Security vulnerability detection method and system applied to smart contract

Abstract

The invention is suitable for the technical field of network security, and provides a security vulnerability detection method and system applied to a smart contract, and the method comprises the steps: firstly obtaining malicious activity frequency information of each to-be-monitored network node, then rapidly determining a target network node based on the malicious activity frequency information, and finally, according to the contract log information of the target network node, determining the security vulnerability of the target network node. Abnormal function fragment information is accurately determined, and finally transaction risk information is effectively generated according to the abnormal function fragment information. According to the method, subjective judgment in manual analysis can be remarkably reduced, missing detection and false detection phenomena can be avoided, the detection accuracy and efficiency can be greatly improved, meanwhile, potential abnormal events can be predicted in advance, the early warning capability is enhanced, a security team is assisted to take countermeasures in time, occurred security holes can be comprehensively repaired, and the safety performance of the security team is improved. And potential risks can be effectively prevented, safe and stable operation of the whole system is guaranteed, and the information security management level and protection capability of the block chain network are improved.

Description

Technical Field

[0001] This application relates to the technical field of network security, and more specifically, to a method and system for detecting security vulnerabilities in smart contracts. Background Technology

[0002] Blockchain technology is a decentralized distributed ledger technology initially designed for cryptocurrencies such as Bitcoin. Due to its characteristics—no single controller, maintenance by multiple nodes, and visibility of all transaction records to all participants in the network—blockchain technology has gained wider application. Smart contracts are protocols or contracts defined in code that run on the blockchain.

[0003] Furthermore, smart contracts are protocols or contracts defined in code that can be executed automatically on the blockchain. They are triggered by preset conditions, achieving self-execution without intermediaries and building trust.

[0004] Currently, vulnerability detection for smart contracts mainly relies on the involvement of expert knowledge, which often requires a large amount of manpower. Moreover, due to its significant subjectivity, it frequently results in missed or false detections, leading to poor detection effectiveness, which needs further improvement. Summary of the Invention

[0005] Based on this, embodiments of this application provide a security vulnerability detection method and system for smart contracts to solve the problem of poor detection performance in the prior art.

[0006] In a first aspect, embodiments of this application provide a security vulnerability detection method for smart contracts, the method comprising: Based on a pre-set blockchain network, information on the number of malicious activities of each network node to be monitored is obtained; The target network node is determined based on the malicious activity count information and the preset abnormal activity count threshold information; Based on the contract log information of the target network node, determine the abnormal function fragment information; Based on the abnormal function fragment information, transaction risk information is generated.

[0007] Compared with existing technologies, the beneficial effects are as follows: The security vulnerability detection method for smart contracts provided in this application allows the terminal device to first obtain information on the number of malicious activities of each network node to be monitored based on a preset blockchain network. Then, based on the information on the number of malicious activities and the preset threshold information on the number of abnormal activities, the target network node is quickly identified. Next, based on the contract log information of the target network node, the abnormal function fragment information is accurately determined. Finally, based on the abnormal function fragment information, transaction risk information is effectively generated, thereby significantly reducing the subjectivity of manual analysis, comprehensively avoiding missed detections and false detections, effectively improving the detection effect, and to a certain extent solving the problem of poor detection effect at present.

[0008] Secondly, embodiments of this application provide a security vulnerability detection system for smart contracts, the system comprising: Malicious Activity Count Information Acquisition Module: Used to acquire malicious activity count information for each network node to be monitored based on a preset blockchain network; Target network node determination module: used to determine the target network node based on the malicious activity count information and the preset abnormal activity count threshold information; Exception function fragment information determination module: used to determine exception function fragment information based on the contract log information of the target network node; Trading risk information generation module: used to generate trading risk information based on the abnormal function fragment information.

[0009] Thirdly, embodiments of this application provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0010] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in the first aspect above.

