Intelligent contract vulnerability detection method and device, equipment and medium

Abstract

The invention discloses an intelligent contract vulnerability detection method and device, equipment and a medium, and the method comprises the steps: collecting an intelligent contract source code for preprocessing, and obtaining a keyword feature vector; extracting local features and global features of the keyword feature vectors; by means of an attention mechanism, keyword feature weights are distributed; the keyword features are classified through an activation function, and whether the source code contains vulnerabilities or not is judged. According to the method, the CNN is good at capturing local features during data processing, and the BiLSTM can capture long-distance context information; semantic and grammar information in vulnerability codes can be better understood, and vulnerability detection accuracy is improved. The invention discloses an XX method, an XX device, XX equipment and a medium.

Description

Technical Field

[0001] The present invention relates to the field of blockchain smart contract security technology, and in particular to a smart contract vulnerability detection method, device, equipment and medium. Background Art

[0002] Blockchain technology has evolved from cryptocurrency to smart contracts and finally to industry applications. As a core innovation of blockchain, smart contracts are automated scripts deployed on the blockchain that automatically execute transactions or agreement terms when pre-set conditions are met. However, due to the lack of a trusted execution environment at the time, smart contracts were not widely adopted until the emergence of blockchain platforms such as Ethereum that support Turing-complete smart contracts.

[0003] Existing smart contracts still face security challenges: 1) Limitations of single-model detection: Existing methods primarily rely on static analysis or single models, making it difficult to capture dynamic execution characteristics and cross-modal correlations. 2) Insufficient detection of unknown vulnerabilities: Traditional symbolic execution and fuzz testing have poor generalization capabilities for unknown vulnerabilities, and deep learning models rely on limited features, making them ineffective in identifying new attack patterns. 3) It is difficult to capture the dynamic behavior and complex contextual relationships of code. Existing methods lack the ability to respond in real time to the dynamic on-chain transaction environment and adaptively update model parameters.

[0004] For example, invention application number 202310589095.4 discloses a smart contract vulnerability detection method. This application proposes a comprehensive test case value determination formula to guide the optimization process of the test case pool, effectively improving the efficiency of smart contract fuzz testing, exploring more paths in the tested smart contract, and discovering more contract vulnerabilities. However, this method also suffers from the limitations of single-model detection and the difficulty in capturing the dynamic behavior of the code.

[0005] Therefore, there is a need for an improved method for smart contract vulnerability detection and a vulnerability detection model based on deep learning, aiming to improve detection coverage, support multi-type vulnerability identification and reduce false alarm rate, and provide a more efficient vulnerability detection solution for smart contract security. Summary of the Invention

[0006] In response to the above-mentioned problems, the purpose of the present invention is to provide a smart contract vulnerability detection method, device, equipment and medium to capture the local and global characteristics of smart contracts, better understand the semantic and syntactic information in the vulnerability code, and improve the accuracy of vulnerability detection.

[0007] Embodiments of the present invention provide a smart contract vulnerability detection method, apparatus, device, and medium.

[0008] A first aspect: a smart contract vulnerability detection method, comprising:

[0009] S1. Collect smart contract source code for preprocessing and obtain keyword feature vectors;

[0010] S2, extract local features and global features of keyword feature vector;

[0011] S3. Use the attention mechanism to assign keyword feature weights;

[0012] S4. Classify keyword features through activation functions to determine whether the source code contains vulnerabilities.

[0013] Optionally, the S1 includes:

[0014] S11. Standardize the smart contract source code based on the Solidity syntax tree to obtain keywords;

[0015] S12. Use the CodeBERT model to generate keyword feature vectors.

[0016] Optionally, the S2 includes:

[0017] S21. Use the convolutional layer of the CNN model to extract the local features of the keyword feature vector, compress the parameters and data through the pooling layer, and reduce the dimension of the output vector through the Flatten layer;

[0018] S22. Based on the bidirectional long short-term memory network, the forward and backward dependencies of keyword feature vectors are captured to obtain global features.

