Safety protection method and system for generating smart contract honey spot based on large model

Abstract

The invention discloses a security protection method and system for generating a smart contract honey spot based on a large model. The method comprises the steps of collecting and preprocessing multi-modal training data including vulnerability features, behavior features and semantic features; performing adversarial training on the large model based on the data set, and generating an intelligent contract honey point which has normal surface functions and contains hidden vulnerabilities; performing packaging and digital signature on the honey-click contract information, performing uplink storage, and deploying the honey-click contract information to a block chain network; monitoring a block chain transaction log in real time, identifying honey point calling, and extracting features to perform anomaly detection; and judging malicious users based on the abnormal score in combination with a preset rule, and executing hierarchical response measures of on-chain asset freezing, blacklist addition and linkage intranet isolation. According to the method, the high-concealment honey point is dynamically generated by using the large model, and active, accurate and cooperative protection of the smart contract attack is realized by combining credible evidence storage and real-time monitoring of the block chain, so that the ecological security defense capability of the block chain is effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of network proactive defense technology, and in particular relates to a security protection method and system based on generating honey spots for smart contracts using a large model. Background Technology

[0002] In the wave of digitalization, smart contracts, with their immutability and automatic execution capabilities granted by blockchain, have been widely used in fields such as financial transactions and supply chain management. However, code vulnerabilities or logical flaws in smart contracts have become primary targets for attackers. Traditional smart contract security relies on static code analysis or manual auditing. Static analysis can only detect known vulnerability patterns and is powerless against new dynamic attacks; manual auditing is time-consuming and limited by professional expertise, making it difficult to comprehensively identify risks.

[0003] Honeypoint technology, as a proactive defense mechanism, tricks attackers into revealing their behavior by constructing targets with hidden vulnerabilities. However, traditional smart contract honeypoints have significant drawbacks: first, they are statically deployed with fixed code logic, making them easy for attackers to circumvent through pattern recognition, resulting in poor deception effectiveness; second, the generation process lacks intelligence and cannot adjust features based on real-time attack dynamics; and third, related information is mostly stored on centralized servers, posing risks of tampering and leakage, and hindering threat attribution. Furthermore, how to utilize large models to generate highly concealed and dynamic honeypoint contracts is a core challenge in the current field of smart contract security. Summary of the Invention

[0004] To address these issues, this invention provides a security protection method for generating honey spots in smart contracts based on large models, which solves the above problems.

[0005] In a first aspect, the present invention provides a security protection method for generating honey spots in smart contracts based on large models, comprising: S1. Collect and preprocess multimodal training data to construct a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features; S2. Based on the training dataset, perform adversarial training on the large model to generate smart contract honeypots with hidden vulnerabilities, and verify the generated honeypot contracts. S3. After encapsulating and digitally signing the verified information of the smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network; S4. Monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. S5. Based on the aforementioned anomaly score and alarm, and in conjunction with preset rules, determine the caller as a malicious user, and execute tiered linkage response measures according to the determination result.

[0006] Furthermore, step S1 includes: S11: Collect multi-source data from vulnerability databases, blockchain transaction logs, and security community texts; S12: Clean, deduplicatize, and desensitize the multi-source data; S13: Extract code structure features, attack behavior statistical features, and text semantic features from the processed data; S14: The code structure features, attack behavior statistical features, and text semantic features are fused to construct the multimodal training data.

[0007] Furthermore, step S2 includes: S21: Construct an adversarial training framework based on a generator and a discriminator, wherein the generator is used to generate candidate honeypot contracts based on the input contract function description and vulnerability features, and the discriminator is used to distinguish between the generated honeypot contracts and normal contracts. S22: Optimize the generator and the discriminator through alternating training until the discriminator can no longer effectively distinguish between honeypot contracts and normal contracts; S23: Using the trained generator, generate a smart contract honeypot that appears to function normally but contains hidden vulnerabilities. S24: Perform automated vulnerability scanning and verification and manual covert auditing on the generated smart contract honeypots.

[0008] Furthermore, in step S3, The information of the smart contract honeypot includes at least one or more of the following: the bytecode hash value of the honeypot contract, functional description, hidden vulnerability type, triggering condition, and risk level; the on-chain storage includes constructing the information into a blockchain transaction, broadcasting it to the blockchain network after signing, and recording and storing it on the blockchain after the transaction is confirmed by a block.

