Intelligent contract vulnerability detection system based on structure perception contrast learning

Abstract

The invention relates to an intelligent contract vulnerability detection system based on structure perception contrast learning, and belongs to the technical field of block chain security. The system comprises a feature extraction module, a comparative learning module, a vulnerability detection module and a loss function calculation module. The feature extraction module generates structure sensing features based on the abstract syntax tree; the comparative learning module learns feature representation by constructing a comparative relationship between different types of contracts; the vulnerability detection module performs feature aggregation by using attention pooling; and the loss function module integrates three loss functions for optimization. According to the system, the F1 value reaches 95% or above in multi-class vulnerability detection, and the problem that the relation and structure information between contracts are neglected in an existing method is effectively solved by combining code structure analysis and comparative learning.

Description

Technical Field

[0001] This invention belongs to the field of blockchain security technology, specifically relating to a smart contract vulnerability detection system based on structure-aware comparative learning. Background Technology

[0002] With the rapid development of blockchain technology, smart contracts, as automated execution programs on the blockchain, have been widely used in various fields such as finance, supply chain, and the Internet of Things. A smart contract is essentially a program running on a blockchain network; its code, functions, and state are transparent, visible, and immutable. Execution requires no human intervention and can be performed automatically when preset conditions are met. This characteristic makes smart contracts a core component for building decentralized applications (DApps) and decentralized finance (DeFi) systems.

[0003] However, due to the immutability, high value, and complex execution environment of smart contracts, security vulnerabilities often lead to severe economic losses. According to Chainalysis statistics, since 2016, losses due to smart contract vulnerabilities have exceeded $5 billion. For example, the 2016 DAO attack resulted in the theft of approximately $360 million in Ether, prompting the Ethereum community to recover losses through a hard fork; the 2017 Parity multi-signature wallet vulnerability froze over $150 million, which remains unrecoverable; the 2018 BatchOverflow vulnerability affected multiple ERC-20 token contracts, leading to the malicious minting of an unlimited number of tokens; the 2020 bZx flash loan attack caused nearly $1 million in losses; the 2021 Poly Network cross-chain protocol attack resulted in losses exceeding $600 million; the 2022 Ronin bridge hack resulted in losses exceeding $620 million, setting a record for the largest single hack in decentralized finance (DeFi) history; and the 2023 Euler Finance flash loan attack resulted in losses of nearly $200 million. These incidents highlight the severity of smart contract security issues and the urgent need to detect vulnerabilities.

[0004] Currently, common types of vulnerabilities in smart contracts mainly include: reentrancy vulnerabilities, which allow attackers to repeatedly call contract functions before the contract state is updated; integer overflow / underflow vulnerabilities, which cause arithmetic operations to produce unexpected results; access control vulnerabilities, which allow sensitive functions to be called by unauthorized users due to improper permission management; denial of service vulnerabilities, which prevent the contract from functioning properly; unchecked return values ​​vulnerabilities, which ignore the failure of external calls; timestamp dependency vulnerabilities, which rely on block timestamps that can be manipulated by miners; random number generation vulnerabilities, which use predictable random number sources; and front / backrunning vulnerabilities, which allow transactions to be preempted or delayed by miners or other users.

[0005] Traditional smart contract vulnerability detection methods mainly include static analysis, symbolic execution, and formal verification. Static analysis tools such as Mythril, Slither, and Securify identify potential vulnerabilities through predefined rules and patterns, but this approach often suffers from high false positive rates and limited vulnerability coverage. For example, Mythril uses control flow analysis and constraint solvers to detect vulnerabilities, but may time out when analyzing large contracts; Slither provides fast vulnerability detection through data flow analysis, but its ability to detect complex semantic vulnerabilities is limited; Securify uses symbolic analysis and security specifications to verify contract behavior, but it heavily relies on predefined vulnerability patterns.

[0006] Symbolic execution tools such as Oyente, Manticore, and Mythx can explore program execution paths and check for potential vulnerabilities, but they often face path explosion when dealing with complex contracts, causing analysis time to increase exponentially, making comprehensive analysis of large smart contracts impractical. Formal verification tools such as KEVM, FSilidM, and VeriSol can provide strict security guarantees and verify that contract behavior conforms to expected specifications, but they require specialized knowledge and manual specification writing, making them unsuitable for large-scale automated vulnerability detection. Furthermore, the verification process is computationally intensive and difficult to apply to complex contracts.

[0007] In recent years, machine learning-based smart contract vulnerability detection methods have become a research hotspot because they can automatically learn vulnerability feature patterns, adapt to new types of vulnerabilities, and reduce false positive rates. The main methods include traditional machine learning methods based on feature engineering and deep learning-based methods. Feature engineering-based methods (such as ContractWard and SmartCheck Enhanced) require experts to manually design features; while fast, they rely on domain knowledge and have limited scalability. Deep learning-based methods (such as DR-GCN, TMP, CGE, and SCVHunter) can automatically learn feature representations, but they typically require large amounts of labeled data and consume significant computational resources.

[0008] Most existing machine learning-based methods employ single-modal learning strategies, such as directly extracting features from contract source code or bytecode for learning. For example, SCVHunter converts source code into vector representations and uses deep learning models for classification; DR-GCN represents contracts as graph structures and applies graph neural networks for learning; IVDetect converts control flow graphs into intermediate representations before vulnerability detection. While some methods, such as MMDLVD, consider multimodal fusion and utilize multiple information sources including source code, bytecode, and control flow graphs, significantly improving the accuracy of comprehensive smart contract vulnerability detection, these methods primarily focus on information within a single contract, neglecting the relationships between contracts, such as the relationships between vulnerable contracts, between vulnerable and non-vulnerable contracts, and between non-vulnerable and non-vulnerable contracts. This information is crucial for vulnerability detection.