[0019] Optionally, the S3 includes:

[0020] Based on the attention mechanism, the keyword feature vector is weighted to filter out redundant information in the keyword and highlight the key features.

[0021] Optionally, the S4 includes:

[0022] Use the Softmax layer to classify the fused features to determine whether the source code contains vulnerabilities. The formula is expressed as:

[0023] result = Softmax(WX+b)

[0024] Among them, W and b are weight parameters, and X is the output fusion feature of the fully connected layer.

[0025] Optionally, the method further includes: S5, evaluating the judgment result.

[0026] Optionally, the S5 evaluation indicators include:

[0027]

[0028] Among them, TP represents the number of correctly predicted positive samples, TN represents the number of correctly predicted negative samples, FP represents the number of incorrectly predicted positive samples, and FN represents the number of incorrectly predicted negative samples; Accuracy represents the ratio of the number of correctly predicted samples to the total number of samples; Precision represents the proportion of correctly predicted samples to the actual correct samples; Recall represents the proportion of actual positive samples to predicted positive samples, and F1-score is the harmonic mean of Precision and Recall.

[0029] A second aspect: A smart contract vulnerability detection device, comprising:

[0030] Input unit, used to collect smart contract source code data for preprocessing and obtain keyword feature vectors;

[0031] A feature extraction unit, used to obtain local features and global features of keyword feature vectors;

[0032] Attention unit, used to use the attention mechanism to assign keyword feature weights;

[0033] The detection unit is used to classify the source code by activating the keyword features of the function and determine whether the source code contains vulnerabilities.

[0034] A third aspect: An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method provided in the first aspect are implemented.

[0035] A fourth aspect: A non-transitory computer-readable storage medium having a computer program stored thereon, which implements the steps of the method provided in the first aspect when executed by a processor.

[0036] Beneficial effects of the present invention:

[0037] 1. This paper adopts the network fusion of CNN and BiLSTM. The CNN layer captures the local grammatical patterns of the code through convolution kernels, while the bidirectional LSTM captures long-range contextual dependencies. The two work together to improve the completeness of code semantic feature extraction and form a multimodal feature fusion architecture. Through the innovative combination of deep learning models and attention enhancement mechanism, it successfully solves the shortcomings of traditional methods in dynamic behavior capture and contextual association analysis, and provides a high-precision and high-efficiency automated detection paradigm for smart contract security audits.

[0038] 2. The present invention effectively suppresses the interference of non-critical variables through the attention mechanism, thereby improving the model's recognition accuracy of vulnerability call paths.

[0039] 3. This paper uses the CodeBERT model for code vectorization, which improves the similarity of similar vulnerability identification while retaining the Solidity syntax structure.

[0040] 4. In the preprocessing stage of the present invention, symbolic replacement (user function FUN1, variable VAR1) is used to enhance the generalization ability of the model, and the overfitting rate on the test set is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 Schematic diagram of the process of the smart contract vulnerability detection method of the present invention;

[0042] Figure 2 This is a schematic diagram of the structure of the smart contract vulnerability detection device of the present invention;

[0043] Figure 3 This is a flow chart of the principle of the smart contract vulnerability detection method of the present invention;

[0044] Figure 4 Schematic diagram of the structure of the electronic device of the present invention. DETAILED DESCRIPTION

[0045] The following describes embodiments of the present invention in detail. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar symbols throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended only to explain the present invention and are not to be construed as limiting the present invention.

[0046] Traditional smart contract vulnerability detection methods have difficulty capturing the dynamic behavior and complex contextual relationships of the code. Attackers can specifically bypass detection and are unable to adapt to large-scale contract scenarios. They have a single model defect and are prone to overfitting when data is sparse. The lack of an attention mechanism makes it difficult for the model to focus on high-risk code snippets.

[0047] In response to the above problems, the present invention provides a smart contract vulnerability detection method. Figure 1 A flowchart of a smart contract vulnerability detection method provided by an embodiment of the present invention includes:

[0048] S1. Collect smart contract source code data for preprocessing to obtain keyword feature vectors.

