Security vulnerability detection method and device, equipment, storage medium and product

Abstract

The invention discloses a security vulnerability detection method and device, equipment, a storage medium and a product. The method comprises the following steps: segmenting an obtained contract code to be detected to obtain a code unit set; determining a target code block set associated with the target business logic according to the preset target business logic, the code unit set, the classification information of each code unit in the code unit set and the dependency relationship between the code units; generating a virtual contract code according to a pre-constructed virtual contract structure and the target code block set; and determining a vulnerability detection result according to the to-be-detected contract code, the code unit set and the virtual contract code. By means of the method, explicit vulnerability recognition in a single code unit or a contract code to be detected is achieved, implicit vulnerability mining of multi-unit and multi-file interaction association is achieved, meanwhile, accurate vulnerability detection of target service logic is achieved, and therefore the accuracy and comprehensiveness of security vulnerability detection are improved.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a security vulnerability detection method, apparatus, device, storage medium, and product. Background Technology

[0002] As a core component of blockchain technology, the security of smart contracts directly determines the ownership and transfer security of digital assets. Once vulnerabilities exist, they can easily lead to major risks such as asset theft and logical anomalies.

[0003] Current methods for detecting security vulnerabilities in smart contract code are mostly static analysis, which is an analysis method that does not run the code. It detects potential errors and vulnerabilities by analyzing the syntax and semantics of the code. This method can detect some common vulnerability patterns, such as integer overflow and unchecked call return values. However, they are often limited by the fixed rules and the depth of analysis, making it difficult to fully cover the complex logic and potential risks of smart contracts, and they are not suitable for detecting business logic vulnerabilities. Summary of the Invention

[0004] This invention provides a security vulnerability detection method, apparatus, device, storage medium, and product to solve the problem of poor accuracy in detecting security vulnerabilities in smart contract code using existing methods.

[0005] In a first aspect, embodiments of the present invention provide a security vulnerability detection method, the method comprising:

[0006] The acquired contract code to be tested is segmented to obtain a set of code units;

[0007] Based on the preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependency relationships between each code unit, determine the set of target code blocks associated with the target business logic;

[0008] Based on the pre-built virtual contract structure and the target code block set, generate virtual contract code;

[0009] The vulnerability detection result is determined based on the contract code to be detected, the set of code units, and the virtual contract code.

[0010] Secondly, embodiments of the present invention provide a security vulnerability detection device, the device comprising:

[0011] The segmentation module is used to segment the acquired contract code to be tested to obtain a set of code units;

[0012] An integration module is used to determine a set of target code blocks associated with the target business logic based on a preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependency relationships between each code unit.

[0013] The generation module is used to generate virtual contract code based on the pre-built virtual contract structure and the target code block set;

[0014] The result determination module is used to determine the vulnerability detection result based on the contract code to be detected, the set of code units, and the virtual contract code.

[0015] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising:

[0016] At least one processor;

[0017] and a memory communicatively connected to the at least one processor;

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the security vulnerability detection method according to any embodiment of the present invention.

[0019] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute and implement the security vulnerability detection method described in any embodiment of the present invention.

[0020] Fifthly, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the security vulnerability detection method according to any embodiment of the present invention.

[0021] The technical solution of this invention involves segmenting the acquired contract code to be tested to obtain a set of code units; determining a set of target code blocks associated with the target business logic based on the preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependencies between each code unit; generating virtual contract code based on a pre-constructed virtual contract structure and the set of target code blocks; and determining the vulnerability detection result based on the contract code to be tested, the set of code units, and the virtual contract code. This method achieves multi-dimensional vulnerability coverage of micro-units, macro-contracts, and cross-file associations. It enables both the identification of explicit vulnerabilities in a single code unit or the contract code to be tested, and the discovery of implicit vulnerabilities in multi-unit and multi-file interactive associations. Simultaneously, it achieves accurate vulnerability detection of the target business logic, thereby improving the accuracy and comprehensiveness of security vulnerability detection.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart illustrating a security vulnerability detection method provided in an embodiment of the present invention;

[0025] Figure 2 This is a schematic diagram of the structure of a security vulnerability detection device provided in an embodiment of the present invention;

[0026] Figure 3 A schematic diagram of an electronic device that can be used to implement embodiments of the present invention is shown. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It is understood that before using the technical methods disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0030] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as the electronic device, application, server, or storage medium performing the operations of this disclosed technology.

[0031] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0032] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0033] Specifically, embodiments of the present invention provide a security vulnerability detection method. Figure 1 This is a flowchart of a security vulnerability detection method provided by an embodiment of the present invention. The embodiment of the present invention can be applied to scenarios of detecting security vulnerabilities in smart contract code. The method can be executed by a security vulnerability detection device, which can be implemented in the form of software and / or hardware. Optionally, it can be implemented by an electronic device, preferably a mobile terminal, desktop computer, laptop computer, or server.

[0034] like Figure 1As shown, the security vulnerability detection method provided in this embodiment of the invention may specifically include:

[0035] S101. The obtained contract code to be tested is segmented to obtain a set of code units.