[0009] Furthermore, step S4 includes: S41: Collect transaction logs in real time by subscribing to blockchain node interfaces; S42: Compare the contract address in the transaction log with the honey point address of the smart contract that has been stored on the blockchain to identify the transaction that calls the honey point contract; S43: Extract features from the call transaction, the features including at least one of the following: call frequency, transaction amount, function call sequence, caller address attribute, network status features; S44: Input the extracted features into the pre-trained anomaly scoring model, output the anomaly score, and determine whether to trigger an alarm based on the anomaly score.

[0010] Furthermore, in step S5, the preset rule includes at least one of the following: Rule 1: A single call to a high-risk honeypot contract results in an anomaly score reaching the first threshold; Rule 2: Within the first preset time period, the cumulative number of calls to the medium-risk honeypot contract reaches the second threshold, and the cumulative abnormal score reaches the third threshold; Rule 3: After the Honey Point contract is invoked, a pre-defined abnormal fund transfer behavior will occur at the associated address within the second preset time.

[0011] Furthermore, the tiered and coordinated response measures include: For malicious users identified as high-risk, on-chain assets are frozen, they are added to the contract call blacklist, and the internal network security system is notified to isolate the associated host. For malicious users identified as medium risk, a warning message is sent, their on-chain operation permissions are restricted, and the internal network administrator is notified. For suspicious users identified as low-risk, they will be added to a watchlist for continuous monitoring.

[0012] Secondly, the present invention provides a security protection system for generating honey spots in smart contracts based on large models, comprising: The data preprocessing module is used to collect and preprocess multimodal training data to build a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features. A honeypot generation module is used to perform adversarial training on a large model based on the training dataset, generate smart contract honeypots with hidden vulnerabilities, and verify the generated honeypot contracts; wherein, the honeypot generation module includes: The adversarial training unit is used to build and train an adversarial training framework that includes a generator and a discriminator to optimize the generation of honeypot contracts. The contract generation unit is used to output smart contract honeypots using a trained generator. The verification unit is used to perform automated scanning and manual auditing verification of the generated smart contract honeypots.

[0013] The on-chain deployment module is used to encapsulate and digitally sign the information of the verified smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network. The monitoring and detection module is used to monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. The response and handling module is used to determine the caller as a malicious user based on the anomaly score and alarm, combined with preset rules, and to execute tiered linkage response measures according to the determination result; in addition, the response and handling module is connected to the intranet security system and is used to trigger isolation, scanning or enhanced monitoring operations on intranet hosts according to the malicious user determination result.

[0014] Thirdly, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of the security protection method for generating smart contract honeypots based on a large model according to any embodiment of the present invention.

[0015] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the steps of the security protection method for generating smart contract honey spots based on a large model according to any embodiment of the present invention.

[0016] The security protection method and system for generating honey points of smart contracts based on large models in this application have the following specific benefits: 1. High-quality dataset: Multi-source data fusion and refined preprocessing cover a variety of data types with rich feature dimensions, providing comprehensive learning samples for large models and improving the targeting of honeypot generation.

[0017] 2. Strong concealment of honey points: Through adversarial training, honey point contracts can evade automated detection tools and manual audits, resulting in a significant deception effect, which is a substantial improvement over traditional static honey points.

[0018] 3. Secure and reliable on-chain process: The use of encryption algorithms, digital signatures, and blockchain on-chain ensures that the honey point information is tamper-proof, the on-chain confirmation mechanism guarantees data validity, and the storage reliability is high.

[0019] 4. Timely monitoring response: The real-time monitoring system based on the distributed stream processing framework has strong processing capabilities, low latency in anomaly detection, and accurate identification of malicious behavior by the scoring model, resulting in a low false alarm rate.