[0049] First, the smart contract source code is standardized based on the Solidity syntax tree to obtain keywords.

[0050] The Solidity syntax tree is used to preprocess vulnerability-related keywords (such as call and value), removing code versions, comments, non-ASCII values, and blank lines. User-defined variables are converted to symbolic names (such as VAR1 and VAR2), and user-defined functions are converted to symbolic names (such as FUN1 and FUN2). After the smart contract source code is processed, only the keywords in the Solidity syntax tree are retained.

[0051] Then, the CodeBERT model is used to generate keyword feature vectors.

[0052] CodeBERT is a word embedding model. The advantage of the CodeBERT algorithm is that it can map words in a high-dimensional discrete space to a low-dimensional continuous space, providing a more compact and expressive representation. It controls the dimension of the feature vector and solves the problem of dimensionality mutation while preserving the semantic and grammatical relationships between words.

[0053] Based on the CodeBERT model, keywords are predicted through source code context and keyword feature vectors are generated for easy embedding into the CNN network.

[0054] In order to more effectively extract keyword feature information, this paper treats each line of the smart contract source code as a fragment, and then treats each fragment in each line as a token. CodeBERT is used to convert the token into a keyword feature vector that meets the requirements. For example, part of the code is implemented as follows:

[0055] pragma solidity^0.4,20;

[0056] interface tokenRecipient{

[0057] function receiveApproval(address from,uint256value,bytes data)external;

[0058] / / from represents the sender's address

[0059] }

[0060] contract owned

[0061] / / owned is an owner-controlled contract address public owner;

[0062] function owned()public{

[0063] owner = msg.sender;

[0064] }

[0065] function changeOwner(address miner)public onlyOwner{

[0066] owner=miner;

[0067] / / miner represents the new owner address}

[0068] }

[0069] interface VARl{function FUN1(address VAR2,uint256 VAR3,bytes VAR4)external;

[0070] }

[0071] contract VAR5{address public FUN2; function VAR6() public{FUN2=msg.sender;

[0072] }

[0073] function FUN3(address miner)public FUN4{FUN2=FUN5;

[0074] }

[0075] }

[0076] The above code shows that the Solidity contract manages permissions and basic logic, and CodeBERT processes semantic features.

[0077] By defining the tokenRecipient core interface: including the receiveApproval function (parameters: address, uint256, bytes, bytes), the VAR1 interface: including the FUN1 function (parameters: uint256, bytes), and the VAR2 interface, including the FUN2 function (parameters: address, uint256), solidity replication is performed according to the contract characteristics.

[0078] S2. Obtain local features and global features of the keyword feature vector.

[0079] The convolutional layer of the CNN model is used to extract the local features of the keyword feature vector, the parameters and data are compressed through the pooling layer, and the dimension is reduced through the Flatten layer to output the vector.

[0080] like Figure 3 As shown, CNN is a feedforward neural network with a convolutional structure. It can extract features from smart contract source code data and has strong feature extraction and generalization capabilities, which can improve the vulnerability detection capabilities of hybrid networks. CNN consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. After the CodeBERT word vectors are embedded, the present invention uses a 1D convolutional layer in the CNN layer to perform convolution operations to extract local features. The parameters and data are then compressed through the pooling layer, and the local information is processed for dimensionality reduction to reduce overfitting.

[0081] After the convolutional and pooling layers, the Flatten layer is used to reduce the dimensionality of the final output vector. The Flatten layer plays a very important role in CNNs, serving as a bridge between the convolutional and fully connected layers. In the method presented here, two convolutional layers are used for local feature learning. The output of the previous layer is then used as the input for the next layer to learn a nonlinear representation, thereby forming a hierarchical feature representation.

[0082] Based on the bidirectional long short-term memory network (BiLSTM), the forward and backward dependencies of keyword feature vectors are captured to obtain global features.