[0011] It is understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0013] Figure 1 This is a flowchart illustrating a security vulnerability detection method provided in an embodiment of this application; Figure 2 This is a flowchart illustrating step S200 in a security vulnerability detection method provided in an embodiment of this application; Figure 3 This is a flowchart illustrating step S300 in a security vulnerability detection method provided in an embodiment of this application; Figure 4 This is a flowchart illustrating the process after step S301 in a security vulnerability detection method provided in an embodiment of this application. Figure 5 This is a flowchart illustrating the process after step S305 in a security vulnerability detection method provided in an embodiment of this application. Figure 6 This is a flowchart illustrating the process after step S307 in a security vulnerability detection method provided in an embodiment of this application; Figure 7 This is a block diagram of a security vulnerability detection system provided in one embodiment of this application; Figure 8 This is a schematic diagram of a terminal device provided in an embodiment of this application. Detailed Implementation

[0014] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0015] In the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0016] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0017] To illustrate the technical solution described in this application, specific embodiments are provided below.

[0018] Please see Figure 1 , Figure 1 This is a flowchart illustrating a security vulnerability detection method for smart contracts provided in this application embodiment. In this embodiment, the execution subject of the security vulnerability detection method is a terminal device. It is understood that the types of terminal devices include, but are not limited to, mobile phones, tablets, laptops, Ultra-Mobile Personal Computers (UMPCs), netbooks, Personal Digital Assistants (PDAs), etc. This application embodiment does not impose any restrictions on the specific type of terminal device.

[0019] Please see Figure 1 The security vulnerability detection method provided in this application includes, but is not limited to, the following steps: In S100, information on the number of malicious activities of each network node to be monitored is obtained based on a preset blockchain network.

[0020] Specifically, the terminal device can first obtain information on the number of malicious activities of each network node to be monitored based on a preset blockchain network. The network node to be monitored is used to describe any network node in the blockchain network; the number of malicious activities is used to describe the total number of times any network node in the blockchain network has initiated malicious activities. Malicious activities can be frequently initiating a large number of transactions or frequently receiving a large number of transactions in a short period of time.

[0021] In S200, the target network node is determined based on the information on the number of malicious activities and the preset threshold information on the number of abnormal activities.

[0022] Specifically, after the terminal device obtains information on the number of malicious activities, it can accurately determine the target network node based on the information on the number of malicious activities and the preset threshold information on the number of abnormal activities, thereby enabling the rapid location of abnormal network nodes in the blockchain.

[0023] In some possible implementations, to determine the target network node, please refer to [link / reference needed]. Figure 2 Step S200 includes, but is not limited to, the following steps: In S210, for each network node to be monitored, the information on the number of malicious activities is compared with the preset threshold information on the number of abnormal activities.

[0024] Specifically, the terminal device can perform this process for each network node to be monitored: compare the number of malicious activities with the preset threshold for the number of abnormal activities. The threshold for the number of abnormal activities serves as a boundary value for measuring whether the target network node has vulnerabilities, and the value of the threshold for the number of abnormal activities is defined by the operation and maintenance personnel.

[0025] In S220, if the number of malicious activities exceeds the threshold for abnormal activities, the network node to be monitored is identified as the target network node.

[0026] Specifically, if the number of malicious activities exceeds the threshold for abnormal activities, it indicates that the network node has a security vulnerability. Therefore, the terminal device can quickly identify the network node to be monitored as the target network node.

[0027] In S300, the abnormal function fragment information is determined based on the contract log information of the target network node.

[0028] Specifically, after the terminal device identifies the target network node, it can effectively determine the abnormal function fragment information based on the contract log information of the target network node. The target network node includes multiple contract log information and the function fragment information to be monitored corresponding to each contract log information. The contract log information is used to describe the contract log of the smart contract contained in the target network node. The function fragment information to be monitored is used to describe a certain function fragment in the contract log.

[0029] In some possible implementations, for efficient determination of exception function fragment information, please refer to [link / reference]. Figure 3 Step S300 includes, but is not limited to, the following steps: In S310, for each contract log information corresponding to each function fragment to be monitored, the call count information of the function fragment to be monitored is obtained based on the preset sampling time period.