[0009] Furthermore, existing methods often overlook the structural information of smart contracts. Smart contract code has a clear syntactic structure and execution logic, and this structural information is crucial for understanding the code's functionality and identifying potential vulnerabilities. For example, reentrancy vulnerabilities typically involve specific function call patterns (external call before state update) and the order of state changes, while integer overflow vulnerabilities are related to specific arithmetic operation structures (such as addition, subtraction, multiplication, and division operations without security checks). Current methods mostly treat code simply as a linear sequence, capturing code patterns through word embeddings or n-grams, or focusing only on the surface features of control flow and data flow, failing to fully utilize this rich structural information, especially the code's syntactic structure and fine-grained operational logic. This results in poor performance when identifying complex vulnerabilities that require understanding the deep semantics of the code.

[0010] Contrastive learning, as a powerful representation learning method, has achieved significant success in computer vision (such as SimCLR and MoCo) and natural language processing (such as BERT and SimCSE) in recent years. Its core idea is to learn discriminative feature representations by comparing the representations of similar and dissimilar samples, obtaining high-quality features without requiring a large amount of labeled data. In code analysis, contrastive learning has been used for code search (such as CodeBERT and GraphCodeBERT) and similar code detection (such as ASTNN and TBCNN), but its application in smart contract vulnerability detection remains limited. Applying contrastive learning to smart contract vulnerability detection can help the model learn more robust and generalizable vulnerability features by comparing the feature representations of vulnerable and non-vulnerable contracts, especially when labeled data is limited.

[0011] Therefore, this invention proposes a smart contract vulnerability detection system based on structure-aware contrastive learning, which achieves more efficient and accurate smart contract vulnerability detection by combining code structure information and contrastive learning strategies. Summary of the Invention

[0012] The purpose of this invention is to provide a smart contract vulnerability detection system based on structure-aware contrastive learning. By combining code model structure analysis with contrastive learning, this system solves the problem of neglecting the relationships between contracts and code structure information in existing smart contract vulnerability detection methods, thereby achieving more accurate and efficient smart contract vulnerability detection.

[0013] The purpose of this invention is to provide a smart contract vulnerability detection system based on structure-aware contrastive learning, comprising a feature extraction module, a contrastive learning module, a vulnerability detection module, and a loss function calculation module. The input of the feature extraction module is connected to the output of the smart contract module, and the output of the feature extraction module is connected to the input of the vulnerability detection module. The vulnerability detection module and the contrastive learning module are bidirectionally connected.

[0014] The feature extraction layer is responsible for extracting smart contract modules, constructing function call relationship graphs, obtaining meta-path information, generating CORE contract operation representations by combining abstract syntax trees, further extracting FLOW function logic operation wrappers, and finally converting FLOW into vector representations through word embeddings.

[0015] The contrast learning layer uses an MLM pre-trained language model to enhance contextual understanding. By randomly masking parts of the input text, the Transformer model makes predictions based on the context. At the same time, CLS vectors are introduced as special input markers to obtain the overall semantic representation of the sequence.

[0016] The vulnerability detection layer utilizes the feature matrix obtained through feature learning and Transformer fine-tuning, aggregates features through the AttentionPooling mechanism, processes them through MLP, and finally uses a fully connected neural network for vulnerability detection.

[0017] The loss function layer is based on the contrastive learning framework, combining LossMLM (masked language model loss), LossSCV (vulnerability detection classification loss), and LossCL (contrastive learning loss) to optimize the model.

[0018] The operation steps of the smart contract vulnerability detection system are as follows:

[0019] (1) The feature extraction module extracts structure-aware features from the smart contract module. (1.1) Extract the smart contract module, construct the function call relationship graph, and obtain meta-path information; specifically, for program P = {f1,...,f n The call graph of program P is represented as G = (V, E), where V = n1, ..., n m It is a collection of nodes, each node representing a function f. i ∈P, and E=e1,...,e p It is a set of direct edges, each edge representing a possible control flow between a pair of nodes; by traversing each node in the function call relationship graph, meta-path information reflecting the call relationship between functions can be obtained;

[0020] (1.2) Generate CORE (Contract Operation Representation) contract operations based on the Abstract Syntax Tree (AST); this process needs to be performed according to Algorithm 1: take the abstract syntax tree T and function call graph G of the program as input; initialize an empty CORE set C and an empty root node set RN; create a cached_nodes structure to cache the processed nodes; traverse each node M in the function call graph. x Check if the node has been cached. If so, reuse the result. Otherwise, analyze each function call in the node and add the matching function definition as the root node to RN. Generate a corresponding subtree for each root node and collect the leaf nodes of these subtrees as COREs. Finally, output the CORE set.

[0021] (1.3) Extract the FLOW (Function Logic Operation Wrapper) function logic operation wrapper from the CORE contract; proceed according to Algorithm 2: receive program P and its generated abstract syntax tree T, a CORE contract generated by Algorithm 1, and a set Y containing all relevant node types as input; initialize an empty FLOW set W and a set valid_types containing all valid node types; obtain the subtree ST corresponding to CORE through the PREORDER(T,rn) function; for each node type y in the set Y... e If the type is valid, then use PREORDER(ST,y) e Get its corresponding subtree st e and subtree st e The leaf nodes are added to W; finally, a set W containing all extracted FLOWs is returned.