[0083] The Bidirectional Long Short-Term Memory (BiLSTM) network is a combination of a forward LSTM and a backward LSTM. BiLSTM can capture the dependencies between keyword feature vectors, making it very useful for detecting vulnerabilities that rely on the context of keyword feature vectors.

[0084] Each LSTM layer in BiLSTM contains multiple memory cells. Each memory cell has 1 hidden state and 1 cell state. The cell state is updated based on the input and the previous hidden state. The hidden state is then calculated based on the cell state and the input. The output of the LSTM layer is calculated based on the hidden state. The cell state of the LSTM layer is expressed as:

[0085] c t =f t c t-1 +i t ·tanh(w c [h t-1 ,x t ]+b c ) (1)

[0086] h t =o t ·tanh(ct ) (2)

[0087] Among them, c t is the state of the unit at time t, which is determined by the forget gate f t and input gate i t Controlled, h t is the hidden state at time t, which is output by the output gate o t control.

[0088] S3. Use the attention mechanism to assign keyword feature weights.

[0089] To better extract feature vectors, this paper introduces an attention mechanism. The attention mechanism can improve detection accuracy and efficiency, highlight key features in the smart contract source code, assign weights to key features related to vulnerabilities, and assign higher scores to key features. This effectively filters redundant information in the source code, highlights key features, and improves vulnerability detection performance. The formula is expressed as:

[0090] u t =tanh(Wh t +b)

[0091]

[0092] Among them, W and b are weight parameters, h t is the keyword feature, u t is the key feature, a t To calculate the score.

[0093] S4. Classify the source code by activating the keyword features of the function to determine whether it contains vulnerabilities.

[0094] The output of the attention layer can be further processed and feature fused through the fully connected layer. The fully connected layer maps the output to a specific dimension and introduces nonlinearity through the activation function. Finally, the Softmax layer is used to classify the features to determine whether the source code contains vulnerabilities. The formula is expressed as:

[0095] result = Softmax(WX+b)

[0096] Among them, X is the fusion feature of the fully connected layer output fusion feature.

[0097] Evaluate the judgment results. The evaluation indicators include:

[0098]

[0099] Among them, TP represents the number of correctly predicted positive samples, TN represents the number of correctly predicted negative samples, FP represents the number of incorrectly predicted positive samples, and FN represents the number of incorrectly predicted negative samples; Accuracy represents the ratio of the number of correctly predicted samples to the total number of samples; Precision represents the proportion of correctly predicted samples to the actual correct samples; Recall represents the proportion of actual positive samples to predicted positive samples, and F1-score is the harmonic mean of Precision and Recall.

[0100] The present invention also provides a smart contract vulnerability detection device, such as Figure 2 As shown, the device includes:

[0101] Input unit, used to collect smart contract source code data for preprocessing and obtain keyword feature vectors;

[0102] A feature extraction unit, used to obtain local features and global features of keyword feature vectors;

[0103] Attention unit, used to use the attention mechanism to assign keyword feature weights;

[0104] The detection unit is used to classify the source code by activating the keyword features of the function and determine whether the source code contains vulnerabilities.

[0105] The present invention combines different types of deep learning models. CNNs excel at capturing local features when processing data, while BiLSTMs can capture long-range contextual information. In smart contracts, vulnerabilities may not be easily detected by simply examining local code. Therefore, combining these two networks can capture both local and global features of vulnerabilities, better understanding the semantic and syntactic information in vulnerable code and improving vulnerability detection accuracy. The combination of CNNs and BiLSTMs can also reduce the risk of overfitting. The present invention first uses input units and embeds words using the word embedding method CodeBERT to map high-dimensional smart contracts into low-dimensional vectors.

[0106] Secondly, the feature extraction unit is used to input the keyword vector into CNN for feature extraction. The output of the CNN layer is used as the input of the BiLSTM layer and the feature vector is trained. The output of this stage is sent to the concat layer for feature fusion to make the extracted feature vector matrix more complete. The feature vector is then input into the attention layer to increase the weight of key information. Finally, classification is performed through the Softmax layer to obtain the final result.

