Intelligent contract vulnerability detection method, system and device, medium and product

Abstract

The invention discloses an intelligent contract vulnerability detection method, system and device, a medium and a product, and relates to the field of data processing, and the method comprises the steps: obtaining a source code of an intelligent contract; extracting local features and global features from the source code; training and testing the large language model, adjusting the large language model by adopting a LoRA method in the training process, and taking the trained large language model as a vulnerability detection model until a set condition is met; and inputting the local features and the global features into the vulnerability detection model to obtain a vulnerability detection result of the smart contract. According to the invention, the security vulnerability of the smart contract can be identified efficiently and accurately, and the security of the smart contract is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a smart contract vulnerability detection method, system, device, medium and product. Background Art

[0002] The concept of smart contracts was first proposed by computer scientist Nick Szabo in 1994. In his paper, Szabo defined smart contracts as computerized transaction protocols designed to automate and simplify contract execution and management. However, due to the technological limitations of the time, the concept of smart contracts did not receive widespread attention. However, the development of blockchain technology, with its decentralized, tamper-proof, trustless, secure, and transparent features, has provided the technical foundation for the widespread application of smart contracts.

[0003] Smart contracts can automatically execute contract terms without third-party oversight. When pre-defined conditions are met, transactions or other logical operations are automatically executed. However, once deployed on a blockchain, smart contracts cannot be easily modified. These characteristics also pose significant security risks. For one thing, smart contracts are relatively new, and developers lack a thorough understanding of blockchain features and smart contract programming systems. This makes smart contracts prone to security vulnerabilities. Furthermore, smart contracts often manage blockchain-related data assets, which are highly valuable and easily attract the attention of attackers. Attackers can exploit these vulnerabilities to steal on-chain data assets and harm the interests of users. Therefore, detecting vulnerabilities in smart contracts before they are uploaded to the blockchain is crucial. The efficient and accurate identification of smart contract security vulnerabilities is a pressing issue. Summary of the Invention

[0004] In order to solve the above problems, this application provides a smart contract vulnerability detection method, system, device, medium and product.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides a smart contract vulnerability detection method, comprising:

[0007] Get the source code of the smart contract;

[0008] Extracting local features and global features from the source code;

[0009] Train and test the large language model, and use the LoRA method to adjust the large language model during the training process until the set conditions are met. Then, use the trained large language model as the vulnerability detection model;

[0010] The local features and the global features are input into the vulnerability detection model to obtain vulnerability detection results of the smart contract.

[0011] Optionally, extracting local features from the source code includes:

[0012] Compile the source code using the solc compiler to generate an abstract syntax tree;

[0013] Traversing the abstract syntax tree using a structured traversal method to generate a sequence structure;

[0014] Construct a node extraction script to extract token information of the source code from the sequence structure;

[0015] The token information and the abstract syntax tree are used as the local features.

[0016] Optionally, use Python language to build a node extraction script.

[0017] Optionally, extracting global features from the source code includes:

[0018] Using code comment generation technology to convert the source code into natural language to obtain code comments;

[0019] The code annotation is made into a global feature.

[0020] Alternatively, the process of adjusting the large language model using the LoRA method is expressed as:

[0021]

[0022] In the formula, Θ represents the optimization parameters of the large language model, x and y represent the input and output respectively, It is composed of data in sequence, t represents the length of the large language model output, represents the fine-tuning learner, Φ0 represents the frozen parameter, △Φ(Θ) represents the fine-tuning parameter, y t Indicates the data at the t-th position that the large language model needs to predict, and max indicates the maximum value.

[0023] Optionally, the large language model is trained and tested, and the LoRA method is used to adjust the large language model during the training process until the set conditions are met. The trained large language model is then used as a vulnerability detection model, including:

[0024] Obtain a dataset of labeled vulnerabilities in smart contracts;

[0025] Extract local feature samples and global feature samples from the labeled smart contract vulnerability dataset;

[0026] Generate a dataset based on local feature samples, global feature samples, and the labels corresponding to the local feature samples and global feature samples in the smart contract labeled vulnerability dataset;

[0027] Dividing the data set into a training set and a test set according to a set ratio;

[0028] The training set is used to adjust and train the large language model, and during the training process, the trained large language model is tested with the test set until the evaluation index reaches the expected level, thereby obtaining a trained large language model.

[0029] In a second aspect, this application provides a smart contract vulnerability detection system, comprising:

[0030] Code acquisition module, used to obtain the source code of the smart contract;

[0031] A feature extraction module, configured to extract local features and global features from the source code;

[0032] The model building module is used to train and test the large language model. During the training process, the LoRA method is used to adjust the large language model until the set conditions are met. The trained large language model is then used as the vulnerability detection model.

