Network attack detection method based on operation code graph
By constructing an opcode graph and training it with DeBERTaV3 and a graph isomorphic network, the problem of identifying complex attacks in smart contract calls is solved, achieving efficient attack detection and accurate analysis of contract call relationships.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING LANYUN TECH CO LTD
- Filing Date
- 2026-01-29
- Publication Date
- 2026-05-01
AI Technical Summary
Existing technologies struggle to identify and respond to complex network attacks during smart contract calls, resulting in a high false alarm rate and an inability to effectively detect multi-contract calls and dynamic interactions across contracts.
By constructing an opcode graph, extracting node features using the DeBERTaV3 model, and training it with contrastive learning and graph isomorphic networks, a graph-level representation of the attack contract call is generated. Combined with adversarial graph augmentation and contrastive learning methods, automated attack detection is achieved.
It improves the accuracy of attack detection, effectively identifies the connections between multiple attack contract calls with small sample data, achieves automated detection without relying on expert rules, and has strong scalability.
Smart Images
Figure CN121967003A_ABST
Abstract
Description
A network attack detection method based on opcode graph Technical Field
[0001] This invention relates to blockchain regulatory technology, specifically to a network attack detection method based on opcode graphs. Background Technology
[0002] Smart contracts are self-managing computer programs deployed on blockchain networks, triggered by user invocation. Due to their tamper-proof and automatic execution characteristics, smart contracts are widely used in software engineering, the Internet of Things, business, and medicine, among other fields. However, the increasing number of smart contract vulnerabilities (SCVs) poses a serious threat to the security of network users.
[0003] In recent years, many excellent SCV detection methods have been proposed to enhance the security of blockchain contract calls. While these methods have made some progress in ensuring network security, most existing solutions focus on the vulnerability detection level of smart contracts, neglecting how to identify and respond to malicious contract calls in real-world contract call scenarios. Therefore, the vulnerable contracts detected by existing tools are mostly valueless or unexploitable contracts, resulting in a high false positive rate. All of these factors make it difficult for existing solutions to play a substantial role in ensuring the security of blockchain contract calls.
[0004] To address the shortcomings of existing methods in understanding attack semantics, it is necessary to investigate real-world cyberattacks. Previous research has primarily relied on expert-defined detection rules or feature extraction from single contract calls. However, real-world attacks often consist of multiple contract calls and may involve internal calls between smart contracts. This multi-contract call and dynamic interaction across contracts makes it difficult for a single contract call to fully reflect the attack intent. Therefore, previous research has typically failed to detect such complex attacks and has struggled to directly extract attack patterns from on-chain contract calls. Summary of the Invention
[0005] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a network attack detection method based on opcode graphs.
[0006] Technical solution: The present invention provides a network attack detection method based on opcode graphs, comprising the following steps:
[0007] Step 1: Collect contract call data and replay it. This involves collecting attack contract call data from real attack events, then replaying the contract calls locally based on the collected contract call hash values to obtain execution information (such as stack information, memory information, storage information, and other dynamic information). After processing, an opcode sequence is obtained (mainly by extracting parameters from the execution information according to the execution logic of the specific opcodes, and then serializing it according to the execution order to obtain a global opcode sequence).
[0008] Step 2: Construct the opcode graph. This involves dividing the opcode sequence obtained in Step 1 into blocks, merging opcode blocks with the same address and call depth into a single node, and generating edges based on their call relationships to form the opcode graph. The specific method is as follows:
[0009] Step 2.1: The opcode sequence is used as input, and logically continuous subsequences are divided by the boundaries of call-related instructions (e.g., CALL, DELEGATECALL) and termination-related instructions (e.g., RETURN, STOP). Since the same contract may call other contracts during execution, the opcode sequence of the same contract may be scattered. To accurately attribute block results, blocks are aggregated according to contract address and call depth, and continuous blocks of the same contract are merged into a single node to ensure the consistency and integrity of node semantics.
[0010] However, when a contract is invoked again after completing an internal call and returning, its opcode logic or parameters may change even if the address and call depth are the same. In this case, instead of merging it with the previous node, a separate node identifier should be generated for the new call to avoid the loss of critical information.
[0011] S2.2 Node Embeddings (used as attributes to represent nodes and input into the contrastive model for training): To generate a meaningful representation for each node, the DeBERTaV3 model is used to extract node features from the opcode sequence of each node (to extract features for the opcode sequence in each node); DeBERTaV3 enables the capture of subtle relationships between opcodes and their execution context, thereby generating feature-rich embeddings for each node in the graph.
