Smart contract security vulnerability identification method and system based on multi-modal feature learning
By employing a multimodal feature learning approach, combined with CodeBERT and extended graph convolutional networks, the problems of strong expert dependence and insufficient feature fusion in existing smart contract vulnerability identification methods are solved, achieving accurate identification and efficient detection of different vulnerability types.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ZHEJIANG INT STUDIES UNIV
- Filing Date
- 2026-01-26
- Publication Date
- 2026-05-12
AI Technical Summary
Existing smart contract vulnerability identification methods rely on manually defined detection rules, which are highly dependent on experts and have high rule maintenance costs. Sequence methods ignore code structure information, graph methods suffer from semantic information loss, and existing fusion methods do not consider the differences in feature dependence among different vulnerability types, resulting in limited detection effectiveness.
A multimodal feature learning-based approach is adopted, which integrates feature fusion through code structure graph construction, sequence semantic feature extraction, and graph structure feature extraction, combined with an adaptive weight learning mechanism. Features are extracted using CodeBERT and extended graph convolutional networks, and vulnerability identification is performed through a multilayer perceptron classifier, thus solving the problem of adaptive detection for different vulnerability types.
It achieves accurate identification of smart contract vulnerabilities, improves the accuracy and robustness of detection, and can identify reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and delegatecall vulnerabilities. It has good generalization ability and identification effect.
Smart Images
Figure CN122020661A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of blockchain security technology, and in particular to a method and system for identifying smart contract security vulnerabilities based on multimodal feature learning. Background Technology
[0002] Smart contract vulnerability identification is a crucial component of blockchain security systems. Identifying security vulnerabilities in smart contracts can address issues in blockchain-related fields, including digital asset protection, financial security, and user trust. For example, when developers deploy smart contracts, vulnerability identification results can provide reasonable security recommendations and remediation solutions. DeFi protocols and NFT transactions play a key role in the blockchain ecosystem, and understanding their security status is essential for asset protection and sustainable development. Currently, many scholars have proposed methods for detecting smart contract vulnerabilities based on various technologies, such as symbolic execution, rule matching, and deep learning. However, mining vulnerability patterns from source code and accurately identifying them is a more effective method. It not only contains rich code semantic and structural information but also allows for the discovery of problems before contract deployment, without relying on the runtime environment.
[0003] There are three main categories of methods for identifying smart contract vulnerabilities using deep learning. The first category is based on sequence models, such as bidirectional long short-term memory networks and Transformers. These methods treat code as linear text, ignoring the inherent structural information of the code and making it difficult to capture complex data flow and control flow dependencies. Furthermore, these methods suffer from the vanishing gradient problem when handling long sequences, resulting in limited fitting performance. The second category is based on graph neural networks, such as graph convolutional networks and graph attention networks. These methods model program dependencies by constructing a code structure graph, but suffer from semantic information loss due to node pruning, failing to fully utilize the deep semantics of the code. The third category is based on pre-trained models, primarily CodeBERT and other code pre-trained models. These methods are pre-trained on large-scale code corpora, learning rich code semantic knowledge, making them suitable for application on large datasets and possessing good semantic understanding capabilities. However, there are also several problems in smart contract vulnerability detection applications. Some deep learning models cannot adaptively detect different types of vulnerabilities, such as reentrancy vulnerabilities and timestamp dependency vulnerabilities, which have different degrees of dependence on sequence and structural information, making it difficult to model them uniformly. Meanwhile, most deep learning models do not fully integrate the sequential semantic features and graph structure features of the code, and only consider information from a single modality. Although a few models attempt feature fusion, they use simple concatenation or fixed weights and do not perform adaptive fusion according to different vulnerability types, resulting in limited detection performance.
[0004] Currently, existing smart contract vulnerability identification methods have the following main problems: 1) Traditional methods rely on manually defined detection rules, cannot automatically learn vulnerability patterns, are highly dependent on experts, and have high rule maintenance costs; 2) Sequence methods ignore code structure information, and graph methods suffer from semantic information loss, failing to fully integrate sequence semantic features and graph structure features; 3) Existing fusion methods adopt a fixed weight strategy, do not consider the differences in feature dependence of different vulnerability types, and cannot achieve adaptive fusion. Summary of the Invention
[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a method and system for identifying smart contract security vulnerabilities based on multimodal feature learning. By inputting the source code of a smart contract into the method of this invention, security vulnerabilities in the contract can be accurately identified, exhibiting good accuracy and robustness.