[0036] In this embodiment, the contract code to be detected can be considered as the code obtained by formatting the original contract code with security vulnerability detection requirements collected from one or more code files. By formatting the original contract code to obtain the contract code to be detected, it is easier to better understand and analyze the code logic in subsequent processing, thereby improving the accuracy of vulnerability detection.

[0037] For example, obtaining the contract code to be tested can include: standardizing the code structure of the collected raw contract code, ensuring it follows consistent indentation, whitespace, and line break rules to help accurately identify the hierarchical structure between code blocks and statements. Obtaining the contract code to be tested can also include: unifying naming conventions, ensuring variable names, function names, and other identifiers follow consistent naming conventions. Obtaining the contract code to be tested can also include: code simplification, simplifying complex code structures, such as reducing nesting, splitting excessively long functions or classes, and eliminating redundant code, making it easier to understand the logic of the raw contract code. Obtaining the contract code to be tested can also include: handling special characters, ensuring all special characters (such as quotation marks, parentheses, and semicolons) are handled correctly to avoid errors during subsequent analysis.

[0038] In this embodiment, the method for segmenting the acquired contract code to be detected to obtain a set of code units can be as follows: based on the syntax structure or basic structure of the contract code to be detected, the contract code to be detected is split into multiple logically independent code units, such as functions or classes, and each code unit can be classified according to a preset classification strategy. The classified code units are then summarized to form a set of code units.

[0039] S102. Based on the preset target business logic, code unit set, and the classification information of each code unit in the code unit set and the dependency relationship between each code unit, determine the target code block set associated with the target business logic.

[0040] In this embodiment, this step can be used to filter and classify target code blocks related to the target business logic from a massive amount of code units, thereby providing support for security vulnerability detection of the complete business logic contained in high-risk business scenarios.

[0041] The target business logic can be considered as the business logic intended for security vulnerability detection, serving as the core guideline for code unit selection. For example, the target business logic could be financial business logic, such as transfer logic or balance calculation logic. Classification information can be understood as the category corresponding to the code unit.

[0042] In this embodiment, code units can be categorized according to function, with corresponding classification information including categories such as data management, access control, financial logic, or user interaction. Code units can also be categorized according to risk type, with corresponding classification information including categories such as input validation, status change, or external call. This embodiment of the invention does not limit the method of categorizing code units.

[0043] In this embodiment, the dependencies between code units can be analyzed. These dependencies can include calls between code units, data transfer relationships, etc. For example, it can be checked whether a function in a certain code unit depends on the return value of a function in another code unit, or whether it needs to access state variables in other code units.

[0044] In this embodiment, the method for determining the target code block set can be as follows: using a trained model or obtained filtering instructions, based on the characteristics of the target business logic (such as the withdrawal business logic needing to include permission verification, balance query, transfer, and event triggering), determine each first code unit directly associated with the target business logic based on the classification information of each code unit; and determine each second code unit that has a dependency relationship with the first code unit, i.e., indirectly associated with the target business logic, based on the dependency relationship; and integrate each first code unit and each second code unit according to the classification information corresponding to each first code unit and each second code unit to obtain multiple target code blocks corresponding to different categories, and summarize each target code block to form a target code block set.

[0045] S103. Generate virtual contract code based on the pre-built virtual contract structure and the set of target code blocks.

[0046] In this embodiment, the pre-built virtual contract structure may include standardized contract names and declarations of state variables, as well as modifiers (such as onlyOwner) and required events (such as TransferEvent) to enhance the functionality and traceability of the virtual contract code.

[0047] Optionally, the virtual contract structure may include multiple pre-built layered structures to provide a skeleton for the integration of target code blocks. For example, it may include a data layer for functions related to handling state variables and data storage; a logic layer for functions related to handling core business logic; and an interaction layer for functions handling interactions with users or external systems. Optionally, it may also include clear interfaces to facilitate calls between contracts or by users.

[0048] In this embodiment, target code blocks in the target code block set can be integrated according to the virtual contract structure specification based on preset reference location identifiers to generate virtual contract code. It should be noted that the contract code to be detected can come from one or more code files. By segmenting the contract code to be detected to obtain code units, and integrating code units scattered across different code files but related to the target business logic into the same virtual contract code, an ideal execution environment for the target business logic is simulated, facilitating subsequent accurate analysis of potential interaction risks exposed across code files.

[0049] Understandably, during the integration of target code blocks, it is necessary to ensure that the calling relationships between code units are correct and to avoid undefined variables or function calls; it is also necessary to ensure that the logic in the virtual contract code remains consistent and to avoid logical conflicts. For example, it is necessary to ensure that state changes are adjusted at the appropriate time to avoid inconsistent states.

[0050] Optionally, after generating the virtual contract code, detailed comments can be added to each code unit to explain its function, input and output parameters and their importance; documentation can also be created to outline the overall structure, functional modules and their interrelationships of the virtual contract code. The documentation should include information such as the purpose of the virtual contract code, design decisions and potential risks.

