A smart contract vulnerability detection method based on multi-view learning

Abstract

The application discloses a smart contract vulnerability detection method based on multi-view learning, and the method obtains three representation modes of a smart contract source code, an abstract syntax tree, a control flow graph and a data flow graph through static analysis of the smart contract; noise codes outside called external functions and variable positions are pruned for different representation modes, and features of the noise codes are obtained; abstract syntax tree features are learned through an extended recurrent neural network, and control flow graph and data flow graph features are learned through a graph attention network; and finally, features obtained through fusion of the three kinds of features are used to detect smart contract vulnerabilities. The smart contract vulnerability detection method based on multi-view learning can more comprehensively capture indicative features of vulnerabilities from codes, simplify redundant noise, and improve the performance and effect of smart contract vulnerability detection.

Description

A Smart Contract Vulnerability Detection Method Based on Multi-View Learning Technical Field

[0001] This invention relates to Ethereum smart contract security technology, specifically to a smart contract vulnerability detection method based on multi-view learning. Background Technology

[0002] Driven by emerging blockchain technology, smart contracts run on the blockchain and benefit from its decentralized and immutable characteristics. However, this inability to be modified once deployed on the blockchain also makes vulnerable smart contracts difficult to fix when attacked by malicious users, leading to various losses. Therefore, vulnerability detection for smart contracts has become a critical issue in smart contract applications.

[0003] To address the security issues of smart contracts, numerous smart contract vulnerability detection systems have been designed. Common smart contract vulnerability detection methods include: traditional methods that utilize symbolic execution and formal verification, but these rely heavily on expert knowledge; and deep learning-based methods that learn contracts using sequence, tree, and graph representations, but these typically focus only on syntax or semantics and suffer from excessive model noise due to overly large graph representations.

[0004] Chinese patent CN116383832A discloses a smart contract vulnerability detection method based on graph neural networks. This method uses sensitive operations in the smart contract as the entry point for program analysis, extracting code with control and data dependencies on these sensitive operations as key code for analysis. The key code is represented using a graph structure, taking semantic information into account. It uses a graph neural network learning model and attention mechanism to accurately diagnose and explain abnormal results. However, this method ignores the syntactic information of the smart contract and relies too heavily on expert-defined sensitive operations. While it performs well in detecting sensitive operations with obvious characteristics, it does not effectively handle the detection of other types of vulnerabilities, especially semantically related vulnerabilities.

[0005] Chinese Patent Publication No. CN116089957A discloses a method and apparatus for detecting smart contract vulnerabilities based on the fusion of syntactic and semantic features. The method transforms the smart contract source code into an abstract syntax tree and control flow graph, and uses convolutional neural networks and graph neural networks to extract syntactic and semantic features from the abstract syntax tree and control flow graph. Finally, the syntactic and semantic features are concatenated to obtain a fused vector, which is then used to detect vulnerabilities in the smart contract. However, this invention ignores the data flow information of the smart contract, and the directly concatenated feature vector contains a lot of noise unrelated to the vulnerabilities. On the one hand, overly complex code representations significantly reduce model efficiency; on the other hand, information unrelated to vulnerabilities may lead to overfitting.

[0006] Chinese patent CN120277682A discloses a smart contract vulnerability detection method based on multimodal selective state space fusion. This method extracts the contract graph, data flow, and bytecode text from the smart contract source code, generating color and grayscale images corresponding to the encoded syntax elements and bytecode, respectively. Semantic features are extracted using residual graph convolutional networks and residual attention networks. Contextual encoding is used to process the text to obtain textual modal features, and a convolutional neural network processes the images to obtain visual features. Finally, the fused features are used for vulnerability detection. However, this invention neglects the control flow information of the smart contract and suffers from similar problems to the aforementioned work. The features obtained by directly stitching the two processed images contain a lot of noise unrelated to the vulnerability. The accuracy and efficiency of this method need to be improved.