[0006] This invention is achieved through the following technical solution: a method for identifying smart contract security vulnerabilities based on multimodal feature learning, comprising the following steps: (1) Code structure diagram construction: Standardize the source code of the smart contract; construct the processed code into a code structure diagram; (2) Sequence semantic feature extraction: The standardized source code is segmented into token sequences, and after adding position encoding, it is input into the CodeBERT model. The hidden state at the [CLS] position is used as the sequence semantic feature. (3) Graph structure feature extraction: Extended graph convolutional network is used to extract features from the code structure graph to obtain graph structure features; the extended graph convolutional network includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operation and graph-level feature aggregation; (4) Multimodal feature fusion: Sequence semantic features and graph structure features are fused through an adaptive weight learning mechanism to obtain fused features; (5) Vulnerability identification: Input the fused features into the multilayer perceptron classifier and output the vulnerability identification results; (6) Performance evaluation: Based on the vulnerability identification results in step (5), calculate the corresponding accuracy, precision, recall and F1 score, and then evaluate the identification effect and performance to obtain the evaluation index results; (7) Results Display: The vulnerability identification results and evaluation index results are visualized through confusion matrix or ROC curve.
[0007] Specifically, the standardization process in step (1) includes removing single-line comments and multi-line comments, deleting redundant blank lines and whitespace characters, and adopting a unified indentation rule.
[0008] Specifically, the code structure graph in step (1) is G=(V, E), which defines two types of graph nodes and three types of edge relationships, where V is the set of nodes and E is the set of edges. This code structure graph is used to model the control flow and data dependency relationships in the smart contract code. The two types of graph nodes include general nodes and core nodes, and the three types of edge relationships include control flow edges, data flow edges and fallback edges.
[0009] Furthermore, the sequence semantic feature extraction in step (2) specifically includes the following sub-steps: (2.1) Segment the standardized code according to the vocabulary to obtain the token sequence: ; in, Indicates the first One token, The sequence length; (2.2) Add special markers at the beginning and end of the token sequence. and This leads to the complete input sequence: [CLS] [SEP]; and generate a position code for each position in the sequence and embed it into the token; (2.3) Input the sequence obtained in step (2.2) into the CodeBERT model, and the model outputs a hidden state matrix: ; in, The hidden state matrix, It is the dimension of the hidden state; (2.4) From the hidden state matrix Extract the vector corresponding to the first position, that is, the vector corresponding to the [CLS] marker: ; This vector is used as the semantic feature of the entire code sequence, and finally the sequence semantic features are output. : .
[0010] Further, in step (3), the total number of layers in the extended graph convolutional network is L=3; specifically, it includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operations, and graph-level feature aggregation; wherein, the input-output change process of the multi-level feature preservation mechanism is as follows: ; ; in, For nodes In the The intermediate state of the layer, For nodes In the The hidden state of the layer For nodes The original characteristics, For nodes In the The hidden state of the layer For the first The learnable weight matrix of the layer, For nodes The set of neighboring nodes, This is an aggregation function used to integrate neighbor information. γ is a non-linear activation function, and β are learnable balance parameters. This mechanism balances local structure learning with the preservation of original information through residual connections and original feature injection, thereby enhancing the feature stability of deep networks. The input-output change process of the enhanced edge attention mechanism of the extended graph convolutional network is as follows: ; ; in, For the edge eigenvectors, and They are nodes and nodes In the The hidden state of the layer An embedded representation of the edge type. For the type of edge, For timing position encoding, Temporal information of edges, || represents feature concatenation operation, For the edge Attention weights The learnable weight matrix for the attention mechanism. For activation function, This is a normalization function; this mechanism comprehensively considers edge type and temporal information to improve the ability to distinguish different types of edge relationships. The input-output change process of the adaptive graph convolution operation in the extended graph convolutional network is as follows: ; in, For the first The hidden state matrix of all nodes in the layer. For the first The hidden state matrix of all nodes in the layer. It is an adjacency matrix. A second-order adjacency matrix is used to model the influence of two-hop neighbors. It is the identity matrix. For attention operations, For the first The weight matrix of the layer, It is a non-linear activation function; by introducing a second-order adjacency matrix, the connectivity between nodes is enhanced, which is used to capture indirect dependencies; The graph-level feature aggregation of the extended graph convolutional network adopts a multi-scale pooling strategy, and its input-output transformation process is as follows: ; ; ; ; in, Let be the hidden state matrix of all nodes in layer L, where L is the total number of layers in the extended graph convolutional network. For the max pooling result, This is a max pooling operation used to capture the most salient features. For average pooling results, This is for average pooling operations, used to provide overall statistics. For the attention pooling result, This is an attention pooling operation used to learn weighted representations of important nodes. For graph structure features, This is a feature splicing operation.