[0022] (1.4) The FLOW function logic operation wrapper is transformed into a vector representation through word embedding, providing a foundation for subsequent processing. This step not only considers the semantic information of words but also integrates structural position information, making code fragments with similar structures closer together in the vector space. For an input sequence of length n in a word embedding space of dimension k, the initial representation matrix is ​​obtained after processing by the Transformer. Then through the mapping operator Compress the sequence representation into an initial semantic vector: P(H)=η*∑iH i Where the normalization factor η = 1 / √n;

[0023] (2) The contrastive learning module compares the relationships between different contract samples and learns discriminative contract feature representations. (2.1) The MLM (Masked Language Model) pre-trained language module is used to enhance contextual understanding ability; specifically, given the original sequence X = {x1, x2, ..., x...} n The system randomly replaces the tokens in the input sequence with [MASK] markers according to a preset masking rate (default 20%), generating a mask sequence X. mask MLM calculates the conditional probability distribution for each masked position based on the context: P(x' i |X mask ) = MLM(X mask ) i When generating the replacement token, the system uses a sampling strategy controlled by the temperature parameter τ: P τ (x' i |X mask) = softmax(log(P(x') i |X mask When τ→0, it tends to be a greedy choice, and when τ→∞, it tends to be a uniform sampling.

[0024] (2.2) CLS vectors are used as special input markers for the Transformer to obtain the semantic representation of the entire sequence; when processing positional information, the positional encoding operator E is used; for the position p and feature dimension l in the sequence, the encoding function is defined as an alternating trigonometric function: E l(p) ={

[0025] φ1(p,l)=sin(ω l p), when l is even

[0026] φ2(p,l)=cos(ω l p), when l is odd

[0027] }

[0028] Where ω_l=1 / 10000^l / k is the dimension-dependent frequency modulation factor; after obtaining the position-enhanced representation, a multi-head attention operator A is introduced for deep information interaction: [CLS',F]=A([P(H);H+E]);

[0029] (2.3) Construct three comparison relationships: positive sample pairs of vulnerable contracts and vulnerable contracts (VV), comparative sample pairs of vulnerable contracts and non-vulnerable contracts (VS), and secure sample pairs of non-vulnerable contracts and non-vulnerable contracts (SS); for the semantic association tag L of the contract pair s ij A three-tiered annotation strategy was defined based on vulnerability feature similarity: L-type vulnerability contract pairs (VV) of the same type. s ij =1, L of vulnerability and security contract pair (VS) s ij =0, L of the security contract pair (SS) s ij =0.5, to reflect the semantic relationship between different types of contract pairs;

[0030] (2.4) Through these comparative relationships, the model can directly compare the semantic similarity of code sample pairs, avoiding complex sequence modeling and data alignment operations. The feature learning framework outputs two core components: a global semantic vector. and characteristic matrix For the CLS' vector, two linear transformations are further applied: Transformer's Layer Normalization and Batch Normalization: v = BatchNorm(W·LayerNorm(CLS')), where W is the weight of the linear transformation;

[0031] (3) The vulnerability detection module uses the learned feature representation to identify vulnerabilities. (3.1) The feature matrix obtained by previous feature learning and Transformer fine-tuning. Where n is the sequence length and k is the feature dimension;

[0032] (3.2) Feature aggregation is performed through the attention pooling mechanism; this mechanism intelligently aggregates the feature matrix F and concatenates and fuses it with the relevant feature v, which is expressed as: score = AttentionPooling(F) ⊕ v, where ⊕ represents the feature concatenation operation;

[0033] (3.3) The aggregated features are linearly transformed by the learnable weight matrix W and a bias term b is added: hidden = W·score + b;

[0034] (3.4) The output is mapped to the probability space using the sigmoid activation function to obtain the final vulnerability prediction probability: prob = sigmoid(hidden); (4) The loss function calculation module is responsible for optimizing the model performance through a multi-objective learning strategy, including three loss functions:

[0035] (4.1) Semantic Contrastive Loss (SCL) is used to construct semantic associations between contract code fragments; given the vector representations of two contracts [v i ,v j Based on its semantic relevance label L s ij Design the loss function:

[0036] Loss SCL (v i ,v j ,L s ij ) = L s ij ·D cos (v i ,v j ) 2 +(1-L s ij )·max(0,α-D cos (vi ,v j )) 2

[0037] Where: D cos (·) represents the cosine distance metric between vectors, where α is the semantic difference threshold parameter; for the semantic association label L of a contract pair s ij A three-tiered annotation strategy was defined based on vulnerability feature similarity: L-type vulnerability contract pairs (VV) of the same type. s ij =1, L of vulnerability and security contract pair (VS) s ij =0, L of the security contract pair (SS) s ij =0.5;

[0038] (4.2) Context Understanding Loss (CUL) is used to enhance the model's understanding of code structure; this loss function is defined based on the masked language model prediction task:

[0039] Loss CUL =-∑ m ∈T m w t ·log P(x m |C m )

[0040] Wherein: T m w represents the set of tokens that are blocked. t C assigns importance weights to different types of tokens. m A context window representing the token; unlike traditional MLM, this paper assigns different weights to different types of tokens, such as keywords, function names, and variables, based on the characteristics of smart contracts, so that the model focuses more on understanding the key components of the contract;

[0041] (4.3) Vulnerability Recognition Loss (VRL), used to optimize the final vulnerability detection performance; this loss function adopts the form of cross-entropy with class weights:

[0042]

[0043] in: y∈{0,1} is the vulnerability probability predicted by the model, β is the true label, and β is the sample weighting factor used to deal with the imbalance between vulnerability samples and safe samples in the dataset.