[0030] Specifically, the terminal device can sequentially perform this processing on each function fragment to be monitored corresponding to each contract log information: based on a preset sampling time period, obtain the call count information of the function fragment to be monitored, where the value of the sampling time period is customized by the operation and maintenance personnel; the call count information is used to describe the total number of times the function fragment is called within the sampling time period.

[0031] In S320, the call count information is compared with the preset call count threshold information.

[0032] Specifically, after the terminal device obtains the call count information, it can compare the call count information with the preset call count threshold information, where the value of the call count threshold information is customized by the operation and maintenance personnel.

[0033] In S330, if the number of calls is greater than or equal to the number of calls threshold, the function fragment to be monitored is determined to be an abnormal function fragment.

[0034] Specifically, if the number of calls is greater than or equal to the call count threshold, it indicates that the call frequency of the function segment is significantly abnormal. Therefore, the terminal device can determine that the function segment to be monitored is an abnormal function segment.

[0035] In S340, if the number of calls is less than the number of calls threshold, the sampling time period is increased based on the preset time increment value, and the sampling time period is increased again to obtain the number of calls of the function fragment to be monitored and compare it with the preset number of calls threshold until the sampling time period is greater than the preset pause duration threshold or the number of calls is greater than the number of calls threshold.

[0036] Specifically, if the number of calls is less than the call count threshold, the terminal device can increase the sampling time period based on a preset time increment value. By adding the time increment value to the old sampling time period, a new sampling time period is generated. Then, steps S310 to S320 are executed again until the sampling time period is greater than the preset pause duration threshold, or the number of calls is greater than the call count threshold. The value of the time increment value is defined by the maintenance personnel and can be one-tenth of the sampling time period. The value of the pause duration threshold is also defined by the maintenance personnel and can be three times the sampling time period.

[0037] For a comprehensive approach to addressing various security vulnerabilities, please refer to the following descriptions of possible implementations. Figure 4 After step S300, the method further includes, but is not limited to, the following steps: In S301, the current abnormal event type information of the abnormal function fragment information is obtained, and the historical abnormal event set information of the blockchain network is obtained.

[0038] Specifically, the terminal device can obtain the current abnormal event type information of the abnormal function fragment information and obtain the historical abnormal event set information of the blockchain network. The current abnormal event type information is used to describe the type of abnormal event corresponding to the abnormal function fragment information. The historical anomaly event set information includes multiple historical anomaly event type information and the historical occurrence count information corresponding to each historical anomaly event type information; the historical anomaly event type information is used to describe the type of anomaly event corresponding to the security vulnerability when the security vulnerability occurred in history; the historical occurrence count information is used to describe the total number of times the anomaly event corresponding to the security vulnerability has occurred in history.

[0039] In S302, the information on multiple historical abnormal event types is sorted according to the order of the number of occurrences from most to least, and an abnormal event sorting table is generated.

[0040] Specifically, after the terminal device obtains the current abnormal event type information, the terminal device can sort multiple historical abnormal event type information according to the order of the number of occurrences in descending order, and generate abnormal event sorting table information. The abnormal event sorting table information is used to describe the sorting table after sorting multiple historical abnormal event type information according to the order of the number of occurrences in descending order.

[0041] In S303, based on a preset partitioning ratio, the abnormal event sorting table information is partitioned to generate a rare event type set information.

[0042] Specifically, after the terminal device generates the abnormal event sorting table information, the terminal device can divide the abnormal event sorting table information based on a preset division ratio, and determine the last 5% of the historical abnormal event type information in the abnormal event sorting table information as the rare event type set information. The rare event type set information includes the last 5% of the historical abnormal event type information in the abnormal event sorting table information.

[0043] In S304, it is determined whether the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information.

[0044] Specifically, after the terminal device generates the rare event type set information, the terminal device can determine whether the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information.

[0045] In S305, if the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information, then the current abnormal event type information is determined to be rare event type information.

