n\) represents the total number of block nodes; the set of control flow edges \(e=\{e ij \), \(i\neq j\}\), and \(e ij \) represents an edge from block node \(v i \) to block node \(v j \);

[0008] Step 2: Use the anchor feature generator to generate the semantic feature matrix of each anchor chain in the control flow graph;

[0009] Step 3: Use the feature extractor to process the semantic feature matrix of each anchor chain, and then use the processing result as the input of the vulnerability detector, and output the vulnerability detection result of each anchor chain through the vulnerability detector;

[0010] Step 4: Use the multi-anchor detector to process the features of the anchor chains with vulnerabilities to obtain the vulnerability location results of the anchors in each anchor chain;

[0011] Step 5: Use the vulnerability detector and the multi-anchor detector to process the vulnerable anchors to obtain the vulnerability location results at the instruction scale.

[0012] The beneficial effects of the present invention are:

[0013] The present invention first takes bytecode as the analysis object, disassembles the bytecode, and outputs the opcode as a control flow graph according to the control relationship and jump relationship between the disassembled opcodes. The control flow graph is divided into multiple instances with arbitrary lengths. At the same time, an instance-oriented anchor mechanism is proposed. Multiple anchor chains with fixed lengths are generated on each instance, and anchor chain features are constructed for each anchor chain. Secondly, the features of all anchor chains are spliced at the spatial scale to form multi-channel anchor chain features, and the anchor chain features are processed at multiple scales: at the contract scale, the feature extractor and the self-attention mechanism are used to extract features to identify potential vulnerabilities in the contract; at the Block scale, each single anchor chain in each instance is analyzed and spliced with the global features at the contract scale, and the vulnerability location is determined through a multi-layer perceptron; at the instruction scale, by changing the input unit, the vulnerability is accurately located at the opcode instruction level.

[0014] By applying a multi-scale strategy, the present invention can achieve robust detection and accurately locate one or more vulnerabilities down to the instruction level. Moreover, the vulnerability location results at the instruction level can explain the causes of the vulnerabilities. In addition, the vulnerability detection and location method of the present invention is also applicable to new types of vulnerabilities. Description of the Drawings

[0015] Figure 1 is a flowchart of an intelligent contract vulnerability detection and location method based on multi-anchor multi-spatial scales of the present invention;

[0016] Figure 2 is a flowchart of a feature extractor;

[0017] Figure 3 is a flowchart of a vulnerability detector;

[0018] Figure 4 is a flowchart of a multi-anchor detector. Detailed Embodiments

[0019] Detailed Embodiment 1: Combined with Figure 1 to illustrate this embodiment. An intelligent contract vulnerability detection and location method based on multi-anchor multi-spatial scales described in this embodiment specifically includes the following steps:

[0020] Step 1: Output a control flow graph (CFG) according to the bytecode of the intelligent contract, represent the flow direction of opcode instructions in the form of a control flow graph. The control flow graph includes block nodes and control flow edges (each edge represents the control relationship between block nodes), and each block node contains a set of instructions;

[0021] Among them, the set of block nodes V = {v1, v2,..., v n}, v i is the i-th block node, i = 1, 2,..., n, and n represents the total number of block nodes; the set of control flow edges E = {e ij , i ≠ j}, e ij represents the edge from block node v i to block node v j ;

[0022] Step 2: Use an anchor feature generator (AFG) to generate a semantic feature matrix for each anchor chain in the control flow graph;

[0023] Step 3: Use the Feature Extractor (FE) to process the semantic feature matrices of each anchor chain, and then use the processing results as the input of the Vulnerability Detector (VD). Output the vulnerability detection results for each anchor chain through the vulnerability detector;

[0024] Step 4: Use the Multi-Anchor Detector (MAD) to process the features of the anchor chains with vulnerabilities to obtain the vulnerability location results of the anchor points in each anchor chain;

[0025] Step 5: Use the vulnerability detector and the multi-anchor detector to process the vulnerable anchor points to obtain the vulnerability location results at the instruction scale.

[0026] The present invention combines anchor point feature generation, multi-anchor detection, and specific vulnerability prediction modules. The vulnerability detector completes vulnerability detection at the contract scale, and the multi-anchor detector realizes vulnerability location at the Block and instruction scales. Convolutional networks, self-attention mechanisms, and loss functions are used to ensure high precision and high efficiency in vulnerability detection and location. The method of the present invention can not only identify vulnerable blocks in smart contracts but also accurately locate the affected instructions, thus promoting the development of smart contract security analysis technology.