[0020] 5. Robust defense system: Combining blockchain layer and internal network collaborative response, it blocks attacks from multiple dimensions, has high response coverage, strong scalability, and adapts to different security scenarios. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a security protection method for generating smart contract honeypots based on a large model, as provided in an embodiment of the present invention; Figure 2 This is a module interaction architecture diagram of a security protection system for generating honey spots in smart contracts based on a large model, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] The following combination Figure 1 This document details the specific implementation steps of a preferred embodiment of the present invention. It should be noted that the descriptions in this embodiment are merely examples and do not constitute a sole limitation on the scope of protection of the present invention.

[0025] Example 1: A security protection method for generating honey spots in smart contracts based on large models.

[0026] like Figure 1 As shown, the method provided in this embodiment mainly includes the following steps: S1. Collect and preprocess multimodal training data to construct a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features; S2. Based on the training dataset, perform adversarial training on the large model to generate smart contract honeypots with hidden vulnerabilities, and verify the generated honeypot contracts. S3. After encapsulating and digitally signing the verified information of the smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network; S4. Monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. S5. Based on the aforementioned anomaly score and alarm, and in conjunction with preset rules, determine the caller as a malicious user, and execute tiered linkage response measures according to the determination result.

[0027] Perform step S1 to collect and preprocess multimodal training data, and construct a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features. This step aims to construct a high-quality, multimodal training dataset. Specifically, it includes the following steps: S11 involves collecting multi-source data from vulnerability databases, blockchain transaction logs, and security community texts. First, historical vulnerability cases are obtained from publicly available smart contract vulnerability databases and security reports; each case includes a vulnerable code snippet, a description of the underlying principle, and an exploitation method. Second, historical transaction logs are retrieved in batches through blockchain node interfaces, and abnormal transaction records related to known attack events are filtered out. Finally, web crawlers are used to scrape discussion texts about new smart contract attack techniques from technical communities such as GitHub security topics and well-known hacker forums.

[0028] S12, the multi-source data is cleaned, deduplicated, and anonymized. Vulnerable code is deduplicated and formatted; transaction logs are filtered for noise and sensitive information such as addresses is anonymized; community text is segmented, irrelevant advertisements and emoticons are removed, and core sentences related to the attack techniques are extracted.

[0029] S13, extract code structure features, attack behavior statistical features, and text semantic features from the processed data; For code data, the Solidity parser is used to generate an abstract syntax tree, from which function call graphs, state variable dependencies, permission modifiers, etc. are extracted and quantized into feature vectors.

[0030] For transaction log data, it is converted into a structured table, and statistical characteristics such as transaction frequency, average transfer amount, and function call patterns over time are calculated for each address.

[0031] For community text data, a pre-trained language model is used to encode it to obtain the semantic vector of the text, and key technical keywords are extracted as label features.

[0032] S14, the code structure features, attack behavior statistical features, and text semantic features are fused to construct the multimodal training data. The three types of feature vectors (code structure feature vector, behavior statistical feature vector, and text semantic feature vector) are concatenated to form the final multimodal feature samples. Each sample corresponds to an attack scenario or vulnerability pattern. Subsequently, the total samples are randomly divided into training and validation sets according to a set ratio, and the numerical features are standardized and stored in TFRecord or HDF5 format for model training.

[0033] Step S2 is executed, based on the training dataset, adversarial training is performed on the large model to generate smart contract honeypots with hidden vulnerabilities, and the generated honeypot contracts are verified.

[0034] This step, specifically, includes the following steps: S21, Construct an adversarial training framework based on a generator and a discriminator, wherein the generator is used to generate candidate honeypot contracts based on the input contract function description and vulnerability features, and the discriminator is used to distinguish between the generated honeypot contracts and normal contracts.

[0035] A large model based on the Transformer architecture and pre-trained on a code corpus is selected as the base model, and its parameters are initialized. Based on this, a generative adversarial network framework is constructed.

[0036] The generator, based on the base model, takes as input normal contract function description text and feature vectors of the vulnerability types to be embedded. The generator's goal is to output source code that superficially conforms to the function description but internally contains the specified hidden vulnerability.

[0037] Discriminator: It can be a binary classification model, whose input is a contract code and output is the probability that the code is a "honeypot contract" or a "normal contract".

[0038] S22, the generator and the discriminator are optimized by alternating training until the discriminator can no longer effectively distinguish between honeypot contracts and normal contracts.

