Intelligent contract guiding fuzzy testing method based on suspicious target relevance

Abstract

The invention discloses an intelligent contract guiding fuzzy testing method based on suspicious target relevance. The method comprises the following steps: a suspicious target identification stage: obtaining to-be-tested program compilation, analyzing an intelligent contract, constructing a suspicious vulnerability path of a suspicious node, and calculating a basic block distance from a seed execution path of a suspicious algorithm to a known suspicious node; in the correlation analysis stage, the data dependency relationship between the function sequence of the seed and the suspicious function is analyzed, and correlation labels of the state variable and the function input parameter with the suspicious target are marked for the seed. And a guide fuzzy test stage: generating a new seed by adopting a suspicious target guide evolutionary algorithm, executing the new seed in the Ethereum virtual machine, and detecting vulnerabilities. According to the method, state variables and function input parameters closely related to vulnerability execution can be accurately identified, the efficiency of generating seeds approaching suspicious target codes is remarkably improved, and waste of test resources in a benign code area is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection for Ethereum smart contracts, and in particular to a smart contract-oriented fuzz testing method based on suspicious target correlation. Background Art

[0002] Fuzz testing is one of the most successful automated techniques for verifying software functionality and discovering security vulnerabilities. It discovers potential vulnerabilities or errors by randomly inputting invalid, unexpected, or anomalous data into the system. Since 2018, fuzz testing has been widely used in smart contract vulnerability detection. One approach is coverage-feedback fuzz testing, which attempts to cover as many branches of the target program as possible to achieve comprehensive testing of the target. However, since vulnerable code accounts for a relatively low proportion of the program under test, and coverage-feedback algorithms treat all reachable branches equally, a large amount of testing resources is invested in benign code areas, making it difficult to effectively trigger vulnerabilities.

[0003] Guided fuzz testing pre-identifies suspicious code targets in the program and uses execution feedback information such as distance to generate test cases that reach the target area. Currently, there are many smart contract-guided fuzz testing tools, such as Vulseye and Beak, which focus on vulnerable code snippets and use basic block distance as a seed selection indicator for genetic algorithms. They have achieved good results, but they still have some problems.

[0004] Variables closely related to vulnerability detection in smart contracts include state variables and function input parameters, which are affected by the function execution sequence and function input data, respectively. Existing tools achieve this through the crossover and mutation phases of genetic algorithms, generating new seeds for different execution sequences and inputs. Although existing guided fuzzing methods incorporate guidance into the selection phase of genetic algorithms, the crossover and mutation processes for generating new seeds still rely on coverage-feedback fuzzing methods. For example, tools such as Confuzzius exploit the read-after-write (RAW) data dependencies between state variables in seeds to cross-seed function sequences and use symbolic solution to obtain function input data for seed mutation. These methods essentially randomly explore variables in the contract, leading to random branching, and are unable to determine whether the explored variables are relevant to the execution of the suspicious target.

[0005] In summary, guided fuzz testing of smart contracts does not introduce a guiding strategy in the seed generation process, which makes it difficult to generate new seeds that are close to the target code, thus limiting the efficiency of fuzz testing. Summary of the Invention

[0006] This paper addresses the problem of existing seed generation methods for guided fuzz testing lacking a guiding strategy and proposes a smart contract-guided fuzz testing method based on the association of suspicious targets. Unlike traditional random crossover and mutation methods that rely on RAW relationships, by introducing correlation analysis between seeds and suspicious targets, this method can accurately identify state variables and function inputs closely related to vulnerability execution, providing a clear guiding strategy for the crossover and mutation phases, thereby significantly improving the efficiency of generating seeds that approximate suspicious target code and reducing the waste of testing resources in benign code areas.

[0007] The proposed smart contract-guided fuzz testing method based on suspicious target relevance consists of three main phases: suspicious target identification, relevance analysis, and guided fuzz testing. In the suspicious target identification phase, the Slither static analysis tool is used to compile the smart contract, obtaining compilation information including the control flow graph (CFG). Pattern matching is then used to locate suspicious nodes in the CFG, along with corresponding suspicious functions and suspected vulnerability paths. In the relevance analysis phase, the basic block distance between the seed and the suspicious code is first calculated to guide the genetic algorithm selection phase. Then, a suspicious target-based relevance analysis method is used to add state variable relevance labels and function input parameter relevance labels to the seed through data dependency analysis and directed constraint solving, respectively. This is used to guide the crossover and mutation phases of the genetic algorithm. In the guided fuzz testing phase, the basic block distance is used to calculate the seed fitness as the basis for selection. Based on the different values of the seed's state variable relevance labels and function input parameter relevance labels, adapted guided crossover and guided mutation schemes are used to implement a complete guided fuzzing cycle.

[0008] The present invention provides a smart contract-oriented fuzz testing method based on suspicious target relevance, which includes the following stages:

[0009] Suspicious target identification phase: First, obtain the program to be tested, use the Slither static analysis tool to compile and analyze the smart contract, and obtain the smart contract's mapping diagram (source_map), control flow graph CFG, application binary interface (ABI), and state variable dictionary read and written by functions;

[0010] Then, according to the predefined opcode rules, the suspicious nodes are matched in the control flow graph, and the opcodes and program counters (PC) of the suspicious nodes are mapped to the source code according to source_map to confirm the suspicious function that executes the suspicious node. Starting from the suspicious node, the suspicious vulnerability path that reaches the suspicious node is reverse constructed on the CFG.

[0011] Finally, the initial population is initialized and the seeds in the population are executed to obtain the execution path of the seeds. Based on the distance calculation method of the cross node, the basic block distance between the seed execution path and the known suspicious nodes is calculated;

[0012] Correlation analysis phase: First, the data dependency relationship between the function sequence of each seed and the suspicious function is analyzed. Based on whether there is a containment relationship or a RAW data dependency relationship, the corresponding state variable of the seed is labeled with a correlation label with the suspicious target;

[0013] Then, the execution path of each seed is solved with directed symbols, and the corresponding function entry of the seed is marked with a relevance label for the suspicious target based on whether there is solution data.