[0033] The vulnerability detection module is used to input the local features and the global features into the vulnerability detection model to obtain vulnerability detection results of the smart contract.

[0034] In a third aspect, the present application provides a computer device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the smart contract vulnerability detection method provided above.

[0035] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the smart contract vulnerability detection method provided above.

[0036] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the smart contract vulnerability detection method provided above.

[0037] According to the specific embodiments provided in this application, this application has the following technical effects:

[0038] This application provides a smart contract vulnerability detection method, system, device, medium, and product. By extracting local and global features of the smart contract source code, the vocabulary, structure, and semantic information of the smart contract source code can be preserved. LoRA fine-tuning of the large language model enables the adjusted large language model to analyze the text and structural features of the smart contract source code. By using the adjusted large language model to construct a vulnerability detection model, smart contract security vulnerabilities can be efficiently and accurately identified, thereby improving the security of smart contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 A flowchart of a smart contract vulnerability detection method provided in one embodiment of the present application;

[0041] Figure 2 This is an example diagram of traversing an AST into a sequence using SBT, provided in one embodiment of the present application;

[0042] Figure 3 A schematic diagram of the LoRA principle provided in one embodiment of the present application;

[0043] Figure 4 A schematic diagram of the implementation architecture of a smart contract vulnerability detection method provided in one embodiment of the present application;

[0044] Figure 5 A schematic diagram of the functional modules of a smart contract vulnerability detection system provided in one embodiment of the present application;

[0045] Figure 6 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0047] In previous research work, both formal verification and symbolic execution methods rely on traditional expert rules, and these expert rules are constantly optimized in practice, summarized from failures, and need to be continuously optimized and improved. In order to efficiently and accurately detect vulnerabilities in smart contracts, the use of artificial intelligence methods is a good choice. The artificial intelligence-based method retains the structure and semantic information of the smart contract through training models to learn the basic characteristics of the vulnerabilities, thereby achieving the purpose of vulnerability detection, and the model can be self-optimized when continuously accepting new data, so that the accuracy and efficiency of detection are continuously improved over time. Therefore, applying artificial intelligence to smart contract vulnerability detection is a new idea. Based on the technical idea provided by this application, the technical problems that need to be solved in the implementation process mainly include:

[0048] (1) Extraction of local information of smart contract source code.

[0049] Extracting local information from smart contract source code is a complex task, requiring the extraction of key fragments and features for analysis. This requires preserving the contract's grammatical and semantic features, as well as the hierarchical relationships between nodes, as much as possible. Incomplete contract information extraction can result in inaccurate detection and ineffective detection of security vulnerabilities. Therefore, it is necessary to process and extract the contract source code to reveal its grammatical, semantic, and hierarchical relationships.

[0050] (2) Extraction of global information of smart contract source code.

[0051] Considering only local contract information will result in poor model performance in understanding the global context, making it difficult to effectively capture the overall logic and dependencies of the contract. Therefore, by introducing the powerful natural language generation capabilities of the large language model, we can extract the calling relationships between modules and functions in the source code and global dependency information, helping the model understand the semantic dependencies and global logic of the code.

[0052] (3) Efficiently train the model.

[0053] Given the complexity and diversity of smart contract vulnerability detection tasks, traditional full-parameter training methods suffer from high computational resource consumption and low training efficiency. Therefore, to efficiently train the model while adapting it to smart contract vulnerability detection tasks, we employ the LoRA fine-tuning method. This not only accelerates the training process but also maintains model performance during training.

[0054] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0055] In an exemplary embodiment, the present application provides a smart contract vulnerability detection method, which is executed by a computer device, specifically a terminal or a server, or a terminal and a server. In the embodiment of the present application, the method is applied to a server as an example. Figure 1 As shown, the method includes:

[0056] Step 100: Get the source code of the smart contract.

[0057] Step 101: extract local features and global features from source code.

[0058] Step 102: Train and test the large language model, and use the LoRA method to adjust the large language model during the training process until the set conditions are met, and then use the trained large language model as the vulnerability detection model.

[0059] Step 103: Input the local features and global features into the vulnerability detection model to obtain the vulnerability detection results of the smart contract.

[0060] By implementing steps 100 to 103 above, an efficient and accurate technical solution is provided for smart contract vulnerability detection, which helps developers better develop smart contracts and maintain a secure blockchain environment.