[0007] In summary, current work and published patents in the field of static analysis for smart contract vulnerability detection still have the following unresolved issues:

[0008] (1) Targeting only one or a few specific vulnerabilities in smart contracts. Current smart contract vulnerability detection relies too much on expert knowledge, resulting in poor detection effectiveness for different types of vulnerabilities. This leads to the lack of versatility of existing methods.

[0009] (2) It cannot adequately balance the attention to syntactic and semantic information, resulting in low accuracy. Current smart contract vulnerability detection methods cannot adequately balance syntactic and semantic information. Syntactic information focuses on the program's structure and syntactic patterns, while semantic information focuses on the program's control logic and data dependencies. The inability to balance both leads to the loss of features during model training, which in turn causes a decrease in the model's accuracy.

[0010] (3) Complex representations lead to reduced model efficiency and overfitting due to information unrelated to vulnerabilities. Current smart contract vulnerability detection work has paid attention to the importance of taking into account both syntactic and semantic information, but there are problems in feature extraction. Directly using or splicing syntactic and semantic features leads to overly complex code representations, generating noise unrelated to vulnerabilities, which in turn causes inefficiency and overfitting problems in the model. Summary of the Invention

[0011] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a smart contract vulnerability detection method based on multi-view learning.

[0012] Technical solution: The present invention provides a smart contract vulnerability detection method based on multi-view learning, comprising the following steps:

[0013] Step 1: Obtain the source code of an existing Ethereum smart contract and categorize it with tags; use the Solidity compiler to generate an abstract syntax tree from the source code of the smart contract, and prune redundant nodes to obtain View 1;

[0014] Step 2: Use the Ethereum Virtual Machine Control Flow Graph Builder to generate a control flow graph from View 1 obtained in Step 1, and then prune it to obtain View 2;

[0015] Step 3: Use data flow analysis to generate a data flow diagram from view 1 obtained in step 1, and then trim it to obtain view 3;

[0016] Step 4: Using the tree-like hierarchical structure and node types of the abstract syntax tree of View 1 obtained in Step 1 as common features of View 1, View 2, and View 3, extract the features of these three views respectively, and then calculate the loss based on weighted summation. The specific method is as follows:

[0017] First, the features of each node in view 1 are obtained through a word embedding model (such as Doc2Vec, Word2Vec, or FastText). These features are then used as the common features of the three view nodes. Feature vector 1 of view 1 is learned through an extended recurrent neural network. Feature vector 2 of view 2 is learned through a graph attention network. Feature vector 3 of view 3 is learned through a graph attention network.

[0018] Then, a multilayer perceptron is used to fuse feature vector 1, feature vector 2, and feature vector 3 in pairs to obtain feature vector 12, feature vector 13, and feature vector 23. The multilayer perceptron is then used to fuse feature vector 1, feature vector 2, and feature vector 3 in three pairs to obtain feature vector 123.

[0019] Next, loss functions for feature vector 1, feature vector 2, feature vector 3, feature vector 12, feature vector 13, feature vector 23, and feature vector 123 are generated respectively;

[0020] Finally, the seven losses are weighted and summed to obtain the total loss value used to update the parameters;

[0021] Step 5: In the smart contract vulnerability detection stage, the predicted probability of the contract vulnerability corresponding to the seven sets of feature vectors is calculated by the softmax function. Then, the seven predicted probabilities are weighted and summed. Finally, the detection result with the highest predicted probability value is regarded as the smart contract vulnerability.

[0022] Furthermore, the specific method for generating an abstract syntax tree from the smart contract source code in step 1 is as follows:

[0023] First, name the user-defined variables, functions, events, and contracts in a unified order.

[0024] Then, retain the function M in each smart contract that calls externally defined functions or variables, and retain the function W that directly calls the function, while deleting the rest of the functions;

[0025] Finally, remove the variable declarations in each function, and retain only the assignment and type for variable initialization (view 1).

[0026] Each smart contract is handled independently here, focusing only on the internal relationships within the contract and ignoring its external relationships. The only requirement is to find the nodes that call external functions or variables and delete all functions 3 except for function 1 that calls these nodes and function 2 that directly calls these functions 1. By finding the nodes that call external functions or variables, such nodes can be precisely identified as specific functions or variables. This vulnerability detection method is focused on detecting a specific type of vulnerability.