[0014] Guided fuzz testing phase: The guided fuzz testing phase uses a suspicious goal-oriented evolutionary algorithm to generate new seeds, execute the new seeds in the Ethereum Virtual Machine (EVM), and detect vulnerabilities.

[0015] First, the fitness of seeds is calculated based on the basic block distance, and excellent seeds are selected;

[0016] Then, based on the correlation between the state variables of the selected seed and the suspicious target, it is determined whether the seed's function sequence crosses and different crossover methods are used; based on the correlation between the seed's function input and the suspicious target, it is determined whether the seed's function input mutates and different mutation methods are used to obtain a new seed.

[0017] Finally, the EVM executes the generated new seed and analyzes the result of the execution to confirm whether the vulnerability is triggered.

[0018] Preferably, the specific process of the suspicious target identification stage includes the following steps:

[0019] 1-1. Obtain the program to be tested, which is a smart contract code written in Solidity.

[0020] 1-2. Use the static analysis tool Slither to compile the program under test and obtain compilation information including static opcodes, opcode and source code statement mapping table source_map, application binary interface ABI, abstract syntax tree AST, control flow graph CFG, and function write and read state variable set;

[0021] 1-3. Traverse the opcodes in all nodes on the control flow graph (CFG) and match them against the predefined opcode rules for vulnerabilities. If a node contains at least one vulnerable opcode, define it as a suspicious node.

[0022] The predefined opcode rules for the vulnerabilities described above represent the opcode specifications corresponding to common vulnerabilities in smart contracts. These specifications are derived from vulnerability detection tools Oyente and Mythril.

[0023] 1-4. Use source_map from 1-2 to map the opcode of the suspicious node to the source code to identify the suspicious function that executes the suspicious node and record the name in the suspicious function list Fsus;

[0024] 1-5. Starting from the suspicious node, reverse engineer the suspected vulnerability path on the CFG that can lead to the suspicious node and record it in the suspected vulnerability path list.

[0025] 1-6. Initialize the population population based on genetic algorithm population={seed1,seed2,…,seed m}, each seed i Execute a function sequence. Execute the function sequence of the seed in the population to obtain the corresponding execution path;

[0026] 1-7. For each seed execution path, traverse the list of suspected vulnerability paths. For each suspected vulnerability path, start from the suspicious node (i.e., the end node of the suspected vulnerability path) and traverse backwards to find the closest node that is both on the seed execution path and the suspected vulnerability path. This node is recorded as the intersection node of the seed execution path and the suspected vulnerability path.

[0027] 1-8. Calculate the number of edges from the intersection node to the suspicious node and record this as the basic block distance between the seed execution path and the suspected vulnerability path. If there is no intersection node between the seed and the suspicious node, set the basic block distance to -1.

[0028] 1-9. For each seed execution path, calculate the harmonic mean of its basic block distances to all suspicious nodes as the comprehensive distance of the seed. If the basic block distance between the seed and a suspicious node is -1, the data is not included in the calculation of the harmonic mean.

[0029] Preferably, the correlation analysis stage can be specifically divided into the following two stages: a state variable correlation analysis stage and a function input parameter correlation analysis stage.

[0030] 2-1. The state variable correlation analysis phase includes the following steps:

[0031] Define the seed's state variable correlation label (SV), which indicates whether the state variables read or written by the seed's function sequence affect the execution of the suspicious target. The specific values and meanings of the label are shown in Table 1 below:

[0032] Table 1: State variable association label values and meanings

[0033]

[0034] 2-1-1. Initialize the state variable association labels of all seeds in the population to -1;

[0035] 2-1-2. Traverse each seed i The name set F of the executed functions i , matches with the suspicious function list Fsus1 to determine whether it contains suspicious functions. i If a suspicious function is included, the state variable correlation label of the seed is set to 1, indicating that there is a strong correlation, and the state variable correlation analysis phase of the seed is ended;

[0036] 2-1-3. If F i If no suspicious functions are included, RAW data dependency analysis is performed. Traverse the state variable set read and written by the functions executed by the seed and the functions obtained in the suspicious target identification phase to obtain the state variable R read and written by the seed. i and W i ; Traverse the suspicious function list Fsus1 obtained in the suspicious target identification phase and the state variable set read and written by the function to obtain the state variables R read and written by all suspicious functions sus and W sus ; Take the intersection of the above seed and the state variable set between the read and write operations of the suspicious function. If the intersection is not empty, set the state variable association label of the seed to 0, indicating that there is some association, and end the seed. i State variable correlation analysis stage;

[0037] 2-1-4. If the intersection is empty, it means there is no association. Do not modify the state variable association label and end the seed. i State variable correlation analysis stage;

[0038] 2-1-5. Repeat steps 2-1-1 to 2-1-4 for all seeds in the population, configuring the state variable association label for each seed.

[0039] 2-2. The function input parameter relevance analysis phase specifically includes the following steps

[0040] Define the seed's function parameter correlation label (FP), which indicates whether the parameters input to the seed's function sequence affect the execution of the suspicious target. The specific values and meanings of the label are shown in Table 2 below:

[0041] Table 2: Function input parameter relevance label values and meanings

[0042]

[0043] 2-2-1. Initialize a mutation pool to store mutation values solved by symbolic taint analysis; the mutation pool supports the reuse of previously solved legal values during the mutation phase of the genetic algorithm;

[0044] 2-2-2. For each seed's execution path, traverse the list of suspected vulnerability paths. For each suspected vulnerability path, start from the suspicious node, i.e., the end node of the suspected vulnerability path, and traverse backwards to find the nearest node that is both on the seed's execution path and the suspected vulnerability path. This node is recorded as the intersection node of the seed's execution path and the suspected vulnerability path. If no intersection node is found, set the seed's function input relevance label to 0, indicating that the path cannot be redirected to the suspected vulnerability path by adjusting the input parameters, and terminate the function input relevance analysis phase for the seed.