[0061] In another exemplary embodiment of the present application, in order to preserve information such as lexical and grammatical structures while taking into account global contextual feature information, in this embodiment, the implementation process of the above step 101 includes two parts: one part is to extract local features from the source code, and the other part is to extract global features from the source code. Among them:

[0062] 1. The extraction of local features mainly includes the following steps (1) to (4).

[0063] (1) Use the solc compiler to compile the source code and generate an Abstract Syntax Tree (AST).

[0064] (2) Structure-based traversal (SBT) is used to traverse the abstract syntax tree and generate a sequence structure that fully preserves the hierarchical relationship between nodes.

[0065] (3) Build a node extraction script to extract the token information of the source code from the sequence structure.

[0066] The source code of a smart contract consists of keywords, identifiers, operators, and constants. To learn lexical information from the source code of a smart contract, this application can use Python to build a node script to extract codetokens (transliterated as code tags, i.e., token information). Considering that regular expressions cannot understand the context and hierarchy of the code and may not be able to accurately extract key information from the source code of a smart contract, the node extraction script will first compile the source code to generate an abstract syntax tree, and then extract token information by parsing the tree structure of the source code to avoid situations where regular expressions cannot handle boundaries, thereby ensuring that the extracted code information is more accurate.

[0067] (4) Use token information and abstract syntax tree as local features.

[0068] Based on the above description, the AST obtained by implementing step (1) contains very redundant content and a large amount of irrelevant feature information. In order to better present the hierarchical structure of AST and maintain the clarity of the hierarchical structure, a new SBT method is used in step (2) to traverse AST and convert it into a sequence structure. For example, Figure 2 As shown, first, starting from the root node of the abstract syntax tree, the XML tag markup form is used to represent the structural information of the abstract syntax tree, that is, Next, traverse all subtrees of the root node and put all subtrees of the root node into labels, i.e. <c>< / c> , recursively traverse each subtree until all nodes are traversed and the final sequence is obtained <d>< / d> <e>< / e> <f>< / f> <c>< / c> .

[0069] 2. The local feature extraction process can be described as follows: Currently, significant progress has been made in code comment generation technology for natural language processing. Code comments not only help developers quickly understand code functionality but also identify potential security risks, improving code readability and maintainability. Based on this, during the global feature extraction process, code comment generation technology is used to convert the smart contract source code into natural language form, generating code comments for the smart contract. This approach preserves the global feature information and contextual semantics of the smart contract source code, helping vulnerability detection models understand the semantic dependencies and global logic of the source code. This, combined with the local features from step 1, paves the way for vulnerability detection in subsequent models.

[0070] In another exemplary embodiment of the present application, in order to enable the Large Language Model (LLM) to have the ability to detect smart contract vulnerabilities, in this embodiment, the process of adjusting the large language model using the LoRA method is described. Figure 3 The LoRA principle shown, Figure 3 The left part is the pre-training parameter W0∈R d×d , which is not changed during training; Figure 3 The right part is the fine-tuned trainable weight parameter, which is expressed as two low-order decomposition matrices A and B with small parameter amounts. Matrix A is initialized using a Gaussian function, that is, the element α in matrix A is i ~N(0,σ 2 ). Matrix B is initialized with all zeros, that is, element b in matrix B i = 0. N(0,σ 2 ) is a Gaussian distribution, and σ represents the standard deviation.

[0071] Based on the above description, the parameter matrix to be updated for the large language model is ΔW = BA, where A∈R r×d , B∈R d×r Given input Output after adding LoRA have:

[0072] y=(W0+ΔW)x=W0x+BAx.

[0073] in, Indicates the data dimensions of input and output, R *×* Indicates the dimensions of the matrix.

[0074] If you want to train all parameters of a large language model, you need to relearn each model parameter in the large language model. This approach will bring the disadvantages of high computing resource consumption and low training efficiency. Among them, the objective function for optimizing all parameters in the large language model is expressed as:

[0075]

[0076] In the formula, Φ represents all optimization parameters of the large language model, x and y represent input and output respectively, is composed of data in sequence, t represents the length of the large language model output, y t Indicates the data (word or symbol) at the t-th position that the large language model needs to predict, P Φ (y|x) is a widely used multi-task fine-tuning learner, and max means taking the maximum value.

[0077] However, large language models can often achieve good results if only a few parameters are fine-tuned. Based on this, the objective function for optimizing some parameters in a large language model is expressed as:

[0078]

[0079] Where Θ represents the optimization parameter of the large language model, represents the fine-tuning learner, Φ0 represents the frozen parameter, and △Φ(Θ) represents the fine-tuning parameter.