[0027] Furthermore, the detailed method for obtaining view 2 in step 2 is as follows:

[0028] Input View 1 into the Ethereum Virtual Machine Control Flow Graph Constructor to generate control flow edges when function W calls function M; generate control flow edges in function M related to the location of calling externally defined functions or variables; generate control flow edges in function W related to the location of calling function M.

[0029] The simplified control flow graph is formed by combining all the control flow edges and the nodes corresponding to the control flow edges obtained above. The resulting control flow graph is View 2.

[0030] Furthermore, the detailed method for obtaining view 3 in step 3 is as follows:

[0031] Generate data flow edges from the parameter variables of the externally defined function in the M function and the variables obtained by calling the externally defined function;

[0032] The W function calls the M function, which involves the two types of variable data flow edges mentioned above;

[0033] Finally, all the data flow edges and the nodes corresponding to the data flow edges obtained above are combined to form a simplified data flow graph, which is View 3.

[0034] Because the abstract syntax tree captures the hierarchical syntactic structure of code while ignoring surface variations, it becomes an ideal common feature for multi-view models. Control flow graphs and data flow graphs supplement execution semantics and data dependencies. Therefore, step 4 uses the features related to the abstract syntax tree of view 1 as common features to ensure consistency at the syntactic level across different views, avoid information redundancy or conflict, and improve the model's generalization ability. The specific method is as follows:

[0035] Word embedding models extract information from the basic units in each node of an abstract syntax tree to obtain node features;

[0036] Extended recurrent neural networks (ERNs) generate feature vectors for each node in an abstract syntax tree (AST) by aggregating the features of its child nodes. Here, semantic information from both the child nodes and the node itself is integrated, and a GRU-style neural unit is used to compute the hidden state of each node. After iteratively computing the hidden state of each node in the simplified AST in a bottom-up manner, the hidden state of the root node is used as the final semantic vector representation of the simplified AST. This recursive aggregation of hierarchical information preserves semantic integrity and offers significant advantages in handling tree-like structures.

[0037] The initial features of nodes in View 2 and View 3 are input into a two-layer graph attention network structure for attention-enhanced hidden feature aggregation. The first layer of the two-layer graph attention network structure consists of multi-head attention, and the second layer consists of single-head attention. The multi-head attention layer can effectively learn deep semantic features.

[0038] In this process, different models can be used to learn the control flow graph and the data flow graph. The attention mechanism captures the complex dependencies in the graph structure, which improves the performance of graph analysis and has significant advantages in processing graph structures. At the same time, the two network models are adjusted and optimized to extract view features more effectively. The loss function uses cross-entropy loss, and the loss is calculated for each feature separately.

[0039] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0040] (1) This invention solves the problem of existing methods detecting only a limited number of vulnerabilities. This invention can detect more vulnerabilities, mainly because the detection of a single vulnerability only requires simplification based on the characteristics of that vulnerability. The simplification in this solution uses a more ingenious design and does not rely on expert knowledge.

[0041] (2) This invention addresses the problem that existing methods often fail to adequately balance syntactic and semantic information, resulting in low accuracy. The present invention enables the model to more comprehensively capture indicative features of vulnerabilities from the code by using abstract syntax trees, control flow graphs, and data flow graphs to consider both syntactic and semantic information. This solution avoids feature loss and achieves higher prediction accuracy compared to existing vulnerability detection methods. On the SmartBugs dataset, the present invention achieved an average accuracy of 95%, outperforming existing methods used as a control group.