[0045] 2-2-3. Perform symbolic taint analysis on the seed execution path, identify opcodes related to data transfer, and inject taints into these opcodes. Track the propagation of the taint across the stack, memory, and storage, recording the symbolic expressions that affect the intersection node conditions until the opcode block corresponding to the intersection node is reached.

[0046] 2-2-4. Based on the symbolic taint analysis results, the constraints at the intersection nodes are extracted. To guide the seed execution path toward the suspected vulnerability path, the inequalities in the constraints are negated to generate a new constraint set.

[0047] 2-2-5. Input the new constraint set into the symbolic solver. If the solution is successful, a non-empty set of function input parameters, i.e., mutation values, is generated. This set is stored in the mutation pool for subsequent seed mutations, and the function input parameter relevance flag is set to 1.

[0048] 2-2-6. Repeat steps 2-2-1 to 2-2-5 for all seeds in the population to generate function input data and corresponding function input relevance labels for each seed.

[0049] Preferably, the guided fuzzy testing stage can be specifically divided into the following three stages: a guided selection stage, a guided intersection stage, and a guided mutation stage.

[0050] 3-1. The guidance selection phase includes the following steps:

[0051] 3-1-1. Each seed calculated according to the suspicious target identification stage i The inverse of the comprehensive distance calculation is used as the distance weight w i;

[0052] 3-1-2. Sort all seeds by comprehensive distance from smallest to largest, set a threshold of 0.9 to compare the comprehensive distance difference between adjacent seeds. If the comprehensive distance difference between adjacent seeds is less than this threshold, they are grouped into the same subgroup P, otherwise a new subgroup is started; calculate each subgroup P k The reciprocal of the median of the comprehensive distance of the seeds is recorded as the weight W of the subgroup pk ;

[0053] 3-1-3. Each seed i According to the weight W of the subgroup pk The distance weight w from the seed itself i , calculate the fitness of each seed i ;

[0054] 3-1-4. Normalize the fitness of all seeds to ensure that the sum of fitness is 1;

[0055] 3-1-5. Based on the normalized fitness, the first seed is selected using the roulette wheel method first ;

[0056] 3-1-6. Prioritization and seed first For seeds with RAW data dependencies, traverse the other seeds in the population and take the intersection with the state variable set of the first seed between read and write operations. If the intersection is not empty, select the currently traversed seed as the second seed. second ; If the intersection is empty, use the 3-1-5 roulette method to select the seed again second ;

[0057] 3-1-7. The selected seed pairs enter the guided crossover phase.

[0058] 3-2. The guided crossover phase includes the following steps:

[0059] 3-2-1. Check the state variable association label values of the seed pair and take the maximum value as the strongest state variable association SV max ;

[0060] 3-2-2. Intersect the state variable sets of the seed pair between the read and write operations. If the intersection is not empty, it indicates that there is a RAW data dependency in the seed pair;

[0061] 3-2-3. If SV max=1, and there is a RAW data dependency in the seed pair, their function execution sequences are combined in the order of write first and read later to generate a new seed, and the corresponding state variable association label is set to 1; if SV max= 0, and there is a RAW data dependency in the seed pair, their function execution sequences are combined in the order of write first and read later to generate a new seed, and the corresponding state variable association label is set to 0; if SV max= -1, no operation is performed;

[0062] 3-2-4. If a crossover operation is performed, the combined distance of the new seed is set to the minimum of the combined distances of the two seeds before the crossover, and the guided mutation phase is entered. If a crossover operation is not performed, the guided mutation phase is skipped.

[0063] 3-3. The guided mutation stage includes the following steps:

[0064] 3-3-1. Check the relevance label values of the state variables and function input parameters of the new seed;

[0065] 3-3-2. If both the state variable relevance label and the function input parameter relevance label are 1, perform deterministic mutation and set the function input parameter value to the corresponding data in the mutation pool. If the state variable relevance label is 1 and the function input parameter relevance is 0, generate a random value based on the function input parameter type. If both the state variable relevance label and the function input parameter relevance label are 0, generate a random value based on the function input parameter type. If the state variable relevance label is -1, skip the guided mutation phase.

[0066] The present invention has the following characteristics and beneficial effects:

[0067] (1) The present invention introduces a correlation analysis method based on suspicious targets in the correlation analysis stage, analyzing the correlation strength between the state variables that the seed can explore and the function inputs that participate in the execution of the suspicious targets, so that the fuzzifier can perceive the suspicious targets in the crossover and mutation stages of the genetic algorithm;

[0068] (2) The present invention proposes a suspicious target-oriented evolutionary algorithm. First, the fitness of the seed is calculated based on the basic block distance to guide the seed selection. Then, according to the different values of the association label, an adaptive guided crossover and guided mutation strategy is provided for the seed to generate a new seed close to the suspicious target. The present invention can accurately identify the state variables and function input parameters that are closely related to the vulnerability execution, and provide a clear guidance strategy for the crossover and mutation stages, thereby significantly improving the efficiency of generating seeds close to the suspicious target code and reducing the waste of test resources in the benign code area. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1This is an overall flow chart of the smart contract-oriented fuzz testing method for suspicious target relevance of the present invention;

[0070] Figure 2 Flowchart of the correlation analysis phase of the smart contract-guided fuzz testing method for suspicious target correlation of the present invention. DETAILED DESCRIPTION

[0071] The present invention is described in detail below in conjunction with specific embodiments. The following examples will help those skilled in the art to further understand the invention, but are not intended to limit the present invention in any form. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0072] like Figure 1 As shown in FIG, the smart contract guided fuzz testing method based on suspicious target correlation includes a suspicious target identification stage, a correlation analysis stage, and a guided fuzz testing stage, wherein:

[0073] During the suspicious target identification phase, the program under test is first obtained. The Slither static analysis tool is used to compile and analyze the smart contract to obtain the smart contract's source_map, control flow graph (CFG), application binary interface (ABI), and the state variable dictionary for function reads and writes. Then, according to predefined opcode rules, suspicious nodes are matched in the control flow graph. The opcode and PC of the suspicious node are mapped to the source code based on the source_map to confirm the suspicious function executing the suspicious node. Subsequently, starting from the suspicious node, the suspicious vulnerability path leading to the suspicious node is reverse-engineered on the CFG.