[0011] Furthermore, the multimodal feature fusion in step (4) specifically includes the following sub-steps: (4.1) Adaptive weight learning: based on input sequence features With graph features The adaptive weight learning mechanism learns the adaptive weights for the two modal features of the input. The input-output change process is as follows: ; ; in, For the gated weight matrix, For bias vectors, It is the Sigmoid activation function. For sequence feature weights, As a graph feature weighting mechanism, this mechanism can dynamically adjust the weights of the two modal features according to different vulnerability types; (4.2) Multi-level feature fusion: Based on the weights learned in step (4.1) , and original features , Multi-level feature fusion is performed to generate the final fused feature. The input-output change process is as follows: ; ; ; in, For linear fusion features, through learned weights and The two features are combined in a weighted manner. For interactive fusion features, ⊙ represents element-wise multiplication. It is a multilayer perceptron used to model the interaction relationships between features. For the final fusion feature, this multi-level fusion strategy retains the independent information of a single modality while incorporating cross-modal interactive features.
[0012] Specifically, the input-output change process of the multilayer perceptron classifier in step (5) is as follows: ; MLP is a multilayer perceptron with two hidden layers, using the ReLU activation function and Dropout regularization. Let y be the probability of belonging to category y given contract C, where y∈{0,1} represents the vulnerability identification result, y=1 indicates the existence of a vulnerability, and y=0 indicates the absence of a vulnerability.
[0013] Furthermore, the method addresses the class imbalance problem in smart contract vulnerability data by introducing a focus loss function to dynamically reduce the contribution of easily classified samples to the total loss, thus focusing the training process on difficult-to-classify samples and improving the ability to identify minority class vulnerabilities. The specific expression of the focus loss function is as follows: ; in, For the focus of loss, α is the probability of identification, α is the class weight coefficient used to control the importance of positive and negative samples, and γ is the focusing parameter used to control the importance of easy and difficult samples.
[0014] Specifically, the method can identify smart contract vulnerability types including reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and Delegatecall vulnerabilities.
[0015] This invention also provides a smart contract security vulnerability identification system based on multimodal feature learning, which specifically includes the following modules: Code structure diagram construction module: Standardizes smart contract source code; constructs the processed code into a code structure diagram; Sequence semantic feature extraction module: The standardized source code is segmented into token sequences, and after adding positional encoding, it is input into the CodeBERT model. The hidden state at the [CLS] position is used as the sequence semantic feature. Graph structure feature extraction module: The extended graph convolutional network is used to extract features from the code structure graph. The extended graph convolutional network includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operation and graph-level feature aggregation. Multimodal feature fusion module: It fuses sequence semantic features and graph structure features through an adaptive weight learning mechanism to obtain fused features; Vulnerability identification module: Inputs fused features into a multilayer perceptron classifier and outputs vulnerability identification results; Performance evaluation module: Based on the vulnerability identification results, calculate the corresponding accuracy, precision, recall and F1 score to measure the identification effect and performance; Results Display Module: Visualizes the vulnerability identification results obtained by the vulnerability identification module and the evaluation index results obtained by the performance evaluation module through confusion matrix or ROC curve.
[0016] The beneficial effects of this invention are as follows: (1) This invention not only considers sequence semantic features and graph structure features, but also enhances the structural modeling capability by extending the graph convolutional network, and improves the identification effect of smart contract vulnerabilities by fusing sequence features and graph features. (2) This invention achieves dynamic feature fusion through an adaptive weight learning mechanism, automatically adjusting feature weights according to different vulnerability types, thus eliminating the limitations of fixed weight strategies; (3) This invention has a good identification effect on different types of vulnerabilities, including reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities and delegatecall vulnerabilities. Attached Figure Description
[0017] Figure 1 This is a structural diagram of the smart contract security vulnerability identification method of the present invention; Figure 2 This is a functional block diagram of the system of the present invention; Figure 3 This is a hardware structure diagram of any device with data processing capabilities in which the system of this invention is located. Detailed Implementation
[0018] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.