[0051] As we know, since the contract code to be tested can come from one or more code files, the code units may use different programming languages. Therefore, during the generation of virtual contract code, the compatibility issues of different programming languages ​​can be resolved by employing methods such as converting high-level languages ​​to low-level languages, setting intermediate code, and selecting appropriate bytecode formats.

[0052] S104. Determine the vulnerability detection results based on the contract code to be detected, the set of code units, and the virtual contract code.

[0053] In this embodiment, vulnerability detection can be performed separately on the contract code to be tested, the set of code units, and the virtual contract code to achieve code unit-level detection, identifying and detecting syntax or logic vulnerabilities within the code unit itself. Simultaneously, overall contract code-level detection is achieved, performing overall execution logic verification on the contract code from each code file to identify issues with the overall execution fluency of the contract and the correlation between code units. Furthermore, it also detects security vulnerabilities in the interaction and association of multiple code files or blocks involved in completing business logic. For example, conflict detection is performed on multiple execution logics, and potential security vulnerabilities in interfaces are detected. Through vulnerability detection in these three dimensions, the type, location, and / or risk level of vulnerabilities can be determined, thereby determining the final vulnerability detection result.

[0054] The security vulnerability detection method provided in this invention segmentes the acquired contract code to be detected to obtain a set of code units; determines a set of target code blocks associated with the target business logic based on the preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependencies between each code unit; generates virtual contract code based on a pre-constructed virtual contract structure and the set of target code blocks; and determines the vulnerability detection result based on the contract code to be detected, the set of code units, and the virtual contract code. This method achieves multi-dimensional vulnerability coverage of micro-units, macro-contracts, and cross-file associations, enabling both explicit vulnerability identification in a single code unit or the contract code to be detected, and implicit vulnerability discovery in multi-unit and multi-file interactive associations. It also achieves accurate vulnerability detection of the target business logic, thereby improving the accuracy and comprehensiveness of security vulnerability detection.

[0055] As a first optional embodiment of the present invention, based on the above embodiments, the obtained contract code to be detected can be segmented to obtain a set of code units, which is specified as the following steps:

[0056] a1) Determine a segmentation strategy based on the syntax structure of the contract code to be detected. The segmentation strategy includes treating each function as an independent code unit, treating each class as an independent code unit, and / or treating each module as an independent code unit.

[0057] b1) According to the segmentation strategy, the contract code to be detected is segmented to obtain at least one code unit;

[0058] c1) Based on the preset classification categories and classification algorithms, integrate the code units to determine the code unit set.

[0059] In this embodiment, each function can be extracted from the contract code to be tested as an independent unit of code, since a function typically represents a specific operation or task. If the contract code to be tested uses object-oriented programming, each class and its methods can be treated as an independent unit of code. Furthermore, for contract code to be tested composed of programming languages ​​that support modules or libraries, different module or library functions can be segmented as independent units of code within the contract code to be tested.

[0060] In this embodiment, the segmented code units can also be categorized. For example, when categorized by function, the code units can be divided into different categories based on their function; preset categories may include data management, access control, financial logic, and user interaction. When categorized by risk type, the code units can be divided into different categories based on the types of risks they may pose; preset categories may include input validation, state changes, and external calls.

[0061] For example, clustering algorithms or trained classification models can be used to classify and integrate code units based on preset classification categories, forming subsets of code units corresponding to different classification categories. The code unit set can be determined by summarizing the subsets of code units.

[0062] The technical solution described in this embodiment divides the contract code to be detected into multiple logically independent code units, allowing subsequent vulnerability detection to focus more on each code unit. Furthermore, classifying these units helps to analyze and organize the code more precisely, thereby improving the accuracy and efficiency of subsequent vulnerability detection.

[0063] As a second optional embodiment of the present invention, based on the above embodiments, the step of determining the vulnerability detection result according to the contract code to be detected, the set of code units, and the virtual contract code can be specified as the following steps:

[0064] a2) Input the contract code to be detected, the code unit set, and the virtual contract code into the trained detection model to obtain the first detection result corresponding to the contract code to be detected, the second detection result corresponding to the code unit set, and the third detection result corresponding to the virtual contract code. The detection model includes multiple decoders, each of which corresponds to different types of code features.

[0065] In this embodiment, multiple decoders can be deployed in the detection model to ensure that different decoders can be responsible for decoding specific types of input code units or code features. By designing multiple decoders, the detection model can process different code types and structures more finely and output detection results in the form of labels representing different types of security vulnerabilities, avoiding overlapping or omissions in the detection scope, thereby improving the detection effect of various security vulnerabilities.

[0066] In this embodiment, features of three types of code can be extracted in parallel. Based on each decoder, according to the extracted features, and combined with a preset vulnerability rule base (such as a vulnerability rule base containing feature templates of typical vulnerabilities), vulnerability tags are output for the three types of code as corresponding detection results. The vulnerability tags may include vulnerability type, risk location, and feature matching degree, etc.