[0074] like Figure 2 As shown, in the correlation analysis phase, the initial population is initialized and the seeds in the population are executed to obtain the seed execution path. First, a cross-node-based distance calculation method is used to calculate the basic block distance between the seed execution path and the known suspicious nodes. Then, the data dependency relationship between each seed's function sequence and the suspicious function is analyzed, and the corresponding state variable and suspicious target correlation label is set for the seed. Finally, the execution path of each seed is solved symbolically, and the seed is marked with the correlation label of the set state variable and suspicious target based on whether the solution data exists.

[0075] During the guided fuzz testing phase, a suspicious target-guided evolutionary algorithm is used to generate new seeds. First, the seed's fitness is calculated based on basic block distance to guide seed selection. Then, based on the correlation between the seed's state variables and the suspicious target, the algorithm determines whether to cross the seed's function sequence and the different crossover methods to use. Finally, based on the correlation between the seed's function inputs and the suspicious target, the algorithm determines whether to mutate the seed's function inputs and the different mutation methods to use.

[0076] I. The suspicious target identification stage of the present invention specifically includes the following steps:

[0077] 1-1. Obtain the program to be tested, which is a smart contract code written in Solidity;

[0078] 1-2. Use the static analysis tool Slither to compile the program under test and obtain compilation information including static opcodes, opcode and source code statement mapping table source_map, application binary interface ABI, abstract syntax tree AST, control flow graph CFG, and function write and read state variable set;

[0079] 1-3. Traverse the opcodes in all nodes on the control flow graph and match them with the predefined opcode rules. When one or more characteristic opcodes are included in the rules, mark it as a suspicious node and store the starting program counter value of the node in the suspicious node list vulNode = [vulNode1,…, vulNode n ], n is the total number of suspicious nodes;

[0080] 1-4. Use source_map from 1-2 to map the opcode of the suspicious node to the corresponding source code line number and character offset. Then, analyze the abstract syntax tree (AST), traverse the FunctionDefinition type nodes in the AST, and check the start and length attributes in the source code range src attribute of each node. If the character offset of the statement falls within the range of a FunctionDefinition type node, that is, start ≤ offset < start + length, the function corresponding to the node is suspicious. Extract its function name and record it as the suspicious function.

[0081] 1-5. Starting from the suspicious node, reverse construct the suspicious vulnerability path that can be executed to the suspicious node on the CFG. First, take the suspicious node as the current node and check the predecessor node of the current node. If there is no jump instruction JUMP and JUMPI, then add the suspicious vulnerability path and use it as the current node; if it exists, analyze whether the jump target address of its jump instruction matches the program counter pc value of the current node. If it matches, then add the predecessor node to the suspicious vulnerability path and recursively trace its predecessor node until the root node of the control flow graph is reached. All identified complete suspicious vulnerability paths are stored in the suspicious vulnerability path list V=[vulPath1,vulPath2,…,vulPath n ], n represents the total number of suspected vulnerability paths identified.

[0082] 1-6. Initialize the population based on the genetic algorithm, denoted as population={seed1,seed2,…,seed m}, where seed represents a seed, which consists of a sequence of executable functions, and m represents the total number of seeds in the population. For each seed in the population i , execute the function sequence it contains and generate the corresponding execution path list, recorded as seedPath=[seedPath1,…,seedPath i ];

[0083] 1-7. For each seed execution path seedPath i , traverse the suspicious vulnerability path list V=[vulPath1,vulPath2,…,vulPath n ], where each vulPath j Take the suspicious node vulNode j For the terminal node, follow the steps below to find the intersection node: From vulNode j Start by following the vulPath j Traverse the nodes in reverse order, check the opcode sequence of each node, identify the nodes containing jump instructions (JUMP or JUMPI), and record them as candidate branch nodes. From the candidate branch nodes, find the first one that appears in the seedPath at the same time i The node on the crossNode is called crossNode i ;

[0084] 1-8. For each seed i and suspicious nodes vulNode j If there is a cross node, calculate the basic block distance of the seed dst(seedi, vulNodej)=d(crossNodej , vulNode j ), where d() represents the i to vulNode j The number of edges on the control flow graph. If there is no cross node, the basic block distance dst(seed i ,vulNode j ) is set to -1;

[0085] 1-9. For each seed seedi, collect its connections with all suspicious nodes {vulNode1, vulNode2,…, vulNode n}Path distance { Calculate the harmonic mean of all path distances as the seed i The comprehensive distance , where the path distance with a value of -1 is not included in the calculation. The formula is as follows:

[0086]

[0087] II. The correlation analysis phase of the present invention specifically includes the following steps: a state variable correlation analysis phase and a function input parameter correlation analysis phase.