[0046] Specifically, if the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information, it means that the security vulnerability has occurred very rarely in history, has rarity and high analytical value, so the terminal device can determine that the current abnormal event type information is rare event type information.

[0047] In S306, if the current abnormal event type information is not the same as any of the historical abnormal event type information in the rare event type set information, then it is determined whether the current abnormal event type information is the same as any of the historical abnormal event type information in the historical abnormal event set information.

[0048] Specifically, if the current abnormal event type information is not the same as any of the historical abnormal event type information in the rare event type set information, the terminal device can determine whether the current abnormal event type information is the same as any of the historical abnormal event type information in the historical abnormal event set information.

[0049] In S307, if the current abnormal event type information is not the same as any of the historical abnormal event type information in the historical abnormal event set information, then the current abnormal event type information is determined to be special event type information.

[0050] Specifically, if the current abnormal event type information is not the same as any of the historical abnormal event type information in the historical abnormal event set information, it means that the security vulnerability has never occurred in the past, is more rare and has more high analytical value. Therefore, the terminal device can determine that the current abnormal event type information is special event type information.

[0051] In some possible implementations, to enable advance prediction of potential anomalies and facilitate comprehensive remediation of various existing or potential security vulnerabilities, please refer to [link / reference needed]. Figure 5 After step S305, the method further includes, but is not limited to, the following steps: In S3051, if any historical abnormal event type information in the rare event type set information is the same as the current abnormal event type information, then the same abnormal event type information is determined.

[0052] Specifically, if any historical abnormal event type information in the rare event type set information is the same as the current abnormal event type information, the terminal device can determine the same abnormal event type information. The same abnormal event type information is used to describe the historical abnormal event type information in the rare event type set information that is the same as the current abnormal event type information.

[0053] In S3052, the same information is determined based on the exception function fragment information of the current exception event type information and the exception function fragment information of the same exception event type information.

[0054] Specifically, after the terminal device determines the same abnormal event type information, it can effectively determine the common information based on the abnormal function fragment information corresponding to the current abnormal event type information and the abnormal function fragment information corresponding to the same abnormal event type information. The common information describes the parts that are the same between the abnormal function fragment information corresponding to the current abnormal event type information and the abnormal function fragment information corresponding to the same abnormal event type information. The common information includes function modifier information, function name information, parameter list information, return value information and / or function body information.

[0055] In S3053, the difference information is determined based on the exception function fragment information and the same part information of the current exception event type information.

[0056] Specifically, after the terminal device determines the common part information, the terminal device can determine the difference part information based on the exception function fragment information of the current exception event type information and the common part information. The difference part information is used to describe the part that is different between the exception function fragment information of the current exception event type information and the common part information.

[0057] In S3054, extended function fragment information is generated based on a preset random generation algorithm and the difference information.

[0058] Specifically, after the terminal device determines the difference information, it can randomly generate new function fragments according to the structure of the difference information based on a preset random generation algorithm, effectively generating extended function fragment information, thereby enabling valuable transformations based on this rare vulnerability.

[0059] In S3055, predicted vulnerability information is generated based on the same partial information and extended function fragment information.

[0060] Specifically, after the terminal device generates extended function fragment information, it can generate predicted vulnerability information based on the same partial information and extended function fragment information, thereby predicting security vulnerabilities that have not yet occurred, which is beneficial for early prevention.

[0061] In some possible implementations, to help operations and maintenance personnel stay informed about specific network security situations, please refer to [link / reference]. Figure 6 After step S307, the method further includes, but is not limited to, the following steps: In S3071, exception function fragment information and predicted vulnerability information are sent to the designated monitoring terminal.

[0062] Specifically, the terminal device can send abnormal function fragment information and predicted vulnerability information to the designated monitoring terminal, where the monitoring terminal is used to describe the terminal corresponding to the operation and maintenance personnel.

[0063] or In S3072, special event type information is sent to the designated monitoring terminal.

[0064] Specifically, terminal devices can send special event type information to designated monitoring terminals.