[0044] During the pre-training phase, semantic contrast loss and contextual understanding loss are integrated in a weighted manner:

[0045] Total Loss = α(t)·Loss SCL +β(t)·Loss CUL

[0046] Where α(t) and β(t) are hyperparameters, controlling the weight ratio of SCL and CUL in the total loss, respectively. In the downstream vulnerability detection task, cross-entropy with class weights is used as the vulnerability identification loss. VRL .

[0047] The smart contract vulnerability detection system provided by this invention significantly improves the accuracy of smart contract vulnerability detection by combining structure-aware feature extraction and contrastive learning strategies, especially excelling in handling complex contracts and identifying subtle vulnerability patterns. Compared with existing technologies, this invention has the following advantages:

[0048] (1) Higher detection accuracy: By comparing learning strategies and structure-aware feature extraction, this system achieves an F1 score of over 95% on multiple vulnerability detection tasks. In particular, the F1 scores of high-risk vulnerabilities such as reentrancy vulnerabilities (RE) and unchecked return values ​​(UC) reach 94.36% and 98.29% respectively, which are significantly better than existing methods.

[0049] (2) Stronger generalization ability: By comparing the relationship between different types of contracts, the model learns more discriminative vulnerability features and achieves an accuracy of 74.33% on complex datasets such as Web3Bugs, demonstrating good generalization ability to unseen vulnerability patterns.

[0050] (3) Scalability: The system adopts a modular design, and the modules interact with each other through standardized interfaces, which can be easily extended to new vulnerability types and contract platforms.

[0051] (4) Computational efficiency: The two-stage architecture of shared preprocessing and dedicated processing is adopted, which controls the average detection time to about 3.30 seconds (1.50 seconds for single vulnerability detection) while maintaining high accuracy, making it suitable for the real-time detection needs in actual development environments. Attached Figure Description

[0052] Figure 1 This is a diagram illustrating the overall architecture of the smart contract vulnerability detection model of the present invention.

[0053] Figure 2 This is a detailed block diagram of the smart contract vulnerability detection model of the present invention.

[0054] Figure 3This is a feature distribution map of SCLVD for vulnerabilities AC, AR, and OT during the comparative learning and training phase in this invention.

[0055] Figure 4 This is a feature distribution map of SCLVD targeting vulnerabilities RE and UC, as well as SCLVD-A during the contrastive learning training phase in this invention.

[0056] Figure 5 This is a graph showing the loss variation of SCLVD during the contrastive learning and training phases of the present invention.

[0057] Figure 6 This is a graph showing the F1 score variation of the SCLVD of the present invention during the contrastive learning training phase.

[0058] Figure 7 This is a diagram showing the detection time overhead of the SCLVD method of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings. However, the scope of protection of this invention is not limited to the following embodiments.

[0060] Example 1:

[0061] The overall process of SCLVD is as follows: Figure 1 As shown, it mainly includes data processing, comparative learning, and smart contract vulnerability detection. The output of data processing is connected to the input of comparative learning and smart contract vulnerability detection, respectively, and the output of comparative learning is connected to the input of smart contract vulnerability detection.

[0062] System Overall Architecture

[0063] The overall system architecture is as follows Figure 2 As shown, the smart contract vulnerability detection system based on structure-aware contrastive learning provided by this invention includes four core modules: a feature extraction module, a contrastive learning module, a vulnerability detection module, and a loss function calculation module. The overall system architecture follows an end-to-end learning process, starting from the input of the smart contract source code and ending with the output of the vulnerability detection results. Each module works closely together to achieve high-accuracy vulnerability detection.

[0064] The feature extraction module is a fundamental component of the system, responsible for extracting structured feature representations from smart contract source code. This module employs a combination of Abstract Syntax Trees (ASTs) and function call graphs to perform in-depth analysis of the contract code and extract feature representations with structure awareness capabilities.

[0065] 1.1 Formal Representation of Smart Contracts

[0066] To accurately describe the structural characteristics of smart contracts, this invention first provides a formal definition of smart contracts:

[0067] A program P is a set of functions f1,...,f n The set is represented as P = f1,...,f n Function f i (where 1≤i≤n) is an ordered set of statements si,1,...,si,a, denoted as f i = si,1,...,si,a. The statements si,j (where 1≤i≤n and 1≤j≤a) are an ordered set of tokens t. i ,j,1,...,t i The set of ,j,β is denoted as si,j=t i ,j,1,...,t i ,j,β. A lexical symbol is the smallest element in a program; it can be an identifier, operator, constant, or keyword, and can be extracted through lexical analysis.

[0068] For the program P = f1,...,f n The call graph of program P is represented as G = (V, E), where V = n1, ..., n m It is a collection of nodes, each node representing a function f. i ∈P, and E=e1,...,e p It is a set of direct edges, where each edge represents a possible control flow between a pair of nodes.