[0027] Specific Embodiment 2: The difference between this embodiment and Specific Embodiment 1 is that the process of outputting the control flow chart according to the bytecode of the smart contract is specifically as follows:

[0028] Disassemble the bytecode of the smart contract into operation codes, and then output the operation codes as a control flow chart according to the execution flow of the instructions corresponding to each segment of binary characters in the bytecode.

[0029] Other steps and parameters are the same as those in Specific Embodiment 1.

[0030] Specific Embodiment 3: The difference between this embodiment and Specific Embodiment 1 or 2 is that the specific process of Step 2 is as follows:

[0031] Step 2-1: In the control flow chart, each branch from the root node to the leaf node is used as an instance (that is, each instance contains all the nodes on a branch from the root node to the leaf node, and the execution order is used as the link). Encode each node in each instance to obtain the semantic feature matrix of each node;

[0032] Step 2-2: Output multiple anchor chains for each instance, and obtain the semantic feature matrix of each anchor chain according to the encoding results of Step 2-1.

[0033] Other steps and parameters are the same as those in Specific Embodiment 1 or 2.

[0034] Embodiment 4: The difference between this embodiment and one of Embodiments 1 to 3 is that the Asm2vec method is used to encode each node within each instance.

[0035] Other steps and parameters are the same as those in one of Embodiments 1 to 3.

[0036] For each node, a code representation matrix with node semantic features and a dimension of 256*256 is obtained through encoding.

[0037] Embodiment 5: The difference between this embodiment and one of Embodiments 1 to 4 is that the specific process of Step 22 is as follows:

[0038] Taking any one instance as an example

[0039] (1) If the i-th node M i is the first node on the current instance (i.e., when i = 1), then M i and the node M j form an anchor chain, where j = 2, 3,..., min(2n + 1, N), and N represents the total number of nodes on the current instance;

[0040] The semantic feature matrices of the nodes M i , M i+1 ,..., M min(2n+1,N) form the feature matrix X of the anchor chain i = {x i , x i+1 ,..., x min(2n+1,N)};

[0041] where: x i , x i+1 ,..., x min(2n+1,N) are the semantic feature matrices of the nodes M i , M i+1 ,..., M min(2n+1,N) respectively;

[0042] (2) If the i-th node M i is the last node on the current instance (i.e., when i = N), then the nodes M j and M i form an anchor chain, where j = max(1, N - 2n), max(1, N - 2n) + 1,..., N - 1;

[0043] The semantic feature matrices of the nodes M max(1,N-2n) , M max(1,N-2n)+1 ,..., M N form the feature matrix X of the anchor chain i = {xmax(1,N-2n) , x max(1,N-2n)+1 , …, x N};

[0044] Wherein: x max(1,N-2n) , x max(1,N-2n)+1 , …, x N are respectively the semantic feature matrices of nodes M max(1,N-2n) , M max(1,N-2n)+1 , …, M N ;

[0045] (3) If the i-th node M i is neither the first node nor the last node on the current instance, then nodes M max(1,i-n) , M max(1,i-n)+1 , …, M i-1 , M i , M i+1 , …, M min(i+n,N) form an anchor chain;

[0046] The semantic feature matrices of nodes M max(1,i-n) , M max(1,i-m)+1 , …, M i-1 , M i , M i+1 , …, M min(i+n,N) form the feature matrix X of the anchor chain i = {x max(1,i-n) , x max(1,i-n)+1 , …, x i-1 , x i , x i+1 , …, x min(i+n,N)};

[0047] Wherein: x max(1,i-n) , x max(1,i-n)+1 , …, x i , x i , x i+1 , …, x min(i+n,N) are respectively the semantic feature matrices of nodes M max(1,i-n) , M max(1,i-n)+1 , …, M i-1 , M i , M i+1 , …, M min(i+n,N) ;

[0048] Other steps and parameters are the same as those in any one of the specific embodiments one to four.