[0039] First, with a fixed generator G, a discriminator D is trained using a batch of real, normal contracts and a batch of early honeypot contracts generated by G, enabling it to accurately distinguish between them. Then, with the discriminator D fixed, the generator G is trained with the goal of making its generated honeypot contracts "deceive" D, that is, maximizing the probability that D misclassifies them as normal contracts. This process is iterated alternately until the discriminator D's accuracy in identifying generated honeypot contracts approaches that of random guessing (e.g., 50%). At this point, it is considered that generator G has been able to generate highly concealed honeypots.

[0040] S23, using the trained generator, generate a smart contract honeypot that appears to function normally but contains hidden vulnerabilities.

[0041] After training is complete, input the type of contract you want to simulate and the type of vulnerability you need into the generator G, and G will automatically generate the corresponding honeypot contract source code.

[0042] S24: Perform automated vulnerability scanning and verification and manual covert auditing on the generated smart contract honeypots.

[0043] Compilation and Static Verification: Perform a rapid scan using automated vulnerability scanning tools. A successful honeypot should pass the standard checks of these tools, i.e., the tools should report no obvious vulnerabilities or only report a low-risk warning.

[0044] Manual Coverage Audit: Invite 2-3 security experts to conduct a manual code audit of the generated contract without knowing the source of the code (double-blind). Assess the covertness of vulnerabilities and the degree of integration with normal business logic. Only contracts that pass the review of a majority of experts are considered qualified honeypots.

[0045] Dynamic testnet verification: Deploy the Honeypoint Contract to the blockchain network testnet to simulate the real environment and observe its operating status.

[0046] In step S3, the verified information of the smart contract honey point is encapsulated and digitally signed, then submitted to the blockchain network for on-chain storage, and the smart contract honey point is deployed to the target blockchain network. In this step, the information of the smart contract honeypot includes at least one or more of the following: the bytecode hash value of the honeypot contract, functional description, hidden vulnerability type, triggering condition, and risk level; the on-chain storage includes constructing the information into a blockchain transaction, signing it, broadcasting it to the blockchain network, and recording and storing it on the blockchain after the transaction is confirmed by a block.

[0047] Specifically, it includes the following steps: S31, Contract Information Extraction: Calculate the hash value of the final bytecode of the verified honeypot contract using an encryption algorithm, which serves as the contract's unique digital fingerprint. Simultaneously, extract its metadata, including: functional description, embedded vulnerability type, key conditions triggering the honeypot, risk level (high / medium / low), generation timestamp, and suggested expiration date.

[0048] S32, Data Encapsulation and Signing: Encapsulate the contract hash and metadata according to a preset format. Digitally sign the data packet using the private key held by this system.

[0049] S33, On-chain Submission and Confirmation: The signed data packet is used as transaction data to construct a blockchain transaction pointing to a specific notarization contract. This is broadcast to the blockchain network via the node interface. A transaction listener is set up; when the transaction is successfully packaged into a block and subsequently confirmed by multiple blocks, it is considered successfully submitted to the blockchain. The hash of the transaction and the block height are recorded.

[0050] S34, Honeypoint Contract Deployment: After on-chain notarization, the bytecode of the Honeypoint contract is officially deployed to the target blockchain network through a standard contract deployment process, obtaining a unique contract deployment address. This address is then associated and bound with the previously stored contract hash on-chain, and updated in the management database.

[0051] Execute step S4 to monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. This step, specifically, includes the following steps: S41. Collect transaction logs in real time by subscribing to blockchain node interfaces. Deploy a distributed stream processing framework on full blockchain nodes to subscribe to and capture all network transactions and logs in real time via interfaces.

[0052] S42. Compare the contract addresses in the transaction log with the honeypot addresses of smart contracts already stored on the blockchain to identify transactions that call the honeypot contract. Quickly compare the to address of each transaction or log with all deployed honeypot contract addresses recorded in the system. If a match is found, mark the transaction as a "honeypot call transaction" and allow it to flow into the downstream processing pipeline.

[0053] S43. Extract features from the call transaction, the features including at least one of the following: call frequency, transaction amount, function call sequence, caller address attribute, and network status features.

[0054] Transaction-level characteristics: the function selector of this call, the passed parameter values, the amount of cryptocurrency sent in the transaction, the gas price paid, and the time when the transaction occurred.