[0069] 1.2 Generation of CORE and FLOW

[0070] Based on the above definitions, this invention further introduces the concepts of CORE (Contract Operation Representation) and FLOW (Function Logic Operation Wrapper) to capture the structural information of smart contracts:

[0071] First, consider a program P = f1,...,f n , where f i =si,1,...,si,a, and si,j=t i ,j,1,...,t i ,j,β. Program P can generate a unique abstract syntax tree T. This paper defines code snippet F. i ,j,u,v is composed of one or more consecutive tokens in the statement si,j, that is, F i ,j,u,v=(t i ,j,u,...,t i,j,v), where 1≤u≤v≤β. If t i ,j,u,...,t i If j and v correspond to a substructure of T, that is, form a leaf node of a tree structure, and the root node of the tree structure is a non-root, non-leaf node in the original abstract syntax tree T, then it is called a CORE.

[0072] First, given a program P = f1,...,f n , where f i =si,1,...,si,α, and si,j=t i ,j,1,...,t i The program P generates an abstract syntax tree T. For a set LN = ln1, ..., ln... containing leaf nodes... k If these leaf nodes ln1,...,ln k Having a common root node, these leaf nodes collectively represent a complete set of information, called a FLOW. In particular, all leaf nodes of an abstract syntax tree can also be considered as a FLOW, and the smallest FLOW may contain only two tokens.

[0073] 1.3 Feature Extraction Algorithm

[0074] Algorithm 1: Generating CORE from a program

[0075] Algorithm 1 takes an abstract syntax tree and a function call graph of a program as input, and identifies and constructs a set of root nodes of the code by traversing each node in the function call graph. The algorithm first initializes an empty set of COREs C and an empty set of root nodes RN, and creates a dictionary cached_nodes for caching processed nodes. Then, the algorithm traverses each node M in the function call graph G. x The algorithm checks if the node has been cached. If so, it reuses the existing result; otherwise, it analyzes each function call in the node and adds the matching function definition as the root node to the set RN. After completing the traversal, the algorithm generates a corresponding subtree for each root node and collects the leaf nodes of these subtrees as COREs, finally outputting the CORE set. This method avoids redundant calculations through a caching mechanism, thus improving efficiency.

[0076] Algorithm 2: Extract FLOW from CORE

[0077] Algorithm 2 aims to extract FLOW (Function Logic Operation Wrapper) from the CORE. This algorithm takes program P and its generated abstract syntax tree T, a CORE generated by Algorithm 1, and a set Y containing all relevant node types as input. The algorithm initializes an empty FLOW set W and a set valid_types containing all valid node types. Then, it processes the subtree structure corresponding to the CORE through a preorder traversal. For each valid node type, the algorithm continues to traverse downwards and collects its leaf nodes, ultimately generating a set W containing all extracted FLOWs as output. This preorder traversal process relies on the support of Algorithm 3.

[0078] Algorithm 3: Preorder Traversal

[0079] Algorithm 3 is an auxiliary algorithm for preorder traversal of tree structures. It takes a tree and a node as input and recursively constructs a new subtree structure. The algorithm first handles the boundary case of empty nodes, then creates a new tree node for the current node. If the current node has no children, it returns directly; otherwise, it recursively traverses all child nodes and adds them to the newly constructed subtree in the order of preorder traversal. This algorithm, used in Algorithm 2, is used to reconstruct and extract specific parts of the tree, ensuring that the FLOW extraction process proceeds in the correct order. These three algorithms form a complete analysis chain: Algorithm 1 is responsible for basic CORE identification and construction, providing input for subsequent analysis; Algorithm 2 utilizes the output of Algorithm 1 and performs FLOW extraction with the support of Algorithm 3; and Algorithm 3 provides the necessary tree traversal capabilities for the entire process. Their close cooperation ensures that the entire process from code analysis to flow extraction can be completed efficiently and accurately. Through this algorithm system, this invention can effectively extract structure-aware feature representations from smart contract source code, providing a solid foundation for subsequent comparative learning and vulnerability detection.

[0080] The contrastive learning module is the core innovation of this invention. It is responsible for learning discriminative feature representations by comparing the relationships between different contract samples.

[0081] 2.1 Data Classification and Comparison Strategies

[0082] This module performs comparative learning by constructing different types of smart contract pairs, specifically including three comparative relationships:

[0083] (1) Positive sample comparison between vulnerability contracts: By comparing vulnerability contracts of the same type, the model can learn common vulnerability feature patterns and vulnerabilities.

[0084] (2) Comparison between vulnerable contracts and non-vulnerable contracts: This comparison helps the model learn to identify the key differences and boundaries between vulnerable code and secure code.

[0085] (3) Comparison between non-vulnerable contracts: By comparing secure contracts, the model can understand and extract common features and best practices of secure code. This multi-dimensional comparative learning strategy not only enables the model to understand the security features and vulnerability patterns of contract code more comprehensively, but also enhances the model's ability to identify similar vulnerabilities and improves its generalization performance for unknown vulnerabilities.

[0086] 2.2 Context Enhancement Mechanism

[0087] To enhance the model's understanding of code semantics, this invention employs a masked language model (MLM) to enhance the context of the input text. Specifically, the system randomly replaces markers in the input sequence with [MASK] markers according to a preset masking rate (default 20%), and then allows the model to predict these masked markers.

[0088] Given an original sequence X = {x1, x2, ..., x...} n The system generates a mask sequence X. mask And calculate the conditional probability distribution of each masked position using a language model: P(x' i |X mask ) = MLM(X mask ) i When generating replacement markers, the system employs a sampling strategy controlled by the temperature parameter τ:

[0089] P τ (x' i |X mask ) = softmax(log(P(x') i |X mask )) / τ)

[0090] As τ approaches 0, the system tends towards greedy selection (the token with the highest replacement rate), and as τ approaches infinity, it tends towards uniform sampling. In this way, the system can balance determinism and diversity, providing rich training samples for the model.