[0042] (3) This invention addresses the problems of reduced model efficiency due to complex representations and overfitting caused by irrelevant information in existing methods. By optimizing the smart contract abstract syntax tree, control flow graph, and data flow graph, and effectively fusing different features, this invention achieves concise code representation, avoiding irrelevant noise. Compared to existing smart contract vulnerability detection methods, this model is more efficient and does not suffer from overfitting. On the SmartBugs dataset, the data preprocessing and training speed of this invention is improved by approximately 20% compared to the control group. Attached Figure Description

[0043] Figure 1 is a schematic diagram of the overall invention;

[0044] Figure 2 is a schematic diagram of different representations of the abstract syntax tree in the embodiment;

[0045] Figure 3 is a schematic diagram of the multi-view fusion method during the training phase of the embodiment;

[0046] Figure 4 is a schematic diagram of the vulnerability detection method during the testing phase of the embodiment. Detailed Implementation

[0047] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0048] As shown in Figure 1, the smart contract vulnerability detection method based on multi-view learning of the present invention includes the following steps:

[0049] Step 1: Obtain the source code of an existing Ethereum smart contract and categorize it with tags; use the Solidity compiler to generate an abstract syntax tree from the source code of the smart contract, and prune redundant nodes to obtain View 1;

[0050] Step 2: Use the Ethereum Virtual Machine Control Flow Graph Builder to generate a control flow graph from View 1 obtained in Step 1, and then prune it to obtain View 2;

[0051] Step 3: Use data flow analysis to generate a data flow diagram from view 1 obtained in step 1, and then trim it to obtain view 3;

[0052] Step 4: Using the tree-like hierarchical structure and node types of the abstract syntax tree of View 1 obtained in Step 1 as common features of View 1, View 2, and View 3, extract the features of these three views respectively, and then calculate the loss based on weighted summation. The specific method is as follows:

[0053] First, the features of each node in view 1 are obtained through a word embedding model as the common features of the three view nodes. Then, feature vector 1 of view 1 is learned through an extended recurrent neural network. Features of view 2 are learned through a graph attention network to obtain feature vector 2. Features of view 3 are learned through a graph attention network to obtain feature vector 3. Next, a multilayer perceptron is used to fuse feature vectors 1, 2, and 3 pairwise to obtain feature vectors 12, 13, and 23. Finally, a multilayer perceptron is used to fuse feature vectors 1, 2, and 3 together to obtain feature vector 123. Then, loss functions are generated for feature vectors 1, 2, 3, 12, 13, 23, and 123 respectively. Finally, the seven loss values ​​are weighted and summed.

[0054] Step 5: In the smart contract vulnerability detection stage, the predicted probability of the contract vulnerability corresponding to the seven sets of feature vectors is calculated by the softmax function. Then, the seven predicted probabilities are weighted and summed. Finally, the detection result with the highest predicted probability value is regarded as the smart contract vulnerability.

[0055] This invention obtains three representations of smart contract source code—abstract syntax tree, control flow graph, and data flow graph—through static analysis of smart contracts. Noisy code outside of external function calls and variable locations is pruned from each representation, and their features are obtained. The abstract syntax tree features are learned through an extended recurrent neural network, and the control flow graph and data flow graph features are learned through a graph attention network. Smart contract vulnerabilities are detected based on the final features obtained by fusing these three features. This multi-view learning-based smart contract vulnerability detection method can more comprehensively capture indicative features of vulnerabilities from the code, simplify redundant noise, and improve the performance and effectiveness of smart contract vulnerability detection.

[0056] Step 1 of this embodiment collects real-world Ethereum smart contract source code and marks the collected source code for vulnerabilities. A vulnerability in a smart contract is marked as "1", and a non-vulnerable smart contract is marked as "0". To ensure the source code can be correctly read by the compiler, the source code is standardized by conforming to the standard JSON input format of SOLC. Then, an abstract syntax tree (AST) is generated from the processed source code. This standardization primarily involves simplifying the AST, removing redundant nodes, and eliminating redundant functions unrelated to externally defined functions and variables. The resulting standard JSON file is then used to generate a simplified AST using py-solc-x (a third-party Python package). The specific method is as follows:

[0057] First, name the user-defined variables, functions, events, and contracts in the same order.