[0067] As one implementation, the step of inputting the contract code to be detected, the code unit set, and the virtual contract code into a trained detection model to obtain a first detection result corresponding to the contract code to be detected, a second detection result corresponding to the code unit set, and a third detection result corresponding to the virtual contract code includes:

[0068] a21) Through the feature extraction module in the vulnerability detection model, feature extraction is performed on the contract code to be detected, the code unit set and the virtual contract code respectively to obtain the first feature vector corresponding to the contract code to be detected, the second feature vector corresponding to the code unit set and the third feature vector corresponding to the virtual contract code.

[0069] In this embodiment, the feature extraction module can extract features from the contract code to be detected to obtain a first feature vector related to the overall structure and logical features of the contract code to be detected, such as function call chain, state variable flow and external dependency relationship.

[0070] In this embodiment, a feature extraction module can be used to extract features from each code unit in the code unit set to obtain a second feature vector related to the internal syntax, logic, and risks of the code unit. For example, features related to variables include variable type, scope, number of assignments, and dependencies between variables; features related to functions include the number of function parameters, visibility, whether state variables are modified, and whether the return value is validated; features related to control flow include the complexity of conditional judgments, branch coverage, and exception triggering conditions.

[0071] In this embodiment, the virtual contract code can be feature extracted by the feature extraction module to obtain a third feature vector related to each running logic, calling interface, etc.

[0072] a22) Input the first feature vector, the second feature vector and the third feature vector into each decoder in the vulnerability detection model to obtain the first sub-result output by each decoder relative to the first feature vector, the second sub-result output by each decoder relative to the second feature vector, and the third sub-result output by each decoder relative to the third feature vector.

[0073] Optionally, the decoder may include a variable declaration decoder, a function call decoder, and a control flow decoder. The variable declaration decoder can specifically handle variable declarations within code units or code features. This type of decoder is responsible for parsing information such as variable definition, scope, and type to detect potential vulnerabilities such as variable tampering, uninitialized variables, or improper access control. The function call decoder can focus on analyzing function call relationships within code units or code features, including interactions with external contract code. By deeply analyzing the passing of function parameters and the call chain, the model can identify vulnerabilities such as reentrancy attacks and unauthorized calls. The control flow decoder can specifically parse control flow structures (such as if-else, while loops, etc.) within code units or code features to assess logical vulnerabilities or race conditions.

[0074] In this embodiment, multiple decoders can typically work in parallel, with different types of code units or code features being processed simultaneously by different decoders. The advantage of this is that parallel processing of multiple code features significantly reduces analysis time when dealing with large-scale contract code to be inspected, and each decoder works independently, providing different perspectives for analyzing the same code. For example, a variable declaration decoder might detect variable-related vulnerabilities, while a control flow decoder focuses on the code's execution logic.

[0075] It should be noted that although decoders process different code units or code features, they are usually designed with information-sharing mechanisms to ensure that decoders can exchange useful information. For example, the function call decoder shares the extracted function call chain information with the control flow decoder; the variable declaration decoder passes variable scope information to other decoders to ensure that variable visibility issues are taken into account during decoding, thereby avoiding omissions of vulnerabilities.

[0076] In this embodiment, the output of each decoder can be a security vulnerability label generated for the code unit or code feature it is responsible for. These labels represent the model's identification results for different vulnerabilities. Since each decoder focuses on different code features, the types of labels generated are also different. For example, variable-related vulnerability labels may include "uninitialized variable", "variable overflow", and "unauthorized modification of variable"; function call-related vulnerability labels may include "reentrancy attack", "unverified external call", and "inappropriately authorized call"; control flow-related vulnerability labels may include "race condition", "infinite loop", and "unhandled exception condition".

[0077] Optionally, the decoder can combine a pre-defined vulnerability rule base (such as a vulnerability rule base containing feature templates of typical security vulnerabilities) to input vulnerability tags as sub-results for the three types of code. For example, typical security vulnerabilities may include: reentrancy attacks, integer overflow / underflow, unchecked call return values, transaction order dependencies, timestamp dependencies, denial of service, improper access control, logical errors, randomness vulnerabilities, delegated call vulnerabilities, constructor vulnerabilities, contract upgrade vulnerabilities, and external dependency vulnerabilities, etc.

[0078] a23) Summarize each of the first sub-results to form a first detection result, summarize each of the second sub-results to form a second detection result, and summarize each of the third sub-results to form a third detection result.

[0079] For example, the first sub-results related to variables, functions, and control flow structures output by the variable declaration decoder, function call decoder, and control flow decoder relative to the first feature vector, respectively, constitute the first detection result for the corresponding contract code to be detected. Based on this, it can be understood that a single detection result may contain multiple security vulnerability types.

[0080] In this embodiment, by summarizing each sub-result, a first detection result relative to the contract code to be tested, a second detection result relative to the set of code units, and a third detection result relative to the virtual contract code can be obtained.

[0081] The above-described technical solution in this embodiment analyzes the features of the contract code, code unit set, and virtual contract code to be detected by setting up multiple decoders. This enables the discovery of deep-seated security vulnerabilities in the code structure and logic from multiple perspectives. It not only covers explicit vulnerabilities but also helps to identify potential hidden security risks, thereby improving the comprehensiveness and accuracy of security vulnerability detection.