[0107] The present invention also provides an electronic device, Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 4As shown, the electronic device may include: a processor, a communications interface, a memory, and a communication bus, wherein the processor, the communications interface, and the memory communicate with each other via the communication bus. The processor may call logic instructions in the memory, for example, to execute the following method:

[0108] S1. Collect smart contract source code for preprocessing and obtain keyword feature vectors;

[0109] S2, extract local features and global features of keyword feature vector;

[0110] S3. Use the attention mechanism to assign keyword feature weights;

[0111] S4. Classify keyword features through activation functions to determine whether the source code contains vulnerabilities.

[0112] In addition, the logical instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0113] An embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method provided in each of the above embodiments is implemented, for example, including:

[0114] S1. Collect smart contract source code for preprocessing and obtain keyword feature vectors;

[0115] S2, extract local features and global features of keyword feature vector;

[0116] S3. Use the attention mechanism to assign keyword feature weights;

[0117] S4. Classify keyword features through activation functions to determine whether the source code contains vulnerabilities.

[0118] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0119] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0120] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A smart contract vulnerability detection method, characterized in that: include: S1. Collect smart contract source code for preprocessing and obtain keyword feature vectors; S2, extract local features and global features of keyword feature vector; S3. Use the attention mechanism to assign keyword feature weights; S4. Classify keyword features through activation functions to determine whether the source code contains vulnerabilities.

2. A smart contract vulnerability detection method according to claim 1, characterized in that: Said S1 comprises: S11. Standardize the smart contract source code based on the Solidity syntax tree to obtain keywords; S12. Use the CodeBERT model to generate keyword feature vectors.

3. A smart contract vulnerability detection method according to claim 1, characterized in that: The S2 includes: S21. Use the convolutional layer of the CNN model to extract the local features of the keyword feature vector, compress the parameters and data through the pooling layer, and reduce the dimension of the output vector through the Flatten layer; S22. Based on the bidirectional long short-term memory network, the front-end dependency relationship of the keyword feature vector is captured to obtain the global features.

4. A smart contract vulnerability detection method according to claim 1, characterized in that: The S3 includes: Based on the attention mechanism, the keyword feature vector is weighted to filter out redundant information in the keyword and highlight the key features.

5. A smart contract vulnerability detection method according to claim 1, characterized in that: The S4 includes: Use the Softmax layer to classify the fused features to determine whether the source code contains vulnerabilities. The formula is expressed as: result = Softmax(WX+b) Among them, W and b are weight parameters, and X is the output fusion feature of the fully connected layer.

6. A smart contract vulnerability detection method according to claim 1, characterized in that: Also includes: S5. Evaluate the judgment result.

7. A smart contract vulnerability detection method according to claim 6, characterized in that: The S5 evaluation indicators include: Among them, TP represents the number of correctly predicted positive samples, TN represents the number of correctly predicted negative samples, FP represents the number of incorrectly predicted positive samples, and FN represents the number of incorrectly predicted negative samples; Accuracy represents the ratio of the number of correctly predicted samples to the total number of samples; Precision represents the proportion of correctly predicted samples to the actual correct samples; Recall represents the proportion of actual positive samples to predicted positive samples, and F1-score is the harmonic mean of Precision and Recall.

8. A smart contract vulnerability detection device applied to the method according to any one of claims 1 to 7, characterized in that: The device comprises: Input unit, used to collect smart contract source code data for preprocessing and obtain keyword feature vectors; A feature extraction unit, used to obtain local features and global features of keyword feature vectors; Attention unit, used to use the attention mechanism to assign keyword feature weights; The detection unit is used to classify the source code by activating the keyword features of the function and determine whether the source code contains vulnerabilities.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of a smart contract vulnerability detection method as described in any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a smart contract vulnerability detection method as described in any one of claims 1 to 7 are implemented.

Images