[0058] Then, retain the function M in each smart contract that calls externally defined functions or variables, and retain the function W that directly calls the function, while deleting the rest of the functions;

[0059] Finally, delete the variable declarations in each of the functions obtained above (that is, mark the actual value assigned to the variable as "assignment" without retaining the actual value assigned), and retain only the assignment and type for variable initialization.

[0060] The following steps are further performed in this embodiment:

[0061] For each contract, iterate through each function within the contract. If a function's nodes contain nodes that call external functions or variables, this function is called `m`. After traversing the contract once, we obtain a set of functions M = {m1, m2, ..., mi}. Here, "external functions" and "variables" refer to functions and variables that are not user-defined. Iterate through each function in the contract again, excluding set M. If a function's nodes contain nodes that call functions in set M, this function is called `w`. After traversing the contract once, we obtain a set of functions W = {w1, w2, ..., wj}. For each function within a contract, only functions from sets M and W are retained; functions not in sets M and W are deleted. The abstract syntax tree resulting from the above operations is then serialized.

[0062] Each node in the simplified abstract syntax tree is traversed in depth-first search order. Nodes with the same meaning are called a Token, and the Tokens are numbered starting from 0 according to the order in which the node numbers appear. A Token value attribute is added to each node, and the Token value of each node is used to represent the node. The Token value is not unique to each source code, but is a mapping table of node content and Token number shared by all source codes.

[0063] The different representations of the abstract syntax tree obtained in this embodiment are shown in Figure 2. Given the correspondence between token values ​​and nodes, for the given abstract syntax tree in the figure, the order ["<=", "+", "a", "b", "c"] is obtained through depth-first search. These are then placed into a List with the corresponding order: ["<="], ["<=", ["+"]], ["<=", ["+", ["a"]]], ["<=", ["+", ["a", "b"]]], ["<=", ["+", ["a", "b"], "c"]]. Here, node "<=" is the parent node of nodes "+" and "c", and "+" is the parent node of nodes "a" and "b". Substituting the token values ​​into the corresponding nodes yields the required format [12, [3, [5, 8], 16] for the input tree model and the required format [12, 3, 5, 8, 16] for generating node features.

[0064] In this embodiment, step 2 further processes the simplified abstract syntax tree obtained in step 1 to obtain a simplified control flow graph and data flow graph, as follows:

[0065] Input View 1 into the Ethereum Virtual Machine Control Flow Graph Builder to generate control flow edges when function W calls function M; generate control flow edges in function M related to the location of calling externally defined functions or variables; generate control flow edges in function W related to the location of calling function M; combine all the control flow edges obtained above and the nodes corresponding to the control flow edges to form a simplified control flow graph, and the resulting control flow graph is View 2.

[0066] The parameter variables of the externally defined function in the M function and the variables obtained by calling the externally defined function are generated as data flow edges; the data flow edges involving the above two types of variables in the call to the M function by the W function are generated; finally, all the data flow edges obtained above and the nodes corresponding to the data flow edges are combined to form a simplified data flow graph, which is View 3.

[0067] Add conditional and loop structures such as If, While, For, and Require from the control flow graph to the abstract syntax tree. First, find the abstract syntax tree nodes corresponding to the start and destination statements of the control flow. Then, add the corresponding control flow edges between the two nodes of the abstract syntax tree according to the type and direction of the control flow.

[0068] For each function in the contract that belongs to the function set M, first, perform a depth-first traversal of the function to find the nodes that call external functions or external variables. Add all control flow edges related to these nodes from the root node. A control flow edge related to a node refers to one or more unbranched paths from the root node to that node. For each function in the contract that belongs to the function set W, first, perform a depth-first traversal of the function to find the nodes that directly call functions in set M. Add all control flow edges related to these nodes from the root node. Consider the set of all control flow edges E1 and the set of nodes connecting them V1 as the simplified control flow graph G1={V1,E1}. The generated simplified data flow graph is based on the simplified abstract syntax tree and can be considered a subgraph of the abstract syntax tree.