[0080] Based on the above description, if Figure 4 As shown, LLaMA-Factory can be selected as the fine-tuning tool (i.e., large language model). This fine-tuning tool provides comprehensive tools and interfaces designed to simplify and accelerate the training, fine-tuning, and deployment of large language models. The selected base model is glm-4-9b-1m-chat. The fine-tuning hyperparameter configuration is:

[0081] Number of training steps: 40. Learning rate: 1e-5 to 5e-5. Maximum gradient norm: 1. LoRA rank: 32. Truncation length: 12000. Batch size: 2. Optimizer: Adam.

[0082] Figure 4 In

[15] , CodeBERT is a bimodal pre-training model for programming language and natural language.

[0083] In another exemplary embodiment of the present application, the process of constructing a vulnerability detection model in step 102 is described.

[0084] 1) Obtain a dataset of labeled smart contract vulnerabilities, such as a smart contract sol file.

[0085] 2) Extract local and global feature samples from the labeled smart contract vulnerability dataset. The smart contract sol file is compiled to extract an abstract syntax tree (AST). A structured traversal approach is used to remove redundant data from the AST, traversing valid information to obtain a sequence structure. A node script is used to extract codetokens from the smart contract source code. Local feature information, such as contract vocabulary and lexical structure, is retained to obtain local feature samples. Code comment generation technology is used to convert the smart contract source code into a natural language model to obtain code comments, retaining global contextual feature information to obtain global feature samples.

[0086] 3) Generate a dataset based on local feature samples, global feature samples, and the labels corresponding to the local feature samples and global feature samples in the smart contract labeled vulnerability dataset.

[0087] 4) Divide the dataset into training set and test set according to the set ratio (e.g. 8:2).

[0088] 5) Use the training set to adjust and train the large language model. During the training process, use the test set to test the trained large language model until the evaluation index reaches the expected level, and obtain the trained large language model.

[0089] During this process, the large language model is fine-tuned using the three features from the training set (code tokens, abstract syntax trees, and code comments) as input. The fine-tuned large model is evaluated using the test set, and the model is repeatedly optimized based on the evaluation metrics until the desired level is reached. This results in the final large language model (i.e., vulnerability detection model), and a smart contract vulnerability detection dataset is constructed to feed into the large language model for testing.

[0090] The output of the large language model is evaluated using metrics such as accuracy, precision, recall, and F1, and optimization is performed based on the results. A trained large language model with high accuracy, recall, precision, and F1 scores is considered effective in smart contract vulnerability detection.

[0091] The calculation methods of accuracy, recall, precision and F1 value are shown in formula (1) to formula (4). Among them, TP (True Positive) represents the number of samples that are judged as positive samples by the large language model and are actually positive samples; FP (False Positive) represents the number of samples that are judged as positive samples by the large language model but are actually negative samples; TN (True Negative) represents the number of samples that are judged as negative samples by the large language model and are actually negative samples; FN (False Negative) represents the number of samples that are judged as negative samples by the large language model but are actually positive samples.

[0092]

[0093]

[0094] After evaluating the trained large language model according to the aforementioned evaluation metrics, the model needs to be fine-tuned repeatedly until the evaluation metrics reach the desired level. Once fine-tuning is complete, the model can be used to detect vulnerabilities in smart contracts.

[0095] Based on the above description, the overall implementation architecture of the smart contract vulnerability detection method provided by this application is as follows: Figure 4 As shown in the figure, the system can be divided into two parts. The left part is data processing, which mainly converts the smart contract source code into three feature inputs: abstract syntax trees, code tokens, and code comments. The right part is the large language model structure. The three features on the left are vectorized and converted into a format that the large language model can learn. The large language model's predictions are used for binary classification to determine whether the smart contract has security vulnerabilities.

[0096] In summary, this application proposes an innovative solution to the problem of smart contract vulnerability detection: first, extract local information of the smart contract, use the code abstract syntax tree (AST) conversion tool to convert the smart contract into an AST sequence, and use a structured traversal method to traverse the AST sequence to convert it into a sequence structure, retaining the vocabulary and structural information of the code, and build a node extraction script to mine the token information of the code from the smart contract code, retaining the semantic information of the code. Subsequently, extract the global context information of the smart contract, and use the code large model to convert the source code of the smart contract into code comments, retaining the global dependency information of the code. Finally, use the code comments, the AST sequence structure after traversal by SBT method, and the token information of the code as a fine-tuning dataset, and perform LoRA fine-tuning on the large language model. The large model can simultaneously analyze the text and structural features of the code based on the self-attention mechanism for vulnerability detection. Among them, this application uses the LoRA fine-tuning method to provide new ideas for subsequent research.