[0055] Address-level characteristics: age of the caller's address (time of first appearance), total number of historical transactions, and frequency of calls to various contracts in the past 24 hours.

[0056] Contextual characteristics: A sequence of calls made by the same caller to the same or other honeypots within a period of time before and after the transaction.

[0057] S44. Input the extracted features into the pre-trained anomaly scoring model, input the above features, output the anomaly score, and determine whether to trigger an alarm based on the anomaly score.

[0058] The extracted feature vectors are input into a pre-trained anomaly detection model. The model outputs an anomaly score between 0 and 1. A dynamic threshold (e.g., 0.85) is set; when the score exceeds the threshold, an alarm is immediately triggered. The alarm information includes the transaction hash, caller address, honeypot contract address, anomaly score, and key features, and is pushed to the security operations center platform in real time.

[0059] Step S5 is executed, based on the anomaly score and alarm, combined with preset rules to determine the caller as a malicious user, and to execute graded linkage response measures according to the determination result.

[0060] Specifically, the preset rules include at least one of the following: Rule 1: A single call to a high-risk honeypot contract results in an anomaly score reaching the first threshold; Rule 2: Within the first preset time period, the cumulative number of calls to the medium-risk honeypot contract reaches the second threshold, and the cumulative abnormal score reaches the third threshold; Rule 3: After the Honey Point contract is invoked, a pre-defined abnormal fund transfer behavior will occur at the associated address within the second preset time.

[0061] This step also includes the following steps: S51, Malicious User Determination: The response and handling module receives the alarm stream from S4 and performs a determination according to the preset rule engine. For example: If a single call to a honeypot by an address has a risk level of "high" and an anomaly score > 0.95 (Rule 1), it is directly identified as a high-risk malicious user.

[0062] If an address makes 5 calls to a medium-risk honeypot within 1 hour and has a cumulative anomaly score > 4.0 (Rule 2), it is determined to be a medium-risk malicious user.

[0063] The system can correlate internal network terminal detection and response data. If an internal network IP associated with the address calling the honeypot is found to exhibit abnormal lateral movement behavior before and after the attack, it is further identified as a malicious user.

[0064] S52, Hierarchical Linkage Response: Based on the judgment result, execute automated or semi-automated response measures.

[0065] For high-risk malicious users: An on-chain "defense management contract" is automatically invoked, which has the authority to temporarily freeze the funds of the malicious address or add it to the blacklist of all protected contracts.

[0066] Instruct the enterprise's intranet firewall or endpoint security system to isolate the traced internal host and initiate a full-system malware scan.

[0067] For medium-risk malicious users: Send an on-chain warning message to it via an on-chain contract.

[0068] Restrict certain high-risk operational permissions in the blockchain application.

[0069] A work order is generated on the platform and assigned to the security administrator for manual investigation.

[0070] For low-risk suspicious users: simply add their addresses to the watchlist, highlight them in the monitoring dashboard, and conduct short-term enhanced monitoring of their subsequent behavior.

[0071] S53, Auditing and Traceability: All judgment results, response actions, associated transaction hashes, and logs are immutably recorded on the blockchain sidechain or evidence storage chain, forming a complete audit chain. The security team can periodically generate attack posture reports based on this data.

[0072] Please see Figure 2 The diagram illustrates the module interaction architecture of a security protection system for generating honey spots in smart contracts based on a large model, as described in this application.

[0073] like Figure 2 As shown, the data preprocessing module 200 is used to collect and preprocess multimodal training data to construct a training dataset containing smart contract vulnerability features, attack behavior features and semantic features. Honeypoint generation module 210 is used to perform adversarial training on a large model based on the training dataset, generate smart contract honeypoints with hidden vulnerabilities, and verify the generated honeypoint contracts; wherein, the honeypoint generation module includes: Adversarial training unit 211 is used to build and train an adversarial training framework containing a generator and a discriminator to optimize the generation of honeypot contracts; Contract generation unit 212 is used to output smart contract honeypots using a trained generator; Verification unit 213 is used to perform automated scanning and manual auditing verification of the generated smart contract honey spots.