[0082] b2) Determine the vulnerability detection result based on the first detection result, the second detection result, and the third detection result.

[0083] In this embodiment, by comprehensively considering the security vulnerabilities in the detection results of the contract code to be detected, the set of code units, and the virtual contract code, the vulnerability detection result corresponding to the original contract code collected is determined, thereby improving the accuracy of potential risk detection and thus discovering security vulnerabilities more comprehensively.

[0084] As one implementation method, based on the above optional embodiments, the step of determining the vulnerability detection result based on the first detection result, the second detection result, and the third detection result can be further specified as the following steps:

[0085] b21) If the first detection result, the second detection result, and the third detection result are all without security vulnerabilities, then the vulnerability detection result is determined to be risk-free;

[0086] b22) If the first detection result and / or the second detection result indicate the existence of a security vulnerability, then the vulnerability detection result is determined to indicate the existence of a risk;

[0087] b23) If the first detection result and the second detection result are both without security vulnerabilities, and the third detection result is that there are security vulnerabilities, then the vulnerability detection result is determined based on the target similarity between the contract code to be detected and the virtual contract code.

[0088] In this embodiment, the first detection result is to check whether the code unit itself has security vulnerabilities, which is the set of code units obtained by splitting. The second detection result is to detect whether the complete contract code to be tested from each code file runs smoothly, whether the function call chain is complete, and whether the state variable updates are consistent, etc., which are contract-level vulnerabilities. Vulnerabilities in code units or the contract as a whole are explicit security vulnerabilities that directly affect the normal operation of the contract or the security of assets. Therefore, if either the first detection result or the second detection result has a security vulnerability, no additional verification is required, and the vulnerability detection result can be directly determined to be risky, thereby improving detection efficiency.

[0089] The third detection result is relative to the detection result of the virtual contract code. The virtual contract code is a comprehensive and relatively pure contract code that focuses on the target business logic, removes redundancy, and integrates cross-file related code. Therefore, the third detection result is essentially the detection of hidden vulnerabilities in the contract under test, such as cross-file interaction risks, anomalies caused by excessively deep logic nesting, and anomalies caused by conflicts between multiple business logics.

[0090] Therefore, if the first, second, and third detection results all show no security vulnerabilities, this represents the ideal security state, and the vulnerability detection result can be determined to be risk-free. However, if the first and second detection results show no security vulnerabilities, but the third detection result indicates the presence of a security vulnerability, further verification is required. This is because the virtual contract code may have exposed hidden risks, or the false positives may be due to differences in the integration of the virtual contract code. Optionally, the detection results can be further verified by comparing the similarity between the contract code to be detected and the virtual contract code.

[0091] Optionally, determining the vulnerability detection result based on the target similarity between the contract code to be detected and the virtual contract code includes:

[0092] Determine the graph similarity and cosine similarity between the contract code to be detected and the virtual contract code, and determine the text similarity based on the graph similarity and the cosine similarity;

[0093] The code to be detected and the virtual contract code are converted into abstract syntax trees respectively, and the structural similarity between the two abstract syntax trees is determined.

[0094] Extract code measurement information from the code to be detected and the virtual contract code respectively, and determine the information similarity between the two code measurement information;

[0095] The text similarity, structural similarity, and information similarity are weighted and summed, and the sum is determined as the target similarity.

[0096] If the target similarity is higher than a preset similarity threshold, the vulnerability detection result is determined to be risky; otherwise, the vulnerability detection result is determined to be risk-free.

[0097] In this embodiment, the text similarity between the contract code to be detected and the virtual contract code can be determined by converting the contract code to be detected and the virtual contract code into vector representations respectively. For example, a vocabulary can be constructed using all unique words in the code, and vectors can be generated based on the frequency of each word in each code segment. On this basis, vectors can be generated by calculating the importance of each word (i.e., the ratio of frequency to document frequency).

[0098] Next, the important elements in each code (such as functions, variables, and classes) are treated as nodes, and the relationships between nodes (such as function calls, variable dependencies, and inheritance relationships) are treated as edges of the graph, thus constructing the graphs corresponding to the contract code to be tested and the virtual contract code, respectively, denoted as the contract graph to be tested and the virtual contract graph.

[0099] Then, in the graphs corresponding to the contract code to be detected and the virtual contract code respectively, the greatest common subset of nodes and edges is found. This process includes: traversing both graphs, finding common nodes and edges, recording the found common nodes and edges, and continuously expanding the subgraphs. The subgraph with the largest number of nodes and edges among all candidate subgraphs is selected as the greatest common subgraph. Once the greatest common subgraph is obtained, the graph similarity between the contract code to be detected and the virtual contract code can be calculated using the following method. Specifically, the number of nodes and edges in the contract graph to be detected and the virtual contract graph are determined, denoted as |GA| and |GB|, respectively. The number of nodes or edges in the greatest common subgraph is denoted as |MCS|. Next, the graph similarity is determined based on the number of nodes and edges in the contract graph to be detected and the virtual contract graph, as well as the number of nodes or edges in the greatest common subgraph. For example, the graph similarity is determined... The method can be expressed as:

[0100] .