[0091] 2.3 Feature Learning and Representation

[0092] In the feature learning stage, the system first uses a Transformer encoder to process the enhanced input sequence and obtain an initial representation matrix H. Subsequently, the system introduces a special [CLS] marker as an anchor point for obtaining the representation of the entire sequence, and strengthens the representation of positional information in the sequence through positional encoding.

[0093] The feature learning process can be represented as:

[0094] (1) Initial representation acquisition:

[0095] (2) Sequence representation aggregation: v = η * ∑ i H i Where η = 1 / √n

[0096] (3) Position encoding addition: E(p) = alternating trigonometric functions (sine and cosine)

[0097] (4) Multi-head attention processing: [CLS',F]=A([v(H);H+E])

[0098] (5) Layer normalization and batch normalization: v = BatchNorm(W·LayerNorm(CLS'))

[0099] Through these steps, the model can learn a contract code representation that includes both global semantic information and preserves local structural features.

[0100] The vulnerability detection module is responsible for using the feature representations obtained through contrastive learning to perform the final vulnerability identification. This module mainly includes the following steps:

[0101] (1) Feature aggregation: The feature matrix F is intelligently aggregated through the attention pooling mechanism and then concatenated and fused with the relevant feature v, as shown below:

[0102] score=AttentionPooling(F)⊕v

[0103] (2) Feature transformation: The fused features are linearly transformed using a learnable weight matrix W and a bias term b is added.

[0104] hidden = W·score + b

[0105] (3) Probability Output: The output is mapped to the probability space using the sigmoid activation function to obtain the final vulnerability prediction probability:

[0106] prob = sigmoid(hidden)

[0107] This hierarchical feature processing enables the model to gradually extract and transform features, ultimately achieving effective identification of smart contract vulnerabilities.

[0108] The loss function calculation module employs a multi-objective learning strategy, using three different loss functions to optimize different aspects of the model:

[0109] (1) Semantic Contrast Loss (SCL): Used to construct semantic associations between contract code fragments, based on cosine similarity metric: Loss SCL (v i ,v j ,L s ij ) = L s ij ·D cos (v i ,v j ) 2 +(1-L s ij )·max(0,α-D cos (v i ,v j )) 2

[0110] Where L s ij These are semantic association tags, set to 1, 0, and 0.5 respectively based on the type of contract pair (VV, VS, SS). cos This represents the cosine distance, and α is the semantic difference threshold parameter.

[0111] (2) Contextual Understanding Loss (CUL): Used to enhance the model's understanding of code structure, based on mask prediction:

[0112] Loss CUL =-∑ m ∈T m w t ·log P(x t |C t )

[0113] Where T m w represents the set of tokens that are masked. t C assigns importance weights to different types of tokens. t The context window representing the token.

[0114] (3) Vulnerability Detection Loss (VRL): Used to optimize the final vulnerability detection performance, employing cross-entropy with class weights.

[0115]

[0116] in Let y represent the vulnerability probability predicted by the model, y∈{0,1} represent the true label, and β represent the sample weighting factor used to handle the data imbalance problem.

[0117] These three loss functions are combined in a weighted manner to optimize the model:

[0118] Total Loss = α(t)·Loss SCL +β(t)·Loss CUL +Loss VRL

[0119] Where α(t) and β(t) are weighting coefficients that change over time, controlling the importance of each loss function in the optimization process.

[0120] System Implementation and Evaluation:

[0121] The smart contract vulnerability detection system of this invention has been evaluated on multiple standard datasets, including the detection of different types of vulnerabilities (access control vulnerabilities AC, arithmetic vulnerabilities AR, reentrancy vulnerabilities RE, etc.). Evaluation metrics include accuracy, precision, recall, and F1 score.

[0122] Experimental results show that the system of the present invention has achieved excellent performance in various vulnerability detection tasks, especially in the detection of common high-risk vulnerabilities such as reentrancy vulnerabilities (RE) and unchecked return values ​​(UC), with an accuracy and F1 score of over 98%, which is significantly better than existing methods.

[0123] Figure 3 and Figure 4This diagram illustrates the feature distribution of different vulnerability types (AC, AR, OT, RE, UC, and SCLVD-A) at different training stages (epochs 0, 20, and 99). Each subgraph represents a smart contract sample, with red indicating vulnerable samples and blue indicating non-vulnerable samples. Over time, the following characteristics can be observed: In the early training phase (Epoch 0), red and blue points are mixed together, indicating that the model cannot yet effectively distinguish between vulnerable and non-vulnerable samples. The overall distribution is relatively uniform. In the middle training phase (Epoch 20), blue points clearly begin to spread outwards, forming a ring structure, while red vulnerable samples are more concentrated in the central area. This indicates that the model has begun to learn the features to distinguish between vulnerable and non-vulnerable samples. In the later training phase (Epoch 99), this distribution pattern is further strengthened—forming a very clear ring structure, with red vulnerable samples mainly concentrated in the inner core area, while blue non-vulnerable samples are distributed in the outer ring area. This clear spatial separation indicates that the model has been able to effectively extract and distinguish vulnerability features. Various vulnerability types (AC, AR, OT, RE, UC, SCLVD-A) exhibit similar evolutionary trends, demonstrating the model's strong feature learning capabilities across different vulnerability types. Particularly noteworthy is the remarkable stability and clarity of this inside-out hierarchical structure at the end of training, providing a solid feature foundation for subsequent vulnerability detection tasks.