[0012] For subsequence blocks of contract calls containing long opcode sequences (e.g., more than 512 tokens), a sliding window technique is used to split the opcode sequence into overlapping fragments, then the embedding of each fragment is calculated, and these embeddings are aggregated by taking the average, thereby creating a final embedding vector for each node.
[0013] Here, the process first divides the logically continuous subsequences into blocks based on the boundaries of the relevant call and end instructions. Then, it further divides the already split subsequences into blocks. If the subsequences are too long, the sliding window technique is used to split the opcode sequence into overlapping segments for block calculation.
[0014] Step 3: Comparative Learning and Training
[0015] The opcode map obtained in step 2 is labeled, and the labeled opcode map is input into the contrastive learning model (e.g., using a graph isomorphic network GIN) for training. The model is trained by comparing the ordinary augmentation map, the original opcode map, and the adversarial augmentation map. Finally, the trained contrastive learning model is output.
[0016] Step S4, Attack Detection,
[0017] Based on the trained contrastive learning model, a graph-level representation of the opcode graph is obtained, which is then used to train a classifier. Finally, the trained classifier is used to perform the attack classification task.
[0018] Furthermore, the detailed process of step 1 is as follows:
[0019] Step 1.1: Data collection of attack contract calls. First, research network attack reports from well-known websites and collect the attacker's address, attack contract address, and attack contract call hash. Then, find the corresponding contract calls involved in the attack contract from the GON attack contract address and build a dataset.
[0020] Step 1.2: RPC request contract call replay, that is, by forking the network from the specified block of the network to the local network, and then by sending an RPC request to specify the attack contract call hash, the previously collected attack contract calls are re-executed in the local forked network environment, thereby obtaining detailed information on the execution of the attack contract calls;
[0021] Step 1.3: Data preprocessing, which involves extracting the required call addresses, parameters, and other information from the execution environment, such as memory, storage, and stack space, based on the execution information of each attack contract call and according to the specific execution behavior of the opcode. The opcodes and the extracted information are then processed into an opcode sequence according to the original opcode execution order.
[0022] Furthermore, the specific method for step 3 is as follows:
[0023] S3.1, Adversarial Graph Enhancement: For a batch of block-based operation code graphs and a batch of ordinary enhanced views The goal is to generate a batch of adversarial enhancement graphs. ,picture The result is obtained after perturbation, and with added constraints on the changes in the adjacency matrix and the characteristic matrix. ;
[0024] The combination of each batch of images is represented as: , , ;
[0025] The objective of graph-level adversarial graph contrastive learning is: ;
[0026] S3.2, Graph-level Regularization and Projection: During the attack phase, the perturbation matrix... and its convex hull Further constraints apply: if the node and nodes If the nodes come from two graphs in the batch, then they must be block diagonal matrices, and their positions must be... The gradient at that point is 0;
[0027] This can be easily achieved by using a block diagonal mask to zero out the gradient during the forward propagation:
[0028] ;
[0029] ;
[0030] in It is a product of elements. This is a batch of images. The number of nodes in;
[0031] S3.3, Contrastive Training: Graph-level contrastive learning is performed using a three-layer GIN network;
[0032] The symmetric normalized adjacency matrix is defined as: ;
[0033] in, It is an adjacency matrix with added self-connections. It is the identity matrix. yes The angle matrix, and ;
[0034] The graph isomorphic network operator is defined as: ;
[0035] in, The node feature matrix of the representative graph. This represents the updated node feature matrix after processing by the graph isomorphic network operator; It is a neural network (e.g., using a multilayer perceptron (MLP)). It is a nonnegative scalar, a three-layer GIN stack with three graph isomorphism operators. It is a two-layer MLP, followed by an activation function and batch normalization, and all operators All are set to 0;
[0036] make Indicates the first Node embedding after each operator;
[0037] The final node embedding is The series connection is represented as Graph embedding is a cascade of node embeddings after average pooling: .
[0038] Furthermore, to improve training effectiveness, a corresponding loss function is used during the training process. The details are as follows:
[0039] For a batch of images By discarding nodes, sampling subgraphs, perturbing edges, and masking features, a common augmented graph is obtained for each graph, i.e. Similar to GraphCL;
[0040] Loss functions for these two batches of graphs The definition is as follows:
[0041] ;
[0042] in and ;
[0043] For convenience, it is also used Let represent the loss function for graph-level contrastive learning. The actual meaning depends on the input type (graph or set);
[0044] Finally, the final loss function of graph-level contrastive learning is obtained. as follows:
[0045] .