[0097] Based on the same inventive concept, embodiments of the present application also provide a smart contract vulnerability detection system for implementing the aforementioned smart contract vulnerability detection method. The implementation solution provided by this system is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations in one or more smart contract vulnerability detection system embodiments provided below can be found in the limitations of the smart contract vulnerability detection method above and will not be repeated here.

[0098] In an exemplary embodiment, Figure 5 As shown, a smart contract vulnerability detection system is provided, including: a code acquisition module 200, a feature extraction module 201, a model construction module 202 and a vulnerability detection module 203.

[0099] The code acquisition module 200 is used to obtain the source code of the smart contract.

[0100] The feature extraction module 201 is used to extract local features and global features from source code.

[0101] The model building module 202 is used to train and test the large language model, and use the LoRA method to adjust the large language model during the training process until the set conditions are met, and then use the trained large language model as the vulnerability detection model.

[0102] The vulnerability detection module 203 is used to input local features and global features into the vulnerability detection model to obtain vulnerability detection results of the smart contract.

[0103] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 6As shown. The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, memory and input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data of a smart contract vulnerability detection method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a smart contract vulnerability detection method is implemented.

[0104] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0105] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0106] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0107] In an exemplary embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0108] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0109] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (RRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0110] The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may include, but are not limited to, general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic units, data processing logic units based on quantum computing, and the like.

[0111] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0112] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is only intended to help understand the method and core concept of this application. At the same time, for those skilled in the art, based on the concept of this application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A smart contract vulnerability detection method, characterized in that: include: Get the source code of the smart contract; Extracting local features and global features from the source code; Train and test the large language model, and use the LoRA method to adjust the large language model during the training process until the set conditions are met. Then, use the trained large language model as the vulnerability detection model; The local features and the global features are input into the vulnerability detection model to obtain vulnerability detection results of the smart contract.

2. The smart contract vulnerability detection method according to claim 1, characterized in that: Local features are extracted from the source code, including: Compile the source code using the solc compiler to generate an abstract syntax tree; Traversing the abstract syntax tree using a structured traversal method to generate a sequence structure; Construct a node extraction script to extract token information of the source code from the sequence structure; The token information and the abstract syntax tree are used as the local features.

3. The smart contract vulnerability detection method according to claim 2, characterized in that: Use Python language to build node extraction scripts.

4. The smart contract vulnerability detection method according to claim 1, characterized in that: Global features are extracted from the source code, including: Using code comment generation technology to convert the source code into natural language to obtain code comments; The code annotation is made into a global feature.

5. The smart contract vulnerability detection method according to claim 1, characterized in that: The process of adjusting the large language model using the LoRA method is expressed as: In the formula, Θ represents the optimization parameters of the large language model, x and y represent the input and output respectively, It is composed of data in sequence, t represents the length of the large language model output, represents the fine-tuning learner, Φ0 represents the frozen parameter, △Φ(Θ) represents the fine-tuning parameter, y t Indicates the data at the t-th position that the large language model needs to predict, and max indicates the maximum value.

6. The smart contract vulnerability detection method according to claim 1, characterized in that: Train and test the large language model. Use the LoRA method to adjust the large language model during the training process until the set conditions are met. Then use the trained large language model as the vulnerability detection model, including: Obtain a dataset of labeled vulnerabilities in smart contracts; Extract local feature samples and global feature samples from the labeled smart contract vulnerability dataset; Generate a dataset based on local feature samples, global feature samples, and the labels corresponding to the local feature samples and global feature samples in the smart contract labeled vulnerability dataset; Dividing the data set into a training set and a test set according to a set ratio; The training set is used to adjust and train the large language model, and during the training process, the trained large language model is tested with the test set until the evaluation index reaches the expected level, thereby obtaining a trained large language model.

7. A smart contract vulnerability detection system, characterized in that: include: Code acquisition module, used to obtain the source code of the smart contract; A feature extraction module, configured to extract local features and global features from the source code; The model building module is used to train and test the large language model. During the training process, the LoRA method is used to adjust the large language model until the set conditions are met. The trained large language model is then used as the vulnerability detection model. The vulnerability detection module is used to input the local features and the global features into the vulnerability detection model to obtain vulnerability detection results of the smart contract.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the smart contract vulnerability detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the smart contract vulnerability detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the smart contract vulnerability detection method according to any one of claims 1 to 6 is implemented.

Images