[0124] from Figure 5 and Figure 6 The training effect of the SCLVD model during the contrastive learning training phase can be observed. Figure 5 The trend of the loss function is shown. The loss value of all variants decreases rapidly from an initial value of about 3.0, with the most significant decrease occurring in the first 40 epochs. After that, the decrease gradually flattens out, eventually converging to around 0.4 at 100 epochs. Among them, the SCLVD-UC variant has the fastest convergence speed, and its overall loss value is also slightly lower than that of other variants.

[0125] Figure 6 The chart shows the trend of F1 scores, with all variants exhibiting a continuous upward trend. In the early training phase (0-20 epochs), the F1 score rapidly increased from 0.2 to the 0.5-0.6 range; in the mid-phase (20-60 epochs), the rate of increase slowed but remained stable; in the late phase (60-100 epochs), the F1 scores of all variants stabilized, ultimately reaching a high level (above 0.9). SCLVD performed best for AR and UC vulnerabilities, achieving an F1 score close to 1.0, while SCLVD-A's performance was relatively weaker, with a slightly lower F1 score than the other variants.

[0126] Figure 7 The time overhead analysis results of the SCLVD system are presented. SCLVD adopts a two-stage architecture of shared preprocessing and vulnerability-specific processing. The time overhead of the shared preprocessing stage is 0.35-1.80 seconds, with an average time of 1.05 seconds; the time overhead of the dedicated processing stage for each vulnerability type is 0.15-0.85 seconds, with an average time of 0.45 seconds. When detecting only a single type of vulnerability, the total overhead is between 0.50-2.65 seconds, with an average of 1.50 seconds. Since SCLVD supports the detection of 5 vulnerability types, the overall system overhead is between 1.10-6.05 seconds, with an average of 3.30 seconds. Experimental results show that although SCLVD needs to detect multiple vulnerabilities, it successfully controls the overall time overhead within an acceptable range by sharing key preprocessing steps.

[0127] Ablation experiments further validated the effectiveness of each system component, particularly highlighting the significant contributions of contrastive learning and structure-aware feature extraction to system performance improvement. When the contrastive learning component was removed, the model's F1 score dropped to around 70% in all scenarios, demonstrating the crucial role of contrastive learning in enhancing vulnerability detection accuracy.