[0046] Furthermore, the specific method of step 4 is as follows:
[0047] S4.1 Classifier Training: For the model trained through contrastive learning, input the opcode image to obtain the graph-level representation of each image, and then input it into the SVC classifier for training;
[0048] S4.2 Attack Detection: Input the opcode graph of a normal contract call into the contrast learning model to obtain a graph-level representation, then input it into the trained SVC classifier for training, and obtain the final classification result for attack detection.
[0049] Beneficial effects: Compared with the prior art, the present invention has the following advantages:
[0050] (1) This invention traces malicious contract calls and constructs an opcode graph to represent the opcode semantic logic and complex call relationships between contracts during the actual execution of the attack contract call. It can also integrate multiple attack contract calls into a single graph, thereby capturing the connections between multiple attack contract calls.
[0051] (2) The present invention adopts the method of adversarial graph enhancement and contrastive learning, which enables it to obtain an effective representation of graph data even with small sample data, and realizes an automated detection mechanism that does not rely on expert rules. It can be extended to other attack types and has strong scalability.
[0052] (3) This invention discovers the characteristics of attack contract calls by investigating attack events, and constructs a contract call dataset and dynamic information that can characterize the execution of attack contract calls based on this, thereby improving the accuracy of attack detection. Attached Figure Description
[0053] Figure 1 is a diagram of the overall system framework of the present invention;
[0054] Figure 2 is a flowchart of the opcode diagram construction process of the present invention;
[0055] Figure 3 is a schematic diagram of the opcode features, node features and edge features in the embodiment. Detailed Implementation
[0056] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.
[0057] As shown in Figure 1, a network attack detection method based on opcode graphs according to the present invention includes the following steps:
[0058] Step 1: Collect contract call data and replay it. This involves collecting attack contract call data from real attack events, then replaying the contract calls locally based on the collected contract call hash values to obtain the execution information and then processing it to obtain the opcode sequence.
[0059] Step 2: Construct the opcode graph. This involves dividing the opcode sequence obtained in Step 1 into blocks, merging opcode blocks with the same address and call depth into a single node, and generating edges based on their call relationships to form the opcode graph. The specific method is as follows:
[0060] Step 2.1: Take the opcode sequence as input and divide it into logically continuous sub-sequence blocks, using the call-related instructions and the end-related instructions as boundaries; then aggregate the sub-sequence blocks according to the contract address and call depth, and merge the continuous blocks of the same contract into a single node; when the contract is called again after completing the internal call and returning, that is, when the contract address and call depth are the same, generate an independent node identifier for the new call.
[0061] Step 2.2, Node embedding, which involves using the DeBERTaV3 model to extract node features from the opcode sequence of nodes generated in Step 2.1;
[0062] For sub-sequence blocks of contract calls containing long opcode sequences, a sliding window is used to split the opcode sequence into overlapping fragments;
[0063] Then, the node embeddings for each segment are calculated, and all node embeddings are aggregated by taking the average, thereby creating a final embedding vector for each node;
[0064] Step 3: Comparative learning training. First, the opcode image obtained in Step 2 is labeled. Then, the labeled opcode image is input into the comparative learning model for training. The model is trained by comparing the normal augmented image, the original opcode image, and the adversarial augmented image. Finally, the trained comparative learning model is output.
[0065] Step 4, Attack Detection: Based on the contrastive learning model trained in Step 3, a graph-level representation of the opcode graph is obtained. This representation is then used to train a classifier, which is then used to classify attacks.
[0066] The specific process of data collection and contract call replay in this embodiment is as follows:
[0067] First, we investigate reports of network attacks from well-known websites and collect information such as attacker addresses, attack contract addresses, and attack contract call hashes.
[0068] Then, the corresponding contract calls involved in the attack contract are found from the attack contract address, and a dataset is constructed. By forking the network from a specified block to the local machine, and then using an RPC request to specify the attack contract call hash, the previously collected attack contract calls are re-executed in the local forked network environment, thereby obtaining detailed information about the execution of the attack contract calls.
[0069] Finally, based on the execution information of each attack contract call, and according to the specific execution behavior of the opcode, the required call address, parameters and other information are extracted from the obtained execution environment such as memory, storage and stack space, and an opcode sequence is formed by the opcode and the extracted information according to the original opcode execution order.