[0101] Next, the cosine similarity between the contract code to be detected and the virtual contract code can be determined. By weighted summing of graph similarity and cosine similarity, the summation result is determined as the text similarity.

[0102] It should be noted that the value of cosine similarity is usually between [0,1], where 1 indicates that the two code segments are completely identical; 0 indicates that the two code segments are completely dissimilar; a value close to 1 indicates that the two code segments are very similar; and a value close to 0 indicates that the two code segments have low similarity. In the process of weighted summation of graph similarity and cosine similarity, the sum of the weights assigned to graph similarity and cosine similarity must be equal to 1.

[0103] In this embodiment, by converting the contract code to be detected and the virtual contract code into abstract syntax trees respectively, and comparing the structural similarity of the two abstract syntax trees, this method can more accurately capture the differences at the logical structure level between the codes, rather than just the differences at the text level.

[0104] In this embodiment, code metrics may include loop complexity, lines of code, and method length. Although code metrics cannot directly reflect the similarity between codes, they can provide some useful reference information.

[0105] In this embodiment, a weight can be assigned to each of the text similarity, structural similarity, and information similarity. Each similarity is multiplied by its corresponding weight, and the product values ​​are summed. The summation result is determined as the target similarity between the contract code to be detected and the virtual contract code.

[0106] In this embodiment, if the target similarity is higher than a preset similarity threshold, it can be determined that the virtual contract code accurately reproduces the core logic of the contract code to be detected. The security vulnerability in the virtual contract code is then considered a hidden vulnerability in the contract code to be detected, and the vulnerability detection result can be determined to be risky. Otherwise, the detection result indicating a security vulnerability can be considered a false alarm caused by differences during virtual contract code integration, and the vulnerability detection result can be determined to be risk-free. For example, differences during virtual contract code integration may include incomplete selection of target code blocks during integration or excessive structural adjustments.

[0107] The above-described technical solution in this embodiment provides a method for determining vulnerability detection results by integrating the first, second, and third detection results. By directly judging explicit vulnerabilities in each dimension and introducing similarity checks for implicit vulnerabilities, a more reliable basis for risk assessment is provided. This method not only ensures detection efficiency but also achieves a balance between uncovering implicit vulnerabilities and reducing false positive rates. It avoids unnecessary risk misjudgments caused by differences in the structure of virtual contract code, ensuring the accuracy of security vulnerability detection and obtaining comprehensive and accurate vulnerability detection results.

[0108] In an optional embodiment, a detailed logging mechanism can be introduced to record the operation process and key data of each step. For example, it can record the time and source of the original contract code acquisition, the specific parameters of the code formatting process, the results of code unit segmentation and classification, and the process of virtual contract code generation. Simultaneously, a design audit mechanism can be added to trace and review the entire implementation process of the technical solution.

[0109] To better understand the logging and auditing mechanisms proposed in the above optional embodiments, a specific example is given here.

[0110] Suppose there is a system that is responsible for collecting raw contract code from a remote repository, formatting it, and generating virtual contract code. Introduce logging and auditing mechanisms into this system to ensure that each step of the operation is recorded in detail and can be reviewed and traced.

[0111] The system retrieves the original contract code from a specified Git repository, recording the source of the contract code, including the repository URL, branch, and commit ID. It compares the hash value with the commit ID of the remote repository to ensure the collected contract code is correct. An auditing mechanism checks the completeness of the collection operation, identifying any missing steps or anomalies. The system uses the Prettier tool to format the original contract code, ensuring it conforms to specified style requirements, and records the formatting tool version and parameters. It verifies whether the formatted contract code conforms to the set specifications, checking the correctness of the formatting tool version and parameters. The system divides the contract code into modules or functions and categorizes each code unit based on rules (e.g., classifying finance-related code into a "financial calculation" code block), recording the basis and results of each category. It checks whether the categorization conforms to predetermined rules and algorithms, ensuring the code units are correctly classified. Virtual contract code is generated based on a specified template or structure, recording the input data, template, or structure version used during generation, and the hash value of the generated virtual contract code for future verification. Finally, it checks whether the hash value of the generated virtual contract code matches the hash value of the input data and verifies the correctness of the template or structure version.

[0112] Figure 2 This is a schematic diagram of a security vulnerability detection device provided in an embodiment of the present invention. Figure 2 As shown, the device includes: a segmentation module 21, an integration module 22, a generation module 23, and a result determination module 24, wherein,

[0113] The segmentation module 21 is used to segment the acquired contract code to be tested to obtain a set of code units;

[0114] Integration module 22 is used to determine a set of target code blocks associated with the target business logic based on the preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependency relationship between each code unit;

[0115] The generation module 23 is used to generate virtual contract code based on the pre-built virtual contract structure and the target code block set;

[0116] The result determination module 24 is used to determine the vulnerability detection result based on the contract code to be detected, the code unit set, and the virtual contract code.