[0088] 2-1. The state variable correlation analysis phase includes the following steps:

[0089] 2-1-1. For each seed in the population i , label its state variable association SV i Initialized to -1, indicating no association by default;

[0090] 2-1-2. For each seed i , get the function name list F it executes i ={f i1 ,f i2 ,…,f ik}, where f ik The name of the kth function to execute for the seed. i Match with the suspicious function list Fsus1 obtained in step 1-4: If F i Contains at least one suspicious function, then set SV i =1, and end the SV tag analysis of the seed and jump to the next seed;

[0091] 2-1-3. If F i If no suspicious functions are included, perform RAW data dependency analysis. Extract the seedi List of executed function names F i Corresponding read-write state variable R i and W i ; Extract the read-write status variable R of the suspicious function list Fsus1 sus and W sus , calculate the intersection of state variables between read and write operations: I1=R i ∩W sus and I2=W i ∩R sus If I1∪I2≠∅, that is, there is RAW data dependency, then set Svi=0, end the SV label analysis of the seed, and jump to the next seed;

[0092] 2-1-4. If the intersection I1∪I2=∅, then the seed i If there is no RAW data dependency on any suspicious function, keep SV i =−1, indicating no correlation, ending the SV tag analysis of this seed and jumping to the next seed;

[0093] 2-1-5. Repeat steps 2-1-1 to 2-1-4 for all seeds in the population, configuring the state variable association label for each seed.

[0094] 2-2. Function input parameter correlation analysis phase includes the following steps:

[0095] 2-2-1. Initialize the mutation pool M pool , used to store mutation values solved by symbolic taint analysis; the mutation pool supports the reuse of previously solved legal values in the mutation phase of the genetic algorithm;

[0096] 2-2-2. For each seed in the population i , traverse its execution path seedPath i And the list of suspected vulnerability paths V={vulPath1,vulPath2,…,vulPath n}, use the same method as step 2-1-2 to identify the cross node crossNode ij If no intersection node is found, set the seed function input parameter relevance label FP i =0, indicating that the path cannot be redirected to the suspected vulnerability path by adjusting the input parameters, and the FP label analysis of the seed is terminated;

[0097] 2-2-3. Perform symbolic taint analysis on the seed execution path, identify opcodes related to data transfer (such as CALLDATALOAD and CALLVALUE), and inject taints into these opcodes. Track the propagation of the taint across the stack, memory, and storage, recording the symbolic expressions that affect the intersection node conditions until the opcode block corresponding to the intersection node is reached.

[0098] 2-2-4. Extract crossNode based on symbol taint analysis results ij The conditional constraint C={c1,c2,…} that controls the execution direction is used to guide the seedPath i Turning to vulPath j , negate the inequalities in the constraints and generate a new constraint set C′={¬c1,¬c2,…};

[0099] 2-2-5. Input the inverted constraint set C' into the symbolic solver for solution. If the solution is successful, a non-empty function input parameter set solutionSet is generated. ij , which means that the seed i In crossNode ij Then turn to vulPath j . SolutionSet ij Store in mutation pool M pool , and set FP i =1, indicating that the directional constraint is solved successfully;

[0100] 2-2-6. Repeat steps 2-2-1 to 2-2-5 for all seeds in the population to generate the function input data and corresponding FP label (1 or 0) for each seed.

[0101] III. The guided fuzzy testing phase of the present invention specifically includes the following steps: a guided selection phase, a guided intersection phase, and a guided mutation phase.

[0102] 3-1. The guidance selection phase includes the following steps:

[0103] 3-1-1. For population population={seed1,seed2,…,seed n Each seed in} i , the comprehensive distance calculated according to steps 1-9 , calculate the distance weight , the formula is as follows:

[0104]

[0105] in Used to avoid denominator being zero;

[0106] 3-1-2. Based on comprehensive distance i Perform weighted clustering, divide subgroups and assign weights. The steps are as follows: divide the seeds in the population by the comprehensive distance i Sort from small to large to get the ordered sequence {seed'1,seed'2,…,seed' m}, and its corresponding comprehensive distance is {distance'1,distance'2,…,distance' m}, where distance' i ≤distance' i+1 Calculate the comprehensive distance difference δ between adjacent seeds i =|distance' i+1 −distance' i |Set threshold τ=0.9. If δ i <τ, seed' i and seed' i+1 Assign to the same subgroup; otherwise, i+1 Start a new subgroup. Get the subgroup set P, for each subgroup P k , calculate the median of its comprehensive distance , and calculate the subgroup weight W Pk , the formula is as follows:

[0107]

[0108] 3-1-3. For each seed i , combined with its distance weight and the weight of the subgroup , calculate fitness i , the formula is as follows:

[0109]

[0110] 3-1-4. Normalize fitness to selection probability using the following formula to ensure that the sum of the selection probabilities of all seeds is equal to 1;

[0111]

[0112] 3-1-5. Use the roulette wheel method to select the first seed: Generate a random number r∈[0,1), calculate the cumulative probability interval, and find a seed that satisfies the following inequality as the first seed first ;

[0113] 3-1-6. Extract the first seed based on the state variable set read and written by the function obtained in 1-1 first The state variable sets R1 and W1 read and written by the executed function; for other seeds in the population j (j≠first), also extract the state variable set R read and written by its function j and W js , calculate the intersection of state variables between read and write operations: I1=R1∩W j and I2=W1∩R j , if I1∪I2≠∅, then select the current seed seed j As the second seed second , and end the selection; if I1∪I2=∅, then use the roulette wheel method to select the second seed seed second ;

[0114] 3-1-7. Selected seeds first and seed second Enter the guided cross stage.

[0115] 3-2. The guided crossover phase includes the following steps:

[0116] 3-2-1. Check the seed pair first and seed second The state variable association label value is taken, and the maximum value SV is taken max It is recorded as the strongest state variable correlation;

[0117] 3-2-2. Using the same method as in step 3-1-6, intersect the state variable sets of the two seeds between the read and write operations. If the intersection is not empty, it indicates that there is a RAW data dependency between the two seeds.