[0070] The specific process of constructing opcodes in this embodiment is as follows:
[0071] The opcode sequence is divided into blocks, and then the blocks are merged to generate a graph structure. Specifically, the preprocessed opcode sequence is used as input, and logically continuous subsequences are divided along the boundaries of call-related instructions and termination-related instructions. Since the same contract may call other contracts during execution, the opcode sequence of the same contract may be scattered. To accurately attribute block results, blocks are aggregated based on contract address and call depth, and continuous blocks of the same contract are merged into a single node to ensure the consistency and integrity of node semantics.
[0072] However, when a contract is invoked again after completing an internal call and returning, its opcode logic or parameters may change even if the address and call depth are the same. In this case, instead of merging it with the previous node, a separate node identifier should be generated for the new call to avoid the loss of critical information.
[0073] To generate a meaningful representation for each node, I applied a DeBERTaV3 model to extract features from the opcode. The DeBERTaV3 model is able to capture the subtle relationships between the opcode and its execution context, thereby generating feature-rich embeddings for each node in the graph.
[0074] For contract calls containing long opcode sequences, a sliding window technique is used to split the opcode sequence into overlapping segments, the embedding of each segment is calculated, and these embeddings are aggregated by averaging to create a final embedding vector for each node.
[0075] The detailed process of comparative learning in this embodiment is as follows:
[0076] For a batch of images and a batch of enhanced views The goal is to generate a batch of adversarial views and represent them as The combination of each batch of images is represented as follows: , , The objective of graph-level adversarial graph contrastive learning is stated as follows: .
[0077] During the attack phase, the perturbation matrix and its convex hull Further constraints apply: if the node and nodes If the nodes come from two graphs in the batch, then they must be block diagonal matrices, and their positions must be... The gradient at that point is 0, which can be easily achieved by clearing the gradient to zero using a block diagonal mask during forward propagation:
[0078] ,
[0079] .
[0080] A three-layer GIN network is used for graph-level comparative learning.
[0081] The symmetric normalized adjacency matrix is defined as: ;
[0082] in, It is an adjacency matrix with added self-connections. It is an identity matrix. yes The angle matrix, and .
[0083] The graph isomorphic network operator is defined as: ;
[0084] in, It is a two-layer perceptron MLP, followed by an activation function and batch normalization, and all operators All are set to 0;
[0085] make Indicates the first Node embedding after each operator.
[0086] The final node embedding is Series, represented as Graph embedding is a cascade of node embeddings after average pooling: .
[0087] For a batch of images By discarding nodes, sampling subgraphs, perturbing edges, and masking features, enhancements are obtained for each graph, i.e. .
[0088] The loss function for these two batches of graphs is defined as follows:
[0089] ;
[0090] in and .
[0091] Last use Let's represent the loss function for graph-level contrastive learning:
[0092] .
[0093] The detailed method for attack detection in this embodiment is as follows: The constructed dataset is input into a trained contrastive learning model to obtain a graph representation, and then an SVC classifier is trained. The execution of a normal contract call is replayed, and an opcode graph is constructed. This opcode graph of the normal contract call is input into the trained contrastive learning model to obtain a graph representation, and finally input into the trained SVC classifier to obtain the attack detection result.
[0094] The technical solution of this invention is compared with the existing technology, and the results are shown in Table 1.
[0095] Table 1
[0096]
[0097] The last row in Table 1 represents the performance of the technical solution (Tx-ACL) of this invention. It discovers attacks from normal contract calls through real events. The designed opcode graph can characterize the execution order of contract calls involved in the attack on the network and the complex call relationships between contracts, thereby capturing the execution trajectory of the attack contract calls. The contrastive learning framework can not only achieve efficient few-shot learning with limited labeled samples, but also realize an automated detection mechanism that does not rely on expert rules.
Claims
1. A network attack detection method based on opcode graphs, characterized in that, Includes the following steps: Step 1: Collect contract call data and replay it. This involves collecting attack contract call data from real attack events, then replaying the contract calls locally based on the collected contract call hash values to obtain execution information and then processing it to obtain the opcode sequence. Step 2: Construct the opcode graph. This involves dividing the opcode sequence into blocks, merging opcode blocks with the same address and call depth into a single node, and generating edges based on their call relationships to form the opcode graph. Specifically: Step 2.1: Using the opcode sequence as input, and using call-related instructions and end-related instructions as boundaries, divide logically continuous sub-sequence blocks. Then, aggregate the sub-sequence blocks based on the contract address and call depth, merging continuous blocks of the same contract into a single node. When a contract is called again after completing an internal call and returning (i.e., when the contract address and call depth are the same), generate an independent node identifier for the new call. Step 2.2: Node embedding. This involves using the DeBERTaV3 model to extract node features from the opcode sequence of the nodes generated in Step 2.