[0065] In S400, transaction risk information is generated based on the information from the exception function fragment.

[0066] In some possible implementations, in order to generate transaction risk information, step S400 includes, but is not limited to, the following steps: In S410, if there is abnormal function fragment information, then transaction risk information is generated.

[0067] Specifically, if abnormal function fragment information exists, the terminal device can generate transaction risk information, thereby quickly and accurately identifying security vulnerabilities. The transaction risk information is used to describe the transaction risks present in the network nodes to be monitored.

[0068] The implementation principle of the security vulnerability detection method for smart contracts in this application embodiment is as follows: The terminal device can first obtain information on the number of malicious activities of each network node to be monitored based on a preset blockchain network. Then, based on the information on the number of malicious activities and the preset threshold information on the number of abnormal activities, the target network node is quickly determined. Then, based on the contract log information of the target network node, the abnormal function fragment information is accurately determined. Finally, based on the abnormal function fragment information, transaction risk information is effectively generated, thereby greatly reducing the subjectivity of manual analysis, avoiding missed detections and false detections, and effectively improving the detection effect.

[0069] It should be noted that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0070] Embodiments of this application also provide a security vulnerability detection system for smart contracts. For ease of explanation, only the parts relevant to this application are shown, such as... Figure 7 As shown, the system 70 includes: Malicious activity count information acquisition module 71: used to acquire malicious activity count information of each network node to be monitored based on a preset blockchain network; Target network node determination module 72: used to determine target network nodes based on malicious activity count information and preset abnormal activity count threshold information; Module 73 for determining abnormal function fragment information: used to determine abnormal function fragment information based on the contract log information of the target network node; Transaction risk information generation module 74: Used to generate transaction risk information based on abnormal function fragment information.

[0071] Optionally, the target network node determination module 72 mentioned above includes: Malicious activity count comparison submodule: used to compare the malicious activity count information with the preset abnormal activity count threshold information for each network node to be monitored; The target network node determination submodule is used to determine the network node to be monitored as the target network node if the number of malicious activities is greater than the threshold of abnormal activities.

[0072] Accordingly, the target network node includes multiple contract log information and the corresponding function fragment information to be monitored for each contract log information; the above-mentioned abnormal function fragment information determination module 73 includes: Call count information acquisition submodule: used to sequentially acquire the call count information of each function fragment to be monitored for each contract log information based on a preset sampling time period; Call count information comparison submodule: used to compare call count information with preset call count threshold information; The abnormal function fragment information determination submodule is used to determine the function fragment information to be monitored as abnormal function fragment information if the call count information is greater than or equal to the call count threshold information; The submodule is executed again: if the number of calls is less than the number of calls threshold, the sampling time period is increased based on the preset time increment value, and the module is executed again based on the preset sampling time period to obtain the number of calls of the function fragment to be monitored and compare it with the number of calls threshold until the sampling time period is greater than the preset pause duration threshold or the number of calls is greater than the number of calls threshold. Accordingly, the aforementioned transaction risk information generation module 74 includes: The transaction risk information generation submodule is used to generate transaction risk information if abnormal function fragment information exists. The transaction risk information describes the existence of transaction risks in the network nodes to be monitored.

[0073] Optionally, the system 70 also includes: Historical anomaly event set information acquisition module: used to acquire the current anomaly event type information of the anomaly function fragment information, and to acquire the historical anomaly event set information of the blockchain network. The historical anomaly event set information includes multiple historical anomaly event type information and the historical occurrence number information corresponding to each historical anomaly event type information. The abnormal event sorting table information generation module is used to sort multiple historical abnormal event types in descending order of historical occurrence frequency information and generate abnormal event sorting table information. Rare event type set information generation module: used to divide the abnormal event sorting table information based on a preset division ratio and generate rare event type set information; The first judgment module for current abnormal event type information is used to determine whether the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information; Rare event type information determination module: If the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information, then the current abnormal event type information is determined to be rare event type information. The second judgment module for current abnormal event type information is used to determine whether the current abnormal event type information is not the same as any historical abnormal event type information in the rare event type set information if the current abnormal event type information is not the same as any historical abnormal event type information in the rare event type set information. Special event type information determination module: If the current abnormal event type information is not the same as any of the historical abnormal event type information in the historical abnormal event set, then the current abnormal event type information is determined to be special event type information.