[0069] For each function in the function set M within the contract, a depth-first traversal is performed to find nodes that call external functions or external variables. Nodes directly related to these external functions are considered key nodes. A key node is defined as either a parameter variable of an external function or a variable assigned a value using that external function, or a variable assigned a value using that external variable. A second depth-first traversal is performed on each function in the function set M to find nodes with the same token value as key nodes. Data flow edges are added between these nodes, indicating that the key node originates from these shared nodes. Nodes with assignment relationships to key nodes are also found, and data flow edges are added to them, indicating that the key node's value is assigned by these nodes. The set of all data flow edges E2 and the set of nodes connecting them V2 are considered as a simplified data flow graph G2={V2,E2}.

[0070] The specific process of step 4 in this embodiment is as follows:

[0071] Using the features (a one-dimensional vector of tokens) related to the abstract syntax tree in View 1 as common features, a word embedding model is used to extract information from the basic units in each node (token sequence) of the abstract syntax tree to obtain node features.

[0072] Extended recurrent neural networks generate feature vectors for each node in an abstract syntax tree by aggregating the features of child nodes in the abstract syntax tree. They integrate the semantic information of child nodes and the nodes themselves, and use GRU-style neural units to calculate the hidden state of the nodes. After iteratively calculating the hidden state of each node in the simplified abstract syntax tree, the hidden state of the root node is used as the final semantic vector representation of the simplified abstract syntax tree.

[0073] The initial features of the nodes in View 2 and View 3 are input into a two-layer graph attention network to perform attention-enhanced hidden feature aggregation. The first layer of the two-layer graph attention network consists of multi-head attention, and the second layer consists of single-head attention. Deep semantic features are learned using the multi-attention layer.

[0074] In this embodiment, the final output of both the extended recurrent neural network and the two-layer graph attention network structure is an m*128 array, where m is the number of input graphs, i.e., the number of input source code files, i.e., each source code file corresponds to a one-dimensional vector of length 128.

[0075] In this embodiment, the word embedding model, extended recurrent neural network, and two-layer graph attention network structure are regarded as a multi-view learning model. The three features output by the multi-view learning model (three arrays of size m*128) are fused and the final detection result is obtained through a classifier.

[0076] In the classifier, three arrays are input into the fully connected layer, resulting in three arrays of size m*2. These three arrays are named A, B, and C. A and B are merged to obtain array AB; A and C are merged to obtain array AC; B and C are merged to obtain array BC; and A, B, and C are merged to obtain array ABC, resulting in four arrays of size m*2. Here, A is the final feature of the abstract syntax tree, B is the final feature of the control flow graph, and C is the final feature of the data flow graph.

[0077] The fusion method used involves concatenating the arrays using a multilayer perceptron and setting the output dimension of the new array to m*2. As shown in Figure 3, this results in seven arrays: A, B, C, AB, AC, BC, and ABC. These seven arrays are used as the model's outputs, and the loss function for each output can be calculated separately. Finally, the seven loss functions are summed according to their weights to obtain the total loss value used for updating the parameters.

[0078] The training process of a multi-view learning model is represented as follows:

[0079] ;in, These are the weight parameters corresponding to the features. Label the dataset; This is the loss function. For the corresponding view The basic model, This is the final optimized model.

[0080] During the smart contract vulnerability detection phase, as shown in Figure 4, the multi-view learning model outputs seven sets of feature vectors: A, B, C, AB, AC, BC, and ABC.

[0081] The predicted probabilities of seven feature vectors are calculated using the softmax function, then the predicted probabilities of each feature vector are weighted and summed, and the result with the higher predicted probability is taken as the final detection result. The calculation method is as follows:

[0082] ;

[0083] in This is the optimal meta-model. ,..., Indicate each feature, This is the final predicted value. This is the corresponding basic model.