[0117] The security vulnerability detection device provided in this invention segmentes the acquired contract code to be detected to obtain a set of code units; determines a set of target code blocks associated with the target business logic based on the preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependencies between each code unit; generates virtual contract code based on a pre-constructed virtual contract structure and the set of target code blocks; and determines the vulnerability detection result based on the contract code to be detected, the set of code units, and the virtual contract code. Using this device, multi-dimensional vulnerability coverage of micro-units, macro-contracts, and cross-file associations is achieved. It enables the identification of explicit vulnerabilities in a single code unit or the contract code to be detected, as well as the discovery of implicit vulnerabilities in multi-unit and multi-file interactive associations, and precise vulnerability detection of the target business logic, thereby improving the accuracy and comprehensiveness of security vulnerability detection.

[0118] Furthermore, the segmentation module 21 may specifically include:

[0119] Based on the syntax structure of the contract code to be detected, a segmentation strategy is determined, which includes treating each function as an independent code unit, each class as an independent code unit, and / or each module as an independent code unit.

[0120] According to the segmentation strategy, the code of the contract to be detected is segmented to obtain at least one code unit;

[0121] Based on the preset classification categories and classification algorithms, integrate the various code units to determine the code unit set.

[0122] Furthermore, the result determination module 24 may specifically include:

[0123] The first determining unit is used to input the contract code to be detected, the code unit set, and the virtual contract code into the trained detection model respectively, and obtain the first detection result corresponding to the contract code to be detected, the second detection result corresponding to the code unit set, and the third detection result corresponding to the virtual contract code. The detection model includes multiple decoders, each decoder corresponding to different types of code features.

[0124] The second determining unit is used to determine the vulnerability detection result based on the first detection result, the second detection result, and the third detection result.

[0125] Furthermore, the first determining unit can specifically be used for:

[0126] The feature extraction module in the vulnerability detection model extracts features from the contract code to be detected, the set of code units, and the virtual contract code to obtain a first feature vector corresponding to the contract code to be detected, a second feature vector corresponding to the set of code units, and a third feature vector corresponding to the virtual contract code.

[0127] The first feature vector, the second feature vector, and the third feature vector are respectively input into each decoder in the vulnerability detection model to obtain the first sub-result output by each decoder relative to the first feature vector, the second sub-result output by each decoder relative to the second feature vector, and the third sub-result output by each decoder relative to the third feature vector.

[0128] The summation of each of the first sub-results constitutes the first detection result, the summation of each of the second sub-results constitutes the second detection result, and the summation of each of the third sub-results constitutes the third detection result.

[0129] Furthermore, the second determining unit may specifically include:

[0130] The first determination subunit is used to determine that the vulnerability detection result is risk-free if the first detection result, the second detection result, and the third detection result are all free of security vulnerabilities.

[0131] The second determination subunit is used to determine that the vulnerability detection result is a risk if the first detection result and / or the second detection result is a security vulnerability.

[0132] The third determination subunit is used to determine the vulnerability detection result based on the target similarity between the contract code to be detected and the virtual contract code if the first detection result and the second detection result both show no security vulnerabilities, and the third detection result shows that a security vulnerability exists.

[0133] Furthermore, the third determination subunit can specifically be used for:

[0134] Determine the graph similarity and cosine similarity between the contract code to be detected and the virtual contract code, and determine the text similarity based on the graph similarity and the cosine similarity;

[0135] The code to be detected and the virtual contract code are converted into abstract syntax trees respectively, and the structural similarity between the two abstract syntax trees is determined.

[0136] Extract code measurement information from the code to be detected and the virtual contract code respectively, and determine the information similarity between the two code measurement information;

[0137] The text similarity, structural similarity, and information similarity are weighted and summed, and the sum is determined as the target similarity.

[0138] If the target similarity is higher than a preset similarity threshold, the vulnerability detection result is determined to be risky; otherwise, the vulnerability detection result is determined to be risk-free.

[0139] The security vulnerability detection device provided in this embodiment of the invention can execute the security vulnerability detection method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0140] Figure 3 A schematic diagram of an electronic device 30 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0141] like Figure 3 As shown, the electronic device 30 includes at least one processor 31 and a memory, such as a read-only memory (ROM) 32 or a random access memory (RAM) 33, communicatively connected to the at least one processor 31. The memory stores computer programs executable by the at least one processor. The processor 31 can perform various appropriate actions and processes based on the computer program stored in the ROM 32 or loaded from storage unit 38 into the RAM 33. The RAM 33 can also store various programs and data required for the operation of the electronic device 30. The processor 31, ROM 32, and RAM 33 are interconnected via a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0142] Multiple components in electronic device 30 are connected to I / O interface 35, including: input unit 36, such as keyboard, mouse, etc.; output unit 37, such as various types of monitors, speakers, etc.; storage unit 38, such as disk, optical disk, etc.; and communication unit 39, such as network card, modem, wireless transceiver, etc. Communication unit 39 allows electronic device 30 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0143] Processor 31 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 31 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 31 performs the various methods and processes described above, such as security vulnerability detection methods.