[0074] Optionally, the system 70 also includes: The module for determining the same abnormal event type information is used to determine the same abnormal event type information if any historical abnormal event type information in the rare event type set information is the same as the current abnormal event type information. The same abnormal event type information is used to describe the historical abnormal event type information in the rare event type set information that is the same as the current abnormal event type information. The module for determining identical information is used to determine identical information based on the exception function fragment information of the current exception event type information and the exception function fragment information of the same exception event type information. The identical information includes function modifier information, function name information, parameter list information, return value information and / or function body information. The module for determining the difference information is used to determine the difference information based on the exception function fragment information and the information on the same part of the current exception event type information. Extended function fragment information generation module: used to generate extended function fragment information based on a preset random generation algorithm and difference information; Predictive vulnerability information generation module: Used to generate predicted vulnerability information based on the same partial information and extended function fragment information.

[0075] Optionally, the system 70 also includes: Exception Function Fragment Information Sending Module: Used to send exception function fragment information and predicted vulnerability information to the specified monitoring terminal; or Special event type information sending module: used to send special event type information to the specified monitoring terminal.

[0076] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0077] This application also provides a terminal device, such as... Figure 8 As shown, the terminal device 80 in this embodiment includes: a processor 81, a memory 82, and a computer program 83 stored in the memory 82 and executable on the processor 81. When the processor 81 executes the computer program 83, it implements the steps in the above-described security vulnerability detection method embodiment, for example... Figure 1 Steps S100 to S400 are shown; or, when processor 81 executes computer program 83, it implements the functions of each module in the above-described device, for example... Figure 7 The functions of modules 71 to 47 are shown.

[0078] The terminal device 80 can be a desktop computer, laptop, handheld computer, cloud server, or other computing device, and includes, but is not limited to, a processor 81 and a memory 82. Those skilled in the art will understand that... Figure 8 This is merely an example of terminal device 80 and does not constitute a limitation on terminal device 80. It may include more or fewer components than shown, or combine certain components, or different components. For example, terminal device 80 may also include input / output devices, network access devices, buses, etc.

[0079] The processor 81 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.; the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0080] The memory 82 can be an internal storage unit of the terminal device 80, such as a hard disk or memory of the terminal device 80. The memory 82 can also be an external storage device of the terminal device 80, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the terminal device 80. Furthermore, the memory 82 can include both internal storage units and external storage devices of the terminal device 80. The memory 82 can also store computer program 83 and other programs and data required by the terminal device 80. The memory 82 can also be used to temporarily store data that has been output or will be output.

[0081] One embodiment of this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include any entity or device capable of carrying computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0082] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the methods, principles and structures of this application should be covered within the scope of protection of this application.

Claims

1. A method for detecting security vulnerabilities in smart contracts, characterized in that, The method includes: Based on a pre-set blockchain network, information on the number of malicious activities of each network node to be monitored is obtained; The target network node is determined based on the malicious activity count information and the preset abnormal activity count threshold information; Based on the contract log information of the target network node, determine the abnormal function fragment information; Based on the abnormal function fragment information, transaction risk information is generated.