Claims

1. A smart contract vulnerability detection method based on multi-view learning, characterized in that, Includes the following steps: Step 1: Obtain the existing Ethereum smart contract source code and categorize it with tags; use the Solidity compiler to generate an abstract syntax tree from the smart contract source code, prune redundant nodes to obtain View 1; for a smart contract, if a node in a function contains nodes that call external functions or variables, the function is called function M; if a node in a function contains nodes that call functions in set M, the function is called function W; Step 2: Use the Ethereum Virtual Machine Control Flow Graph Builder to generate a control flow graph from View 1 obtained in Step 1, and prune it to obtain View 2; specifically, input View 1 into the Ethereum Virtual Machine Control Flow Graph Builder to generate control flow edges when function W calls function M; generate control flow edges between function W and function M that call external functions; Use the position-related control flow edges of externally defined functions or variables; generate control flow edges in the W function related to the position of calling the M function; combine all the control flow edges obtained above and the nodes corresponding to the control flow edges to form a simplified control flow graph, which is View 2; Step 3: Use data flow analysis to generate a data flow graph from View 1 obtained in Step 1, and prune it to obtain View 3; The detailed method for obtaining View 3 is as follows: generate data flow edges from the parameter variables of the externally defined functions in the M function and the variables obtained by calling the externally defined functions; generate data flow edges from the parameter variables of the W function that involve the above two types of variables when calling the M function; finally, combine all the data flow edges obtained above and the nodes corresponding to the data flow edges to form a simplified data flow graph. This simplified data flow diagram is View 3; Step 4: Using the tree-like hierarchical structure and node types of the abstract syntax tree of View 1 obtained in Step 1 as common features of View 1, View 2, and View 3, extract the features of these three views respectively, and then calculate the loss based on weighted summation. The specific method is as follows: First, obtain the features of each node in View 1 through a word embedding model as common features of the nodes of the three views; learn feature vector 1 of View 1 through an extended recurrent neural network; learn the features of View 2 through a graph attention network to obtain feature vector 2; learn the features of View 3 through a graph attention network to obtain feature vector 3; then use a multilayer perceptron to fuse feature vector 1, feature vector 2, and feature vector 3 pairwise to obtain the feature vector 3. Feature vector 12, feature vector 13, and feature vector 23 are fused using a multilayer perceptron to obtain feature vector 123. Next, loss functions are generated for feature vector 1, feature vector 2, feature vector 3, feature vector 12, feature vector 13, feature vector 23, and feature vector 123 respectively. Finally, the seven losses are weighted and summed to obtain the total loss value used to update the parameters. In step 5, the smart contract vulnerability detection stage, the predicted probability of the contract vulnerability corresponding to the above seven sets of feature vectors is calculated using the softmax function. Then, the seven predicted probabilities are weighted and summed. Finally, the detection result with the highest predicted probability value is regarded as the smart contract vulnerability.

2. The smart contract vulnerability detection method based on multi-view learning according to claim 1, characterized in that, The specific method for generating an abstract syntax tree from the smart contract source code in step 1 is as follows: First, the user-defined variables, functions, events, and contracts are named in the same order. Then, functions M that call externally defined functions or variables in each smart contract are retained, as well as functions W that directly call these functions, while the remaining functions are deleted. Finally, the declarations of variables in each function obtained above are deleted, and only the assignment and type are retained for variable initialization, thus obtaining View 1.

3. The smart contract vulnerability detection method based on multi-view learning according to claim 1, characterized in that, The specific process of step 4 is as follows: taking the features related to the abstract syntax tree of view 1 as common features, using the word embedding model to extract information from the basic units in each node of the abstract syntax tree to obtain node features; Extended recurrent neural networks (ERNs) generate feature vectors for each node in an abstract syntax tree (AST) by aggregating the features of child nodes. They integrate the semantic information of child nodes and the nodes themselves, and use GRU-style neural units to calculate the hidden states of nodes. After iteratively calculating the hidden states of each node in the simplified AST, the hidden state of the root node is used as the final semantic vector representation of the simplified AST. The initial features of nodes in View 2 and View 3 are input into a two-layer graph attention network for attention-enhanced hidden feature aggregation. The first layer of the two-layer graph attention network consists of multi-head attention, and the second layer consists of single-head attention. Deep semantic features are learned using the multi-head attention layer.

Images