[0118] 3-2-3. If SV max If SV is 1 and there is a RAW data dependency between seeds, their function execution sequences are combined in the order of write first and read later to generate a new seed, and the corresponding state variable association label is set to 1; if SV max If SV is 0 and there is a RAW data dependency between seeds, their function execution sequences are combined in the order of write first and read later to generate a new seed, and the corresponding state variable association label is set to 0; if SV max If it is -1, no operation is performed;

[0119] 3-2-4. If a crossover operation is performed to generate a new seed new , the seed newThe comprehensive distance is set to the minimum distance of the comprehensive distance of the two seeds before crossing new =min (distance first , distance second ) and enter the guided mutation stage; if no crossover operation is performed, the guided mutation stage is skipped.

[0120] 3-3. The guided mutation phase includes the following steps:

[0121] 3-3-1. For the input seed, check the value of the state variable relevance label SV and the value of the function input parameter relevance label FP;

[0122] 3-3-2. If the state variable association label and the function input parameter association label are both 1, perform a deterministic mutation and set the function input parameter value to the mutation pool M pool ; if the state variable relevance label is 1 and the function input parameter relevance is 0, a random value is generated according to the variable type of the function input parameter; if the state variable relevance label and the function input parameter relevance label are both 0, a random value is generated according to the variable type of the function input parameter; if the state variable relevance label is -1, the guided mutation stage is skipped.

[0123] The above specific implementation methods are only used to further illustrate the present invention, and are not the only implementation methods of the present invention, and should not be understood as limiting the present invention.

[0124] To validate the effectiveness of our proposed method, three sets of experiments were conducted. Using our method, Ophiuzz was compared with leading smart contract fuzzers Confuzzius, Vulseye, and Ophiuzz variants, and evaluated on two datasets. The first dataset consisted of 430 smart contracts, collected from the blockchain explorer Etherscan and other datasets used by fuzzers. The second dataset consisted of 180 small smart contracts and 120 large smart contracts downloaded from the blockchain explorer Etherscan, according to the standards provided by Confuzzius.

[0125] The variant fuzzers include Ophiuzz-cov and Ophiuzz-cfz, which are designed to evaluate the contributions of various Ophiuzz components by disabling specific modules. Ophiuzz-cov removes the distance-guided selection method of the suspicious goal-guided evolutionary algorithm and adopts a coverage-guided method instead; Ophiuzz-cfz removes the guided crossover and guided mutation methods of the suspicious goal-guided evolutionary algorithm and adopts the traditional crossover and mutation method of Confuzzius instead.

[0126] Experimental results:

[0127] Experiment 1: On Dataset 1, Ophiuzz significantly outperformed other tools in detecting seven vulnerability types: reentrancy (RE), integer overflow (OF), assertion failure (AF), block dependency (BD), unprotected self-destruct (US), unhandled exception (UE), and unsafe delegate call (UD). In terms of true positive detection, Ophiuzz detected a total of 393 true positives, surpassing Confuzzius's 223 and Vulseye's 74. In terms of false negatives and false positives, Ophiuzz only produced 33 false negatives and 6 false positives, respectively, matching Confuzzius's but surpassing Vulseye's 136 false negatives. In terms of precision and recall, Ophiuzz achieved over 90% accuracy across all vulnerability types, reaching 98.5% overall, while its recall reached 92.4%, significantly outperforming Confuzzius's 52% and Vulseye's 35.2%.

[0128] Experiment 2: Ophiuzz demonstrated significant performance improvement over Vulseye and Confuzzius in terms of vulnerability detection time to exposure (TTE). In the TTE analysis of individual smart contracts in Dataset 1, Ophiuzz's average TTE was 5.65 seconds, lower than Vulseye's 8.03 seconds and Confuzzius's 9.01 seconds. Its median TTE was 5.66 seconds, close to the average, indicating a uniform and stable distribution of detection efficiency. In contrast, Vulseye's median TTE was 2.94 seconds, but its average was higher, indicating an uneven distribution of efficiency. Confuzzius had the highest average and median TTE, but the lowest efficiency. In the survival analysis of Dataset 2, Ophiuzz's survival curves were the lowest and smoothest for both the 180 small contracts and the 120 large contracts datasets, reflecting its higher efficiency and stability. Vulseye's curve showed a steep rise in the later stages, indicating instability, while Confuzzius's curve remained consistently high, indicating lower efficiency. The log-rank test further verifies the superiority of Ophiuzz: in small contracts, the p-value of Ophiuzz and Vulseye is 2.04×10⁻² 4 , and the p-value of Confuzzius is 2.06×10⁻ 68 , and in large contracts they are 5.34×10⁻¹³ and 0.0023 respectively, both significantly less than 0.05, indicating that Ophiuzz's TTE distribution is significantly better than other tools.

[0129] Experiment 3: On Dataset 1, Ophiuzz demonstrated the contribution of its components to vulnerability detection through ablation experiments, significantly outperforming its two variants, Ophiuzz-cov and Ophiuzz-cfz. In terms of the number of true positive (TP) detections across seven vulnerability types, Ophiuzz achieved the following performance: RE 166, IO 131, AF 29, BD 12, US 6, UE 49, and UD 11; while Ophiuzz-cov achieved 126, 118, 15, 2, 5, 43, and 8, respectively, and Ophiuzz-cfz achieved 105, 117, 15, 1, 5, 46, and 10. In contrast, Ophiuzz-cfz achieved only 63.3% and 8.3% of Ophiuzz's detection capabilities for RE and BD vulnerabilities, respectively, while Ophiuzz-cov achieved 75.9% and 16.7%, respectively, demonstrating a significant decline in the detection capabilities of both variants across multiple vulnerability types. In terms of the number of unique test cases (UTC), Ophiuzz generated about 70,000 UTCs after 500 seconds of testing, far exceeding the 40,000 of Ophiuzz-cfz and the 50,000 of Ophiuzz-cov. The gap widened significantly after 400 seconds.