2. The method according to claim 1, characterized in that, The step of determining the target network node based on the malicious activity count information and the preset abnormal activity count threshold information includes: For each of the network nodes to be monitored: compare the malicious activity count information with the preset abnormal activity count threshold information; If the number of malicious activities is greater than the threshold for abnormal activities, then the network node to be monitored is determined to be the target network node. Accordingly, the target network node includes multiple contract log information and corresponding function fragment information to be monitored for each contract log information; determining the abnormal function fragment information based on the contract log information of the target network node includes: For each contract log information corresponding to each monitored function fragment: based on a preset sampling time period, obtain the call count information of the monitored function fragment information; Compare the call count information with the preset call count threshold information; If the number of calls is greater than or equal to the number of calls threshold, then the function fragment to be monitored is determined to be an abnormal function fragment. If the number of calls is less than the number of calls threshold, the sampling time period is increased based on the preset time increment value, and the sampling time period is increased again to obtain the number of calls of the function fragment to be monitored and compare the number of calls with the preset number of calls threshold until the sampling time period is greater than the preset pause duration threshold or the number of calls is greater than the number of calls threshold. Accordingly, generating transaction risk information based on the abnormal function fragment information includes: If the abnormal function fragment information exists, transaction risk information is generated, wherein the transaction risk information is used to describe the existence of transaction risks in the network node to be monitored.

3. The method according to claim 1, characterized in that, After determining the abnormal function fragment information based on the contract log information of the target network node, the method further includes: Obtain the current abnormal event type information of the abnormal function fragment information, and obtain the historical abnormal event set information of the blockchain network, wherein the historical abnormal event set information includes multiple historical abnormal event type information and the historical occurrence number information corresponding to each historical abnormal event type information; Based on the historical occurrence information from most to least, sort the information of multiple historical abnormal event types to generate an abnormal event sorting table. Based on a preset partitioning ratio, the abnormal event sorting table information is partitioned to generate a rare event type set information. Determine whether the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information; If the current abnormal event type information is the same as any historical abnormal event type information in the rare event type set information, then the current abnormal event type information is determined to be rare event type information. If the current abnormal event type information is not the same as any of the historical abnormal event type information in the rare event type set information, then determine whether the current abnormal event type information is not the same as any of the historical abnormal event type information in the historical abnormal event set information. If the current abnormal event type information is not the same as any of the historical abnormal event type information in the historical abnormal event set information, then the current abnormal event type information is determined to be special event type information.

4. The method according to claim 3, characterized in that, After determining that the current abnormal event type information is rare event type information if it is the same as any historical abnormal event type information in the rare event type set information, the method further includes: If any historical abnormal event type information in the rare event type set information is the same as the current abnormal event type information, then the same abnormal event type information is determined, wherein the same abnormal event type information is used to describe the historical abnormal event type information in the rare event type set information that is the same as the current abnormal event type information. Based on the exception function fragment information of the current exception event type information and the exception function fragment information of the same exception event type information, the same part information is determined, wherein the same part information includes function modifier information, function name information, parameter list information, return value information and / or function body information; Based on the exception function fragment information and the same part information of the current abnormal event type information, determine the difference part information; Based on the preset random generation algorithm and the difference information, expand function fragment information is generated; Based on the shared information and extended function fragment information, predictive vulnerability information is generated.

5. The method according to claim 4, characterized in that, After determining that the current abnormal event type information is a special event type information if it is not the same as any historical abnormal event type information in the historical abnormal event set information, the method further includes: Send the abnormal function fragment information and predicted vulnerability information to the designated monitoring terminal; or Send special event type information to the designated monitoring terminal.

6. A security vulnerability detection system for smart contracts, characterized in that, The system includes: Malicious Activity Count Information Acquisition Module: Used to acquire malicious activity count information for each network node to be monitored based on a preset blockchain network; Target network node determination module: used to determine the target network node based on the malicious activity count information and the preset abnormal activity count threshold information; Exception function fragment information determination module: used to determine exception function fragment information based on the contract log information of the target network node; Trading risk information generation module: used to generate trading risk information based on the abnormal function fragment information.

7. The system according to claim 6, characterized in that, The target network node determination module includes: Malicious activity count information comparison submodule: used to compare the malicious activity count information with the preset abnormal activity count threshold information for each of the network nodes to be monitored; Target network node determination submodule: If the number of malicious activities is greater than the threshold of abnormal activities, then the network node to be monitored is determined to be the target network node.

8. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 5.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 5.

Images