[0049] In the present invention, n takes a value of 1 or 2. According to the nodes on the instance, multiple anchor chains can be generated for one instance. The anchor chain generation algorithm is shown in Table 1:

[0050] Table 1

[0051]

[0052] Specific Embodiment Six: Combining Figure 2 to illustrate this embodiment. The difference between this embodiment and one of Embodiments One to Five is that when using the feature extractor to process the semantic feature matrix of each anchor chain, the specific process is as follows:

[0053] Taking the semantic feature matrix of each anchor chain in the q-th instance as the q-th row sub-matrix of the feature matrix D, where q = 1, 2,..., Q, the overall semantic feature matrix D is composed of the semantic feature matrices of each anchor chain on all instances:

[0054]

[0055] where X 1,1 represents the sub-matrix at the first row and first column of the semantic feature matrix D (i.e., the semantic feature matrix of the first anchor chain in the first instance);

[0056] X Q,1 represents the sub-matrix at the Q-th row and first column of the semantic feature matrix D (i.e., the semantic feature matrix of the first anchor chain in the Q-th instance);

[0057] X 1,P represents the sub-matrix at the first row and P-th column of the semantic feature matrix D;

[0058] X Q,P represents the sub-matrix at the Q-th row and P-th column of the semantic feature matrix D;

[0059] Q represents the total number of instances;

[0060] Since the number of anchor chains in each instance may be different, it is necessary to use 0 elements to fill the sub-matrix in the row corresponding to the instance with fewer anchor chains based on the instance with the largest number of anchor chains (in the present invention, the maximum number of anchor chains in an instance is denoted as P);

[0061] Performing a two-dimensional convolution operation on the semantic feature matrix D to generate a local feature matrix Y; the sub-matrix Y q,p at the q-th row and p-th column in the local feature matrix Y is:

[0062]

[0063] where X q,p (i'+l, j'+k) represents the element at the i'+l-th row and j'+k-th column in the sub-matrix X q,p ;

[0064] Y q,p (i', j') represents the sub-matrix Yq,p The element in the i'-th row and j'-th column of

[0065] W(l,k) is the weight of the convolution kernel;

[0066] l represents the size of the convolution kernel in the horizontal direction;

[0067] k represents the size of the convolution kernel in the vertical direction;

[0068] b is the bias term;

[0069] Then, the local feature matrix Y is passed through the activation function ReLU (Rectified Linear Unit), and the output of the activation function ReLU is subjected to batch normalization (BatchNormalization) processing. An average pooling operation is performed on the result of the batch normalization processing to obtain the result Z of the average pooling operation. Each sub-matrix in the result of the average pooling operation represents the features of each anchor chain.

[0070] Other steps and parameters are the same as those in any one of the specific embodiments one to five.

[0071] ReLU outputs all negative numbers as 0 and keeps positive numbers unchanged. The activation function ReLU is used to increase non-linearity to accelerate convergence. Performing batch normalization (BatchNormalization) processing on the data can standardize the data. The average pooling operation can reduce the dimension of the features and retain the main feature information. To optimize the computational complexity and feature retention efficiency, the present invention uses a 2*2 pooling window for the average pooling operation. The sub-matrix Z in the result of the average pooling operation q,p The element Z in the i'-th row and j'-th column of q,p (i',j') is:

[0072] Y q,p (2i'+m,2j'+n) are the elements in the pooling window, where m,n∈{0,1}.

[0073]

[0074] This embodiment uses the feature extractor to further extract the features of the input data and uses the extracted features for vulnerability prediction at the contract scale.

[0075] Specific embodiment seven: Combine Figure 3 To illustrate this embodiment. The difference between this embodiment and any one of the specific embodiments one to six is that the working process of the vulnerability detector is as follows:

[0076] Map Z to the space of query Q, key K, and value V through the learned weight matrix (the self-attention mechanism can capture the global context relationship):

[0077] Q = ZWq , K = ZW k , V = ZW v

[0078] Among them, W q , W k and W v represent weight matrices;

[0079] Calculate attention weights Attention Weights using the softmax function:

[0080]

[0081] Among them, d k is the dimension of the key;

[0082] The superscript T represents the transpose of the matrix;

[0083] And calculate the global feature F according to the attention weights Attention Weights G :

[0084] F G = Attention Weights * V

[0085] Among them, * represents multiplication;

[0086] Then pass the global feature F G through a fully connected layer (map the global feature generated by self-attention to a higher-dimensional representation space through the fully connected layer), and denote the output of the fully connected layer as F' G ;

[0087] Take the corresponding values of each anchor chain in F' G as the inputs of the Sigmoid activation function layer respectively, and output the probability of a hole existing in each anchor chain through the Sigmoid activation function layer;

[0088] Then judge whether there is a hole in each anchor chain according to the obtained probability: that is, for any anchor chain, if the probability of a hole existing in the anchor chain output by the Sigmoid activation function layer is greater than the threshold (in the present invention, the threshold is set to 0.8), it is considered that there is a hole in the anchor chain, otherwise, it is considered that there is no hole in the anchor chain.