Claims

1. A smart contract vulnerability detection system based on structure-aware contrastive learning, characterized in that: It includes a feature extraction module, a contrastive learning module, a vulnerability detection module, and a loss function calculation module. The input of the feature extraction module is connected to the output of the smart contract module, and the output of the feature extraction module is connected to the input of the vulnerability detection module. The vulnerability detection module and the contrastive learning module are bidirectionally connected. The feature extraction layer is responsible for extracting smart contract modules, constructing function call relationship graphs, obtaining meta-path information, generating CORE contract operation representations by combining abstract syntax trees, further extracting FLOW function logic operation wrappers, and finally converting FLOW into vector representations through word embeddings. The contrast learning layer uses an MLM pre-trained language model to enhance contextual understanding. By randomly masking parts of the input text, the Transformer model makes predictions based on the context. At the same time, CLS vectors are introduced as special input markers to obtain the overall semantic representation of the sequence. The vulnerability detection layer utilizes the feature matrix obtained through feature learning and Transformer fine-tuning, aggregates features through the AttentionPooling mechanism, processes them through MLP, and finally uses a fully connected neural network for vulnerability detection. The loss function layer is based on the contrastive learning framework, combining LossMLM (masked language model loss), LossSCV (vulnerability detection classification loss), and LossCL (contrastive learning loss) to optimize the model. The operation steps of the smart contract vulnerability detection system are as follows: (1) The feature extraction module extracts structure-aware features from the smart contract module. (1.1) Extract the smart contract module, construct the function call relationship graph, and obtain the meta-path information; specifically, for program P = {f1,...,f...} n The call graph of program P is represented as G = (V, E), where V = n1, ..., n m It is a collection of nodes, each node representing a function f. i ∈P, and E=e1,...,e p It is a set of direct edges, each edge representing a possible control flow between a pair of nodes; by traversing each node in the function call relationship graph, meta-path information reflecting the call relationship between functions can be obtained; (1.2) Generate CORE contract operations based on the abstract syntax tree; this process needs to be performed according to Algorithm 1: take the abstract syntax tree T and function call graph G of the program as input; initialize an empty CORE set C and an empty root node set RN; create a cached_nodes structure to cache the processed nodes; traverse each node M in the function call graph G. x Check if the node has been cached. If so, reuse the result. Otherwise, analyze each function call in the node and add the matching function definition as the root node to RN. Generate a corresponding subtree for each root node and collect the leaf nodes of these subtrees as COREs. Finally, output the CORE set. (1.3) Extract the FLOW function logic operation wrapper from the CORE contract; proceed according to Algorithm 2: receive program P and its generated abstract syntax tree T, a CORE contract generated by Algorithm 1, and a set Y containing all relevant node types as input; initialize an empty FLOW set W and a set valid_types containing all valid node types; obtain the subtree ST corresponding to CORE through the PREORDER(T,rn) function; for each node type y in set Y... e If the type is valid, then use PREORDER(ST,y) e Get its corresponding subtree st e and subtree st e The leaf nodes are added to W; finally, a set W containing all extracted FLOWs is returned. (1.4) The FLOW function logical operation wrapper is transformed into a vector representation through word embedding, providing a foundation for subsequent processing. This step not only considers the semantic information of words but also integrates structural position information, making code fragments with similar structures closer together in the vector space. For an input sequence of length n in a word embedding space of dimension k, the initial representation matrix is ​​obtained after processing by the Transformer. Then through the mapping operator Compress the sequence representation into an initial semantic vector: P(H)=η*∑ i H i Where the normalization factor η = 1 / √n; (2) The contrastive learning module compares the relationships between different contract samples and learns discriminative contract feature representations. (2.1) Employing MLM pre-trained language modules to enhance contextual understanding; specifically, given the original sequence X = {x1, x2, ..., x...} n The system randomly replaces the tokens in the input sequence with [MASK] markers according to a preset masking rate (default 20%), generating a mask sequence X. mask The model calculates the conditional probability distribution for each masked position based on the context: P(x' i |X mask ) = MLM(X mask ) i When generating the replacement token, the system uses a sampling strategy controlled by the temperature parameter τ: P τ (x' i |X mask ) = softmax(log(P(x') i |X mask When τ→0, it tends to be a greedy choice, and when τ→∞, it tends to be a uniform sampling. (2.2) CLS vectors are used as special input markers for the Transformer to obtain the semantic representation of the entire sequence; when processing positional information, the positional encoding operator E is used; for the position p and feature dimension l in the sequence, the encoding function is defined as an alternating trigonometric function: E l(p) ＝{ φ1(p,l)=sin(ω l p), when l is even φ2(p,l)=cos(ω l p), when l is odd } Where ω_l=1 / 10000^l / k is the dimension-dependent frequency modulation factor; after obtaining the position-enhanced representation, a multi-head attention operator A is introduced for deep information interaction: [CLS',F]=A([P(H);H+E]); (2.3) Construct three comparison relationships: positive sample pairs between vulnerable contracts, comparative sample pairs between vulnerable contracts and non-vulnerable contracts, and secure sample pairs between non-vulnerable contracts and non-vulnerable contracts (SS); for the semantic association tag L of the contract pair s ij A three-level annotation strategy was defined based on the similarity of vulnerability features: L-type vulnerability pairs of the same type. s ij =1, L of the vulnerability and security contract pair s ij =0, L of the security contract pair (SS) s ij =0.5, to reflect the semantic relationship between different types of contract pairs; (2.4) Through these comparative relationships, the model can directly compare the semantic similarity of code sample pairs, avoiding complex sequence modeling and data alignment operations. The feature learning framework outputs two core components: a global semantic vector. and characteristic matrix For the CLS' vector, two linear transformations are further applied: Transformer's Layer Normalization and Batch Normalization: v = BatchNorm(W·LayerNorm(CLS')), where W is the weight of the linear transformation; (3) The vulnerability detection module uses the learned feature representations to identify vulnerabilities. (3.1) Feature matrix obtained using previous feature learning and Transformer fine-tuning Where n is the sequence length and k is the feature dimension; (3.2) Feature aggregation is performed through the attention pooling mechanism; this mechanism intelligently aggregates the feature matrix F and concatenates and fuses it with the relevant feature v, which is expressed as: score=AttentionPooling(F)⊕v, where ⊕ represents the feature concatenation operation; (3.3) The aggregated features are linearly transformed by the learnable weight matrix W and a bias term b is added: hidden = W·score + b; (3.4) Use the sigmoid activation function to map the output to the probability space to obtain the final vulnerability prediction probability: prob = sigmoid(hidden); (4) The loss function calculation module is responsible for optimizing model performance through a multi-objective learning strategy, including three loss functions: (4.1) Semantic Contrastive Loss (SCL) is used to construct semantic associations between contract code fragments; given the vector representations of two contracts [v i ,v j Based on its semantic relevance label L s ij Design the loss function: Loss SCL (in i ,in j ,L s ij )=L s ij ·D cos (in i ,in j ) 2 +(1-L s ij )·max(0,α-D cos (in i ,in j )) 2 Where: D cos (·) represents the cosine distance metric between vectors, where α is the semantic difference threshold parameter; for the semantic association label L of a contract pair s ij A three-tiered annotation strategy was defined based on vulnerability feature similarity: L-type vulnerability contract pairs (VV) of the same type. s ij =1, L of vulnerability and security contract pair (VS) s ij =0, L of the security contract pair (SS) s ij =0.5; (4.2) Context Understanding Loss (CUL) is used to enhance the model's understanding of code structure; this loss function is defined based on the masked language model prediction task: Loss CUL =-∑ m ∈T m w t ·log P(x m |C m ) Wherein: T m w represents the set of tokens that are blocked. t C assigns importance weights to different types of tokens. m The context window representing the token; (4.3) Vulnerability identification loss, used to optimize the final vulnerability detection performance; this loss function adopts the form of cross-entropy with class weights: in: y∈{0,1} is the vulnerability probability predicted by the model, β is the true label, and β is the sample weighting factor used to deal with the imbalance between vulnerability samples and safe samples in the dataset. During the pre-training phase, semantic contrast loss and contextual understanding loss are integrated in a weighted manner: Total Loss=α(t)·Loss SCL +β(t)·Loss CUL Where α(t) and β(t) are hyperparameters that control the weight ratio of SCL and CUL in the total loss, respectively; in the downstream vulnerability detection task, cross-entropy with class weights is used as the vulnerability identification loss. VRL .

Images