[0019] This invention presents a smart contract security vulnerability identification method based on multimodal feature learning. This method, based on smart contract source code, designs a multimodal feature extraction framework composed of CodeBERT and an extended graph convolutional network, mainly including a sequence semantic feature extraction module, a graph structure feature extraction module, a multimodal feature fusion module, and a vulnerability identification module. This invention extracts sequence semantic features and graph structure features from standardized source code, using CodeBERT to extract deep semantic information and an extended graph convolutional network to extract structured dependencies, respectively. Furthermore, an adaptive weight learning mechanism is employed to dynamically fuse and reconstruct sequence and graph features, thereby achieving accurate vulnerability identification. The method described in this invention can identify four types of vulnerabilities, including reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and delegatecall vulnerabilities. This invention integrates sequence semantic features and graph structure features, not only improving the accuracy of smart contract vulnerability identification but also adaptively identifying different types of vulnerabilities, unconstrained by specific vulnerability patterns, and exhibiting good generalization and robustness.
[0020] As attached Figure 1 The diagram shown illustrates the structure of the smart contract security vulnerability identification method of this invention. The method consists of four main parts: the first part is code structure graph construction, which involves standardizing the original smart contract source code to construct a code structure graph; the second part is multimodal feature extraction, including two parallel branches: sequence semantic feature extraction and graph structure feature extraction. Sequence semantic feature extraction is implemented using the CodeBERT model, while graph structure feature extraction is implemented using an extended graph convolutional network (EPR). The EPR includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operations, and graph-level feature aggregation; the third part is multimodal feature fusion, which dynamically fuses the two types of features using an adaptive weight learning mechanism, employing a multi-level fusion strategy combining linear fusion and interactive fusion; the fourth part is vulnerability identification, which outputs the final identification result through a multi-layer perceptron classifier, calculates evaluation metrics through a performance evaluation module, and finally visualizes the results through a result display module.
[0021] The specific implementation steps of this invention are as follows: (1) Code Structure Graph Construction. The smart contract source code is standardized, including removing single-line and multi-line comments, deleting redundant blank lines and whitespace characters, and adopting a unified indentation rule. The processed code is constructed into a code structure graph G=(V, E), where V is the set of nodes and E is the set of edges. The code structure graph defines two types of graph nodes and three types of edge relationships to model the control flow and data dependencies in the smart contract code. The two types of graph nodes include general nodes and core nodes, and the three types of edge relationships include control flow edges, data flow edges, and fallback edges.
[0022] (2) Sequence semantic feature extraction. This includes the following sub-steps: (2.1) Segment the standardized code according to the vocabulary to obtain the token sequence: ; in, Indicates the first One token, The sequence length; (2.2) Add special markers at the beginning and end of the token sequence. and This leads to the complete input sequence: [CLS] [SEP]; and generate a position code for each position in the sequence and embed it into the token; (2.3) Input the sequence obtained in step (2.2) into the CodeBERT model, and the model outputs a hidden state matrix:
[0023] in, The hidden state matrix, It is the dimension of the hidden state; (2.4) From the hidden state matrix Extract the vector corresponding to the first position, that is, the vector corresponding to the [CLS] marker: ; This vector is used as the semantic feature of the entire code sequence, and the final output is the sequence semantic feature:
[0024] in, These are sequence semantic features.
[0025] (3) Graph structure feature extraction. An Extended Graph Convolutional Network (EGCN) is used to extract features from the code structure graph, yielding graph structure features. The EGCN includes multi-level feature preservation mechanisms, enhanced edge attention mechanisms, adaptive graph convolution operations, and graph-level feature aggregation.
[0026] The input-output change process of the multi-level feature preservation mechanism is as follows:
[0027]
[0028] in, For nodes In the The intermediate state of the layer, For nodes In the The hidden state of the layer For nodes The original characteristics, For nodes In the The hidden state of the layer For the first The learnable weight matrix of the layer, For nodes The set of neighboring nodes, This is an aggregation function used to integrate neighbor information. γ is a nonlinear activation function, and β are learnable balancing parameters. This mechanism balances local structure learning with the preservation of original information through residual connections and the injection of original features, thereby enhancing the feature stability of deep networks.
[0029] The input-output change process of the enhanced side attention mechanism is as follows:
[0030]
[0031] in, For the edge eigenvectors, and They are nodes and nodes In the The hidden state of the layer An embedded representation of the edge type. For the type of edge, For timing position encoding, Temporal information of edges, || represents feature concatenation operation, For the edge Attention weights The learnable weight matrix for the attention mechanism. For activation function, This is the normalization function. This mechanism comprehensively considers edge type and temporal information, improving the ability to distinguish between different types of edge relationships.