[0130] Result analysis:

[0131] Experimental results validate the innovativeness and superiority of this method's guided fuzz testing approach based on suspicious target correlation. Compared to existing smart contract fuzz testing tools (the coverage-feedback fuzzer Confuzzius and the guided fuzzer Vulseye), as well as variant tools (Ophiuzz-cov and Ophiuzz-cfz), this method significantly improves vulnerability detection efficiency and accuracy through its core innovation of using correlation analysis to guide seed generation. In terms of detection results, Ophiuzz detected more vulnerabilities, thanks to the precise guidance of seed crossover and mutation by correlation labels, which focused testing resources on suspicious target code regions. In terms of time efficiency, Ophiuzz's average TTE was significantly lower than that of other tools, reflecting its ability to rapidly approximate suspicious targets through correlation analysis during seed generation. Ablation experiments further demonstrated the key role of correlation analysis in improving detection targeting.

[0132] The above results fully demonstrate that the present invention provides correlation labels to guide crossover and mutation strategies based on the correlation analysis method of suspicious targets. These labels analyze the correlation strength between the state variables and function inputs of seed exploration and the execution path of suspicious targets, enabling the fuzzifier to clearly perceive suspicious targets during the crossover and mutation phases of the genetic algorithm, thereby achieving more targeted seed generation. As the number of iterations of the above evolutionary algorithm increases, the distance between the generated new seeds and the execution path of the suspicious targets is significantly shortened. After multiple iterations, most of the identified suspicious targets can be used to detect vulnerabilities through actual execution, which improves the efficiency of vulnerability detection while reducing the consumption of resources in benign code areas outside of the suspicious targets.

[0133] The above illustrates and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely preferred examples of the present invention and are not intended to limit the present invention. Various modifications and improvements may be made to the present invention without departing from the spirit and scope of the present invention, and such modifications and improvements fall within the scope of the invention as claimed. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A smart contract-oriented fuzz testing method based on suspicious target correlation, characterized by: The following stages are included: Suspicious target identification phase: Obtain the compiled program under test and analyze the smart contract transmission, construct the suspicious vulnerability path of the suspicious node, and calculate the basic block distance between the execution path of the legacy algorithm seed and the known suspicious node; Correlation analysis phase: Analyze the data dependency between the seed's function sequence and the suspicious function, and label the seed's state variables and function input parameters with correlation labels for the suspicious target. Guided fuzz testing phase: A suspicious goal-oriented evolutionary algorithm is used to generate new seeds, which are then executed in the Ethereum Virtual Machine (EVM) to detect vulnerabilities.

2. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 1 is characterized in that: The specific implementation process of the suspicious target identification stage is as follows: S1.1, obtain the program to be tested, compile and analyze the smart contract using static analysis tools, and obtain the smart contract's mapping map source_map, control flow graph CFG, application binary interface, and state variable dictionary of function read and write; S1.2: Match suspicious nodes in the control flow graph according to predefined opcode rules, and map the opcode and program counter of the suspicious node to the source code according to source_map to confirm the suspicious function that executes the suspicious node. Starting from the suspicious node, reverse engineer the suspicious vulnerability path that reaches the suspicious node on the CFG. S1.3, initialize the initial population, and execute the seeds in the population to obtain the execution path of the seeds. Based on the cross-node distance calculation method, calculate the basic block distance between the seed execution path and the known suspicious node.

3. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 2 is characterized in that: The specific implementation process of step S1.2 is as follows: Traverse the opcodes in all nodes on the control flow graph CFG and match them with the predefined opcode rules of the vulnerability. If a node contains at least one vulnerability opcode, the node is defined as a suspicious node. Use source_map to map the opcode of the suspicious node to the source code to confirm the suspicious function that executes the suspicious node and record the name in the suspicious function list; Starting from the suspicious node, reverse engineering is performed on the CFG to construct a suspicious vulnerability path that can be executed to the suspicious node and record it in the suspicious vulnerability path list.

4. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 3 is characterized in that: The specific implementation process of step S1.3 is as follows: Initialize the population based on the genetic algorithm, execute a function sequence for each seed in the population, and execute the function sequence of the seeds in the population to obtain the corresponding execution path; For each seed execution path, traverse the list of suspected vulnerability paths. For each suspected vulnerability path, start from the suspicious node, that is, the end node of the suspected vulnerability path, and traverse backward to find the nearest node that is both on the seed execution path and the suspected vulnerability path. This node is recorded as the intersection node of the seed execution path and the suspected vulnerability path. Calculate the number of edges from the intersection node to the suspicious node, and record it as the basic block distance between the seed execution path and the suspected vulnerability path; if there is no intersection node between the seed and the suspicious node, set the basic block distance to -1; For each seed execution path, the harmonic mean of its basic block distances with all suspicious nodes is calculated as the comprehensive distance of the seed. If the basic block distance between the seed and a suspicious node is -1, the data is not included in the calculation of the harmonic mean.

5. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 3 is characterized in that: The specific implementation process of the correlation analysis stage is as follows: Analyze the data dependency between the function sequence of each seed and the suspicious function, and mark the corresponding state variable of the seed with a correlation label between the seed and the suspicious target based on whether there is a containment relationship or a RAW data dependency relationship; Solve the execution path of each seed with directed symbols, and mark the corresponding function of the seed with the association label of the suspicious target according to whether there is solution data.

6. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 5 is characterized in that: The specific process of labeling the association between the state variable corresponding to the seed mark and the suspicious target is as follows: Define the state variable relevance label SV of the seed, which indicates whether the state variables read or written by the seed's function sequence affect the execution of the suspicious target; Initialize the state variable relevance labels of all seeds in the population to -1; Traverse the name set F of the function executed by each seed i , match it with the suspicious function list to determine whether it contains suspicious functions; if F i If a suspicious function is included, the state variable correlation label of the seed is set to 1, indicating that there is a strong correlation, and the state variable correlation analysis phase of the seed is ended; if F i If it does not contain suspicious functions, then perform RAW data dependency analysis, traverse the state variable set read and written by the functions executed by the seed and the functions obtained in the suspicious target identification phase, and obtain the state variable R read and written by the seed. i and W i ; Traverse the list of suspicious functions and the state variable set read and written by the function obtained in the suspicious target identification phase, and obtain the state variable R read and written by all suspicious functions sus and W sus ; Take the intersection of the above seed and the state variable set between the read and write operations of the suspicious function. If the intersection is not empty, set the state variable association label of the seed to 0, indicating that there is some association, and end the seed. i The state variable correlation analysis phase of the seed is terminated; if the intersection is empty, it means there is no correlation, the state variable correlation label is not modified, and the state variable correlation analysis phase of the seed is terminated; A label is configured for each seed regarding the association between the state variable and the suspicious target.

7. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 6 is characterized in that: The function corresponding to the seed mark is specifically implemented as follows: Define the seed function input parameter relevance label FP, indicating whether the parameters input to the seed function sequence affect the execution of the suspicious target; Initialize the mutation pool to store the mutation values solved by symbolic taint analysis; For each seed's execution path, traverse the list of suspected vulnerability paths. For each suspected vulnerability path, start from the suspicious node, i.e., the end node of the suspected vulnerability path, and traverse backwards to find the nearest node that is both on the seed's execution path and the suspected vulnerability path. This node is recorded as the intersection node of the seed's execution path and the suspected vulnerability path. If no intersection node is found, set the function input relevance label of the seed to 0, indicating that the path cannot be redirected to the suspected vulnerability path by adjusting the input parameters, and terminate the function input relevance analysis phase for the seed. Perform symbolic taint analysis on the seed execution path, identify opcodes related to data transfer, and inject taints into the opcodes; track the propagation of taints in the stack, memory, and storage, and record symbolic expressions that affect the conditions of cross-nodes until the opcode block corresponding to the cross-node is reached; Based on the results of symbolic taint analysis, the constraints at the intersection nodes are extracted. To guide the seed execution path to the suspected vulnerability path, the inequalities in the constraints are negated to generate a new constraint set. Input the new constraint set into the symbolic solver. If the solution is successful, a non-empty function input parameter set, i.e., the mutation value, is generated. This set is stored in the mutation pool for subsequent seed mutations, and the function input parameter relevance label is set to 1. Generate function input parameter data and corresponding function input parameter relevance labels for each seed.

8. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 7 is characterized in that: The implementation process of the guided fuzz testing stage is as follows: Calculate the fitness of seeds based on the basic block distance and select seeds; Based on the correlation between the state variables of the selected seed and the suspicious target, it is determined whether the seed's function sequence should be crossed and different crossing methods should be used; based on the correlation between the seed's function input and the suspicious target, it is determined whether the seed's function input should be mutated and different mutation methods should be used to obtain a new seed; The EVM executes the generated new seed and analyzes the execution result to confirm whether the vulnerability is triggered.

9. The smart contract-oriented fuzz testing method based on suspicious target correlation according to claim 8 is characterized in that: The guided fuzz testing phase specifically includes the following three sub-phases: Guide selection sub-stage: According to each seed calculated in the suspicious target identification stage i The inverse of the comprehensive distance calculation is used as the distance weight; Sort all seeds by comprehensive distance from small to large, set a threshold to compare the comprehensive distance difference between adjacent seeds; if the comprehensive distance difference is less than the threshold, they are assigned to the same subgroup P, otherwise start a new subgroup; calculate each subgroup P k The reciprocal of the median of the comprehensive distance of the seeds is recorded as the weight of the subgroup; The fitness of each seed is calculated and normalized based on the weight of its subgroup and its own distance weight. Based on the normalized fitness, the first seed is selected using the roulette wheel method, with priority given to seeds that have a RAW data dependency relationship with the first seed. The other seeds in the population are traversed, and the intersection of the state variable set between the read and write operations of the first seed is taken. If the intersection is not empty, the currently traversed seed is selected as the second seed. If the intersection is empty, the roulette wheel method is used again to select the second seed. The selected seed pair enters the guided crossover stage. Guided cross sub-stage: Check the state variable association label values of the seed pair, and take the maximum value as the strongest state variable association SV max ; Take the intersection of the state variable sets of the seed pair between the read and write operations. If the intersection is not empty, it indicates that there is a RAW data dependency in the seed pair; If SV max =1, and there is a RAW data dependency in the seed pair, their function execution sequences are combined in the order of write first and read later to generate a new seed, and the corresponding state variable association label is set to 1; if SV max= 0, and there is a RAW data dependency in the seed pair, their function execution sequences are combined in the order of write first and read later to generate a new seed, and the corresponding state variable association label is set to 0; if SV max= -1, no operation is performed; If a crossover operation is performed, the comprehensive distance of the new seed is set to the minimum comprehensive distance of the two seeds before the crossover, and the guided mutation sub-stage is entered; if a crossover operation is not performed, the guided mutation sub-stage is skipped; Guided mutation sub-phase: Check the state variable relevance label value and function input parameter relevance label value of the new seed; if the state variable relevance label and the function input parameter relevance label are both 1, perform deterministic mutation and set the function input parameter value to the corresponding data in the mutation pool; if the state variable relevance label is 1 and the function input parameter relevance is 0, generate a random value based on the variable type of the function input parameter; if the state variable relevance label and the function input parameter relevance label are both 0, generate a random value based on the variable type of the function input parameter; if the state variable relevance label is -1, skip the guided mutation phase.

Images