1. For a sub-sequence block of a contract call containing a long opcode sequence, a sliding window is used to split the opcode sequence into overlapping fragments; then, the node embedding of each fragment is calculated, and the average value of all node embeddings is used to aggregate them, thereby creating a final embedding vector for each node; Step 3, contrastive learning training, that is, first annotating the opcode graph obtained in Step 2, and then inputting the annotated opcode graph into the contrastive learning model for training, in which learning and training are performed by comparing the ordinary augmented graph, the original opcode graph and the adversarial augmented graph, and finally outputting the trained contrastive learning model; Step 4, attack detection, that is, based on the contrastive learning model trained in Step 3, the graph-level representation of the opcode graph is obtained, and this is used to train a classifier, and finally the trained classifier is obtained to perform the attack classification task.
2. The network attack detection method based on opcode graphs according to claim 1, characterized in that, The detailed process of step 1 is as follows: Step 1.1, Attack contract call data collection: First, investigate network attack events from real websites, collect the attacker's address, attack contract address, and attack contract call hash; then, find the corresponding contract calls involved in the attack contract from the GON attack contract addresses and build a dataset; Step 1.2, RPC request contract call replay: Fork the network from a specified block to the local machine, and then, through an RPC request specifying the attack contract call hash, re-execute the previously collected attack contract calls in the local forked network environment to obtain detailed information on the execution of the attack contract calls; Step 1.3, Data preprocessing: Based on the execution information of each attack contract call, extract the call address and parameters from the execution environment according to the specific execution behavior of the opcode, and form an opcode sequence according to the original opcode execution order and the extracted information.
3. The network attack detection method based on opcode graphs according to claim 1, characterized in that, The specific method for step 3 is as follows: Step 3.1, Generate adversarial enhancement graph. For a batch of block-based operation code diagrams and a batch of ordinary enhanced maps Generate corresponding adversarial enhancement graphs through graph-level adversarial graph comparison learning. ； In the above formula, For the image The perturbation matrix is obtained by adding constraints on the adjacency matrix and characteristic matrix; Step 3.2, graph-level regularization and projection: During the attack phase, the perturbation matrix... and its convex hull Further constraints apply: if the node and nodes If the nodes come from two graphs in the batch respectively, then the nodes and nodes It must be a block diagonal matrix, and the position... The gradient at a given point is 0; this can be easily achieved by using a block diagonal mask to clear the gradient to zero during forward propagation. ； ;in It is a product of elements. This is a batch of images. The number of nodes in the graph; S3.3, Contrastive Training: Using a three-layer GIN network for graph-level contrastive learning; The symmetric normalized adjacency matrix is defined as: ;in It is an adjacency matrix with added self-connections. It is the identity matrix. yes The angle matrix, and The graph isomorphic network operator is defined as: ;in, The node feature matrix of the representative graph. This represents the updated node feature matrix after processing by the graph isomorphic network operator; It is a neural network MLP. It is a nonnegative scalar, a three-layer GIN stack of three graph isomorphism operators. Followed by activation function and batch normalization, and all operators Set all to 0; let Indicates the first The node embeddings after each operator; the final node embedding is The series connection is represented as Graph embedding is a cascade of node embeddings after average pooling: 。 4. The network attack detection method based on opcode graphs according to claim 3, characterized in that, For a batch of images By discarding nodes, sampling subgraphs, perturbing edges, and masking features, a common augmented graph is obtained for each graph. ,Right now The diagram and ordinary enhanced image loss function The definition is as follows: ;in and ; Use last Let's represent the loss function for graph-level contrastive learning. The formula is as follows: 。 5. The network attack detection method based on opcode graphs according to claim 1, characterized in that, The specific method of step 4 is as follows: S4.1 Classifier training: For the model obtained after contrastive learning training, input the opcode image to obtain the graph-level representation of each image, and then input it into the SVC classifier for training; S4.2 Attack Detection: Input the opcode graph of a normal contract call into the contrast learning model to obtain a graph-level representation, then input it into the trained SVC classifier for training, and obtain the final classification result for attack detection.