[0074] The on-chain deployment module 220 is used to encapsulate and digitally sign the information of the verified smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network. The monitoring and detection module 230 is used to monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. The response and handling module 240 is used to determine the caller as a malicious user based on the anomaly score and alarm, combined with preset rules, and to execute graded linkage response measures according to the determination result; and the response and handling module is connected to the intranet security system to trigger isolation, scanning or enhanced monitoring operations on the intranet host according to the malicious user determination result.

[0075] It should be understood that Figure 2 The modules and references described in the document Figure 1 The steps described in the text correspond to those in the method described above. Therefore, the operations, features, and corresponding technical effects described above also apply to the method described in the text. Figure 2 The various modules in the document will not be described in detail here.

[0076] In other embodiments, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the security protection method for generating smart contract honey points based on a large model in any of the above method embodiments. S1. Collect and preprocess multimodal training data to construct a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features; S2. Based on the training dataset, perform adversarial training on the large model to generate smart contract honeypots with hidden vulnerabilities, and verify the generated honeypot contracts. S3. After encapsulating and digitally signing the verified information of the smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network; S4. Monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. S5. Based on the aforementioned anomaly score and alarm, and in conjunction with preset rules, determine the caller as a malicious user, and execute tiered linkage response measures according to the determination result.

[0077] Computer-readable storage media may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store data created by the use of a security protection system that generates smart contract honeypots based on a large model. Furthermore, the computer-readable storage medium may include high-speed random access memory, and may also include memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer-readable storage medium may optionally include memory remotely configured relative to a processor, which can be connected via a network to the security protection system that generates smart contract honeypots based on a large model. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0078] Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present invention, such as... Figure 3 As shown, the device includes a processor 310 and a memory 320. The electronic device may also include an input device 330 and an output device 340. The processor 310, memory 320, input device 330, and output device 340 can be connected via a bus or other means. Figure 3 Taking a bus connection as an example, the memory 320 is the computer-readable storage medium described above. The processor 310 executes various server functions and data processing by running non-volatile software programs, instructions, and modules stored in the memory 320, thereby implementing the security protection method for generating smart contract honeypots based on a large model, as described in the above embodiment. The input device 330 can receive input numeric or character information and generate key signal inputs related to user settings and function control of the security protection system for generating smart contract honeypots based on a large model. The output device 340 may include a display screen or other display device.

[0079] The aforementioned electronic device can execute the method provided in the embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the method. Technical details not described in detail in this embodiment can be found in the method provided in the embodiments of the present invention.

[0080] In one implementation, the aforementioned electronic device is applied to a security protection system for generating smart contract honeypots based on a large model. It is used as a client and includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: S1. Collect and preprocess multimodal training data to construct a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features; S2. Based on the training dataset, perform adversarial training on the large model to generate smart contract honeypots with hidden vulnerabilities, and verify the generated honeypot contracts. S3. After encapsulating and digitally signing the verified information of the smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network; S4. Monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. S5. Based on the aforementioned anomaly score and alarm, and in conjunction with preset rules, determine the caller as a malicious user, and execute tiered linkage response measures according to the determination result.

[0081] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A security protection method for generating honey spots in smart contracts based on large models, characterized in that, include: S1. Collect and preprocess multimodal training data to construct a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features; S2. Based on the training dataset, perform adversarial training on the large model to generate smart contract honeypots with hidden vulnerabilities, and verify the generated honeypot contracts. S3. After encapsulating and digitally signing the verified information of the smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network; S4. Monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. S5. Based on the aforementioned anomaly score and alarm, and in conjunction with preset rules, determine the caller as a malicious user, and execute tiered linkage response measures according to the determination result.

2. The security protection method for generating smart contract honey spots based on a large model according to claim 1, characterized in that, Step S1 includes: S11: Collect multi-source data from vulnerability databases, blockchain transaction logs, and security community texts; S12: Clean, deduplicatize, and desensitize the multi-source data; S13: Extract code structure features, attack behavior statistical features, and text semantic features from the processed data; S14: The code structure features, attack behavior statistical features, and text semantic features are fused to construct the multimodal training data.