[0089] Other steps and parameters are the same as those in any one of the first to sixth specific embodiments.

[0090] Specific embodiment eight: The difference between this embodiment and any one of the first to seventh specific embodiments is that the process of outputting the probability of a hole existing in each anchor chain through the Sigmoid activation function layer is as follows:

[0091]

[0092] Among them, z' represents the corresponding value of an anchor chain in F' G in;

[0093] e represents the base of the natural logarithm;

[0094] σ(z') represents the probability of a hole existing in the anchor chain, and σ(z') ∈ [0, 1].

[0095] Other steps and parameters are the same as those in any one of the specific embodiments one to seven.

[0096] Specific embodiment nine: Combining Figure 4 to illustrate this embodiment. The difference between this embodiment and any one of the specific embodiments one to eight is that the specific process of step four is as follows:

[0097] Extract the features of each anchor chain with holes from the average pooling operation result Z, and splice the features of each extracted anchor chain to obtain a splicing result X;

[0098] Splice the splicing result X with the global feature F G to perform feature splicing to obtain a splicing result Feature:

[0099]

[0100] Among them, represents the splicing operation;

[0101] Input the spliced feature Feature into a multi-layer perceptron for non-linear feature transformation, and represent the working process of the multi-layer perceptron as:

[0102] MLP(f) = W2 * ReLU(W1 * Feature + b1) + b2

[0103] Among them, MLP(f) represents the output of the multi-layer perceptron;

[0104] W1 and W2 represent weights;

[0105] b1 and b2 represent biases;

[0106] And pass the output of the multi-layer perceptron through the Sigmoid activation function, and output the probability of a hole existing in each anchor point through the Sigmoid activation function. For any anchor point, if the probability of a hole existing in the anchor point is greater than the threshold, it is considered that the anchor point has a hole, otherwise it is considered that the anchor point does not have a hole, so that the location where the hole occurs can be located at the node block scale.

[0107] Other steps and parameters are the same as those in any one of the specific embodiments one to eight.

[0108] For the vulnerability detection and location results at the instruction level

[0109] Taking the instance composed of all instructions contained in the vulnerable node as the input, generating the anchor chain feature through the anchor point feature generator (at this time, the anchor chain is composed of instructions), outputting the probability value of each anchor chain having a vulnerability through the vulnerability detector, and then using the multi-anchor point detector to specifically locate the vulnerabilities of the instructions in the anchor chain, so as to locate the vulnerability to the instruction scale. The specific content is as follows:

[0110] First, generate instruction instances. The generation of instruction instances is similar to the generation process of node instances. According to the execution flow of the instructions contained in the vulnerable node, the instructions are output as a CFG graph. Each node of the graph is an instruction and is linked by the execution logic of the instructions. The CFG graph is divided into multiple instances, and one instance is a path from the start node to the end node of the CFG graph. Each instance contains multiple nodes.

[0111] Then, in the same way as the processing method of node instances, after encoding the instruction instances through Asm2vec, generate the anchor chain, and finally perform vulnerability location by the multi-anchor point detector. When the output probability is close to 1 (that is, when the output probability is greater than the threshold), it indicates that the instruction has a vulnerability. When the output is close to 0, it indicates that the instruction does not have a vulnerability. The probability value reflects the probability of each anchor point having a vulnerability, so as to accurately locate the position where the vulnerability occurs at the instruction scale.

[0112] Through training and testing on the data obtained from the actual blockchain network and the commonly used typical data sets, it is found that the method of the present invention can effectively implement vulnerability detection, and can adapt to the detection of new vulnerability types, and at the same time accurately locate the position where the vulnerability occurs at the instruction level. The vulnerability detection method proposed by the present invention helps to be deployed in smart contracts with vulnerabilities to discover and prevent attacks before losses are caused, and gives the specific position where the vulnerability occurs, avoiding immeasurable economic losses.

[0113] The above examples of the present invention are only for explaining in detail the calculation model and calculation process of the present invention, rather than limiting the implementation manner of the present invention. For those of ordinary skill in the art, other different forms of changes or variations can be made on the basis of the above description. It is impossible to list all the implementation manners here. Any obvious changes or variations derived from the technical solution of the present invention still fall within the protection scope of the present invention.