[0144] In some embodiments, the security vulnerability detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 30 via ROM 32 and / or communication unit 39. When the computer program is loaded into RAM 33 and executed by processor 31, one or more steps of the security vulnerability detection method described above may be performed. Alternatively, in other embodiments, processor 31 may be configured to perform the security vulnerability detection method by any other suitable means (e.g., by means of firmware).

[0145] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0147] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0148] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0149] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0150] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0151] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0152] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A security vulnerability detection method, characterized in that, include: The acquired contract code to be tested is segmented to obtain a set of code units; Based on the preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependency relationships between each code unit, determine the set of target code blocks associated with the target business logic; Based on the pre-built virtual contract structure and the target code block set, generate virtual contract code; The vulnerability detection result is determined based on the contract code to be detected, the set of code units, and the virtual contract code.

2. The method according to claim 1, characterized in that, The process of segmenting the acquired contract code to be tested to obtain a set of code units includes: Based on the syntax structure of the contract code to be detected, a segmentation strategy is determined, which includes treating each function as an independent code unit, each class as an independent code unit, and / or each module as an independent code unit. According to the segmentation strategy, the code of the contract to be detected is segmented to obtain at least one code unit; Based on the preset classification categories and classification algorithms, integrate the various code units to determine the code unit set.

3. The method according to claim 1, characterized in that, The step of determining the vulnerability detection result based on the contract code to be detected, the set of code units, and the virtual contract code includes: The contract code to be detected, the set of code units, and the virtual contract code are respectively input into the trained detection model to obtain the first detection result corresponding to the contract code to be detected, the second detection result corresponding to the set of code units, and the third detection result corresponding to the virtual contract code. The detection model includes multiple decoders, each of which corresponds to different types of code features. Based on the first detection result, the second detection result, and the third detection result, the vulnerability detection result is determined.

4. The method according to claim 3, characterized in that, The step of inputting the contract code to be detected, the set of code units, and the virtual contract code into the trained detection model to obtain a first detection result corresponding to the contract code to be detected, a second detection result corresponding to the set of code units, and a third detection result corresponding to the virtual contract code includes: The feature extraction module in the vulnerability detection model extracts features from the contract code to be detected, the set of code units, and the virtual contract code to obtain a first feature vector corresponding to the contract code to be detected, a second feature vector corresponding to the set of code units, and a third feature vector corresponding to the virtual contract code. The first feature vector, the second feature vector, and the third feature vector are respectively input into each decoder in the vulnerability detection model to obtain the first sub-result output by each decoder relative to the first feature vector, the second sub-result output by each decoder relative to the second feature vector, and the third sub-result output by each decoder relative to the third feature vector. The summation of each of the first sub-results constitutes the first detection result, the summation of each of the second sub-results constitutes the second detection result, and the summation of each of the third sub-results constitutes the third detection result.

5. The method according to claim 3, characterized in that, The step of determining the vulnerability detection result based on the first detection result, the second detection result, and the third detection result includes: If the first detection result, the second detection result, and the third detection result are all negative for security vulnerabilities, then the vulnerability detection result is determined to be risk-free. If the first detection result and / or the second detection result indicate the existence of a security vulnerability, then the vulnerability detection result is determined to indicate a risk. If the first detection result and the second detection result both indicate no security vulnerability, but the third detection result indicates the existence of a security vulnerability, then the vulnerability detection result is determined based on the target similarity between the contract code to be detected and the virtual contract code.

6. The method according to claim 5, characterized in that, The step of determining the vulnerability detection result based on the target similarity between the contract code to be detected and the virtual contract code includes: Determine the graph similarity and cosine similarity between the contract code to be detected and the virtual contract code, and determine the text similarity based on the graph similarity and the cosine similarity; The code to be detected and the virtual contract code are converted into abstract syntax trees respectively, and the structural similarity between the two abstract syntax trees is determined. Extract code measurement information from the code to be detected and the virtual contract code respectively, and determine the information similarity between the two code measurement information; The text similarity, structural similarity, and information similarity are weighted and summed, and the sum is determined as the target similarity. If the target similarity is higher than a preset similarity threshold, the vulnerability detection result is determined to be risky; otherwise, the vulnerability detection result is determined to be risk-free.

7. A security vulnerability detection device, characterized in that, include: The segmentation module is used to segment the acquired contract code to be tested to obtain a set of code units; An integration module is used to determine a set of target code blocks associated with the target business logic based on a preset target business logic, the set of code units, the classification information of each code unit in the set of code units, and the dependency relationships between each code unit. The generation module is used to generate virtual contract code based on the pre-built virtual contract structure and the target code block set; The result determination module is used to determine the vulnerability detection result based on the contract code to be detected, the set of code units, and the virtual contract code.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the security vulnerability detection method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the security vulnerability detection method according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the security vulnerability detection method according to any one of claims 1-6.

Images