3. The security protection method for generating honey spots in smart contracts based on a large model according to claim 1, characterized in that, Step S2 includes: S21: Construct an adversarial training framework based on a generator and a discriminator, wherein the generator is used to generate candidate honeypot contracts based on the input contract function description and vulnerability features, and the discriminator is used to distinguish between the generated honeypot contracts and normal contracts. S22: Optimize the generator and the discriminator through alternating training until the discriminator can no longer effectively distinguish between honeypot contracts and normal contracts; S23: Using the trained generator, generate a smart contract honeypot that appears to function normally but contains hidden vulnerabilities. S24: Perform automated vulnerability scanning and verification and manual covert auditing on the generated smart contract honeypots.

4. The security protection method for generating smart contract honeypots based on a large model according to claim 1, characterized in that, In step S3 The information of the smart contract honeypot includes at least one or more of the following: the bytecode hash value of the honeypot contract, functional description, hidden vulnerability type, triggering condition, and risk level; the on-chain storage includes constructing the information into a blockchain transaction, broadcasting it to the blockchain network after signing, and recording and storing it on the blockchain after the transaction is confirmed by a block.

5. A security protection method for generating smart contract honeypots based on a large model according to claim 1, characterized in that, Step S4 includes: S41: Collect transaction logs in real time by subscribing to blockchain node interfaces; S42: Compare the contract address in the transaction log with the honey point address of the smart contract that has been stored on the blockchain to identify the transaction that calls the honey point contract; S43: Extract features from the call transaction, the features including at least one of the following: call frequency, transaction amount, function call sequence, caller address attribute, network status features; S44: Input the extracted features into the pre-trained anomaly scoring model, output the anomaly score, and determine whether to trigger an alarm based on the anomaly score.

6. The security protection method for generating smart contract honeypots based on a large model according to claim 1, characterized in that, In step S5, the preset rule includes at least one of the following: Rule 1: A single call to a high-risk honeypot contract results in an anomaly score reaching the first threshold; Rule 2: Within the first preset time period, the cumulative number of calls to the medium-risk honeypot contract reaches the second threshold, and the cumulative abnormal score reaches the third threshold; Rule 3: After the Honey Point contract is invoked, a pre-defined abnormal fund transfer behavior will occur at the associated address within the second preset time.

7. A security protection method for generating smart contract honeypots based on a large model according to claim 1, characterized in that, The tiered and coordinated response measures include: For malicious users identified as high-risk, on-chain assets are frozen, they are added to the contract call blacklist, and the internal network security system is notified to isolate the associated host. For malicious users identified as medium risk, a warning message is sent, their on-chain operation permissions are restricted, and the internal network administrator is notified. For suspicious users identified as low-risk, they will be added to a watchlist for continuous monitoring.

8. A security protection system for generating honey spots in smart contracts based on large models, characterized in that, include: The data preprocessing module is used to collect and preprocess multimodal training data to build a training dataset containing smart contract vulnerability features, attack behavior features, and semantic features. A honeypot generation module is used to perform adversarial training on a large model based on the training dataset, generate smart contract honeypots with hidden vulnerabilities, and verify the generated honeypot contracts; wherein, the honeypot generation module includes: The adversarial training unit is used to build and train an adversarial training framework that includes a generator and a discriminator to optimize the generation of honeypot contracts. The contract generation unit is used to output smart contract honeypots using a trained generator. The verification unit is used to perform automated scanning and manual auditing verification of generated smart contract honey spots. The on-chain deployment module is used to encapsulate and digitally sign the information of the verified smart contract honey point, submit it to the blockchain network for on-chain storage, and deploy the smart contract honey point to the target blockchain network. The monitoring and detection module is used to monitor the transaction logs of the blockchain network in real time, identify calls to the smart contract honey points, extract call behavior characteristics and perform anomaly detection, and generate anomaly scores and alarms. The response and handling module is used to determine the caller as a malicious user based on the anomaly score and alarm, combined with preset rules, and to execute tiered linkage response measures according to the determination result; in addition, the response and handling module is connected to the intranet security system and is used to trigger isolation, scanning or enhanced monitoring operations on intranet hosts according to the malicious user determination result.

9. An electronic device, characterized in that, include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the method described in any one of claims 1 to 7.

Images