Claims

1. An intelligent contract vulnerability detection and location method based on anchor points with multiple spatial scales, characterized in that, The method specifically includes the following steps: Step 1: Output a control flow graph according to the bytecode of the smart contract. The control flow graph includes block nodes and control flow edges, and each block node contains a set of instructions. Among them, the set of block nodes \(V = \{v_1, v_2, \ldots, v\) n}\), \(v\) i is the \(i\)-th block node, \(i = 1, 2, \ldots, n\), where \(n\) represents the total number of block nodes; the set of control flow edges \(E=\{e\) ij , \(i\neq j\}\), \(e\) ij represents the edge from block node \(v\) i to block node \(v\) j . Step 2: Use an anchor feature generator to generate a semantic feature matrix for each anchor chain in the control flow graph. Step 3: Use a feature extractor to process the semantic feature matrices of each anchor chain, and then use the processing results as the input of the vulnerability detector. The vulnerability detector outputs the vulnerability detection results for each anchor chain. Step 4: Use a multi-anchor detector to process the features of the anchor chains with vulnerabilities to obtain the vulnerability location results of the anchors in each anchor chain. Step 5: Use the vulnerability detector and the multi-anchor detector to process the vulnerable anchors to obtain the vulnerability location results at the instruction level.

2. The intelligent contract vulnerability detection and localization method based on anchor multi - spatial scales according to claim 1, characterized in that, The output of the control flow graph according to the bytecode of the smart contract is specifically as follows: Disassemble the bytecode of the smart contract into opcodes and output the opcodes as a control flow graph.

3. The intelligent contract vulnerability detection and location method based on multi - spatial - scale of anchor points according to claim 1, characterized in that, The specific process of Step 2 is as follows: Step 2-1: In the control flow graph, take each branch from the root node to the leaf node as an instance, and encode each node in each instance to obtain the semantic feature matrix of each node. Step 2-2: Output multiple anchor chains for each instance, and obtain the semantic feature matrix of each anchor chain according to the encoding results of Step 2-1.

4. The intelligent contract vulnerability detection and location method based on anchor multi - spatial scales according to claim 3, wherein, The Asm2vec method is used to encode each node in each instance.

5. The intelligent contract vulnerability detection and localization method based on multi-spatial scale of anchor points according to claim 3, characterized in that, The specific process of Step 2-2 is as follows: Take any one instance as an example (1) If the i-th node M i is the first node on the current instance, then M i and the node M j form an anchor chain, where j = 2, 3, …, min(2n + 1, N), and N represents the total number of nodes on the current instance; Node M i ,M i+1 ,…,M min(2n+1,N) The semantic feature matrices of form the feature matrix X of the anchor chain i ={x i ,x i+1 ,…,x min(2n+1,N)}; where: x i , x i+1 , …, x min(2n+1,N) are the semantic feature matrices of nodes M i , M i+1 , …, M min(2n+1,N) respectively; (2) If the i-th node M i is the last node on the current instance, then nodes M j and M i form an anchor chain, where j = max(1, N - 2n), max(1, N - 2n) + 1, …, N - 1; Node M max(1,N-2n) ,M max(1,N-2n)+1 ,…,M N The semantic feature matrices of form the feature matrix X of the anchor chain i ={x max(1,N-2n) ,x max(1,N-2n)+1 ,…,x N}; where: x max(1,N-2n) , x max(1,N-2n)+1 , …, x N are the semantic feature matrices of nodes M max(1,N-2n) , M max(1,N-2n)+1 , …, M N respectively; (3) If the i-th node M i is neither the first node nor the last node on the current instance, then the node M max(1,i-n) , M max(1,i-n)+1 , …, M i-1 , M i , M i+1 , …, M min(i+n,N) form an anchor chain; Node M max(1,i-n) ,M max(1,i-n)+1 ,…,M i-1 ,M i ,M i+1 ,…,M min(i+n,n) The semantic feature matrices of form the feature matrix X of the anchor chain i ={x max(1,i-n) ,x max(1,i-n)+1 ,…,x i-1 ,x i ,x i+1 ,…,x min(i+n,N)}; Among them: x max(1,i-n) , x max(1,i-n)+1 , …, x i-1 , x i , x i+1 , …, x min(i+n,N) are respectively the semantic feature matrices of nodes M max(1,i-n) , M max(1,i-n)+1 , …, M i-1 , M i , M i+1 , …, M min(i+n,N) .

6. The intelligent contract vulnerability detection and localization method based on multi-spatial scales of anchor points according to claim 5, wherein The specific process of using the feature extractor to process the semantic feature matrices of each anchor chain is as follows: Take the semantic feature matrices of each anchor chain in the q-th instance as the q-th row sub-matrix of the feature matrix D, where q = 1, 2,..., Q. Then, use the semantic feature matrices of each anchor chain on all instances to form the overall semantic feature matrix D: Among them, X 1,1 represents the sub-matrix at the 1st row and 1st column in the semantic feature matrix D; X Q,1 represents the sub-matrix at the Q-th row and the 1st column in the semantic feature matrix D; X 1,P represents the sub-matrix in the first row and the P-th column of the semantic feature matrix D; X Q,P represents the sub-matrix at the P-th column and Q-th row in the semantic feature matrix D; Q represents the total number of instances; Perform a two-dimensional convolution operation on the semantic feature matrix D to generate a local feature matrix Y; the sub-matrix Y at the q-th row and p-th column in the local feature matrix Y q,p is as follows: Among them, X q,p (i'+l, j'+k) represents the element in the i'+l-th row and j'+k-th column of the sub-matrix X q,p in; Y q,p (i', j') represents the element at the i'-th row and j'-th column of the sub-matrix Y q,p in; W(l,k) is the weight of the convolutional kernel; l represents the horizontal size of the convolutional kernel; k represents the vertical size of the convolutional kernel; b is the bias term; Then, pass the local feature matrix Y through the ReLU activation function, perform batch normalization on the output of the ReLU activation function, and perform average pooling operation on the batch normalization result to obtain the average pooling operation result Z.

7. The intelligent contract vulnerability detection and location method based on multi-spatial scales of anchor points according to claim 6, characterized in that, The working process of the vulnerability detector is as follows: Map Z to the space of query Q, key K, and value V: Q = ZW q , K = ZW k , V = ZW v Among them, W q , W k and W v represent weight matrices; Use the softmax function to calculate the attention weights Attention Weights: where d k is the dimension of the key; The superscript T represents the transpose of the matrix; And calculate the global feature F according to the attention weights G : F G = Attention Weights * V where * represents multiplication; Then, the global feature F G passes through a fully-connected layer, and the output of the fully-connected layer is denoted as F'. G ; Take the corresponding value of each anchor chain in F' G as the input of the Sigmoid activation function layer respectively, and output the probability of a vulnerability existing in each anchor chain through the Sigmoid activation function layer; Then, judge whether there is a vulnerability in each anchor chain according to the obtained probability: that is, for any anchor chain, if the probability that the Sigmoid activation function layer outputs that there is a vulnerability in the anchor chain is greater than the threshold, it is considered that there is a vulnerability in the anchor chain; otherwise, it is considered that there is no vulnerability in the anchor chain.

8. The intelligent contract vulnerability detection and localization method based on anchor multi - spatial scales according to claim 7, characterized in that, The specific process of outputting the probability that there is a vulnerability in each anchor chain through the Sigmoid activation function layer is as follows: where z' represents the corresponding value of an anchor chain in F' G ; e represents the base of the natural logarithm; σ(z') represents the probability that there is a vulnerability in the anchor chain.

9. The method for detecting and locating vulnerabilities of smart contracts based on multi - spatial scales of anchor points according to claim 8, characterized in that, The specific process of Step 4 is as follows: Extract the features of each anchor chain with vulnerabilities from the average pooling operation result Z, and splice the features of each extracted anchor chain to obtain the splicing result X; Perform feature concatenation on the splicing result X and the global feature F G to obtain the concatenated result Feature: Among them, represents a splicing operation; Input the spliced feature Feature into a multi-layer perceptron for non-linear feature transformation. The working process of the multi-layer perceptron is expressed as: MLP(f) = W2 * ReLU(W1 * Feature + b1) + b2 where MLP(f) represents the output of the multi-layer perceptron; W1 and W2 represent weights; b1 and b2 represent biases; Then, pass the output of the multi-layer perceptron through the Sigmoid activation function. The probability of a vulnerability existing at each anchor point is output through the Sigmoid activation function. For any anchor point, if the probability of a vulnerability existing at the anchor point is greater than the threshold, it is considered that the anchor point has a vulnerability; otherwise, it is considered that the anchor point does not have a vulnerability.

Images