[0032] The input-output transformation process of adaptive graph convolution operation is as follows:
[0033] in, For the first The hidden state matrix of all nodes in the layer. For the first The hidden state matrix of all nodes in the layer. It is an adjacency matrix. A second-order adjacency matrix is used to model the influence of two-hop neighbors. It is the identity matrix. For attention operations, For the first The weight matrix of the layer, This is a non-linear activation function. By introducing a second-order adjacency matrix to enhance the connectivity between nodes, it helps to capture indirect dependencies.
[0034] The graph-level feature aggregation of extended graph convolutional networks employs a multi-scale pooling strategy, and its input-output transformation process is as follows:
[0035]
[0036]
[0037]
[0038] in, Let L be the hidden state matrix of all nodes in layer L, where L is the total number of layers in the extended graph convolutional network. Generally, parameter L = 3. For the max pooling result, This is a max pooling operation used to capture the most salient features. For average pooling results, This is for average pooling operations, used to provide overall statistics. For the attention pooling result, This is an attention pooling operation used to learn weighted representations of important nodes. For graph structure features, This is a feature splicing operation.
[0039] (4) Multimodal feature fusion. Sequence semantic features and graph structure features are fused using an adaptive weight learning mechanism to obtain fused features. This includes the following sub-steps: (4.1) Adaptive weight learning: based on input sequence features With graph features The adaptive weight learning mechanism learns the adaptive weights for the two modal features of the input. The input-output change process is as follows:
[0040]
[0041] in, For the gated weight matrix, For bias vectors, It is the Sigmoid activation function. For sequence feature weights, As a graph feature weighting mechanism, this mechanism can dynamically adjust the weights of the two modal features according to different vulnerability types.
[0042] (4.2) Multi-level feature fusion: Based on the weights learned in step (4.1) , and original features , Multi-level feature fusion is performed to generate the final fused feature. The input-output change process is as follows:
[0043]
[0044]
[0045] in, For linear fusion features, through learned weights and The two features are combined in a weighted manner. For interactive fusion features, ⊙ represents element-wise multiplication. It is a multilayer perceptron used to model the interaction relationships between features. For the final fusion feature, this multi-level fusion strategy retains the independent information of a single modality while incorporating cross-modal interactive features.
[0046] (5) Vulnerability identification. The fused features are input into the multilayer perceptron classifier, and the vulnerability identification results are output.
[0047] The input-output change process of a multilayer perceptron classifier is as follows:
[0048] MLP is a multilayer perceptron with two hidden layers, using the ReLU activation function and Dropout regularization. Let y be the probability of belonging to category y given contract C, where y∈{0,1} represents the vulnerability identification result, y=1 indicates the existence of a vulnerability, and y=0 indicates the absence of a vulnerability.
[0049] The loss function of the method described in this invention adopts the focus loss function, as follows:
[0050] in, For the focus of loss, The probability of identification is given by α, which is the class weight coefficient used to control the importance of positive and negative samples, and γ is the focusing parameter used to control the importance of easy and difficult samples. This loss function reduces the weight of easy-to-classify samples, making the method pay more attention to difficult-to-classify samples, thus solving the class imbalance problem of smart contract vulnerability data.
[0051] The method described in this invention can identify such vulnerabilities by training the source code of a smart contract that contains them. The smart contract vulnerabilities that this method can identify include, but are not limited to, reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and delegatecall vulnerabilities, as detailed below: (a) Reentrancy vulnerability: This vulnerability exploits the time difference between the "debit" and "post" actions in a transfer operation to trigger an attack. When user A transfers money to user B through a function, B's fallback function is automatically triggered due to the default settings of the contract. At this time, the fallback function can call the transfer function again, thereby illegally transferring A's funds multiple times.
[0052] (b) Timestamp Dependence Vulnerability: This vulnerability is an attack method that exploits the manipulability of block timestamps. When the critical logic of a smart contract depends on the block timestamp, an attacker can manipulate the timestamp to achieve unfair transactions.
[0053] (c) tx.origin vulnerability: This vulnerability is a phishing attack based on the abuse of global variables. When a smart contract incorrectly uses tx.origin instead of msg.sender for authentication, an attacker can bypass the contract's authentication logic by constructing a malicious contract to trick the user into calling it.
[0054] (d) Delegatecall vulnerability: This vulnerability stems from the improper use of the delegatecall() function. When delegatecall is used on an untrusted contract, an attacker can exploit this mechanism to overwrite critical state variables of the caller contract, thereby bypassing access control logic.
[0055] (6) Performance Evaluation. Based on the vulnerability identification results of step (5), calculate the corresponding accuracy, precision, recall, and F1 score to measure the identification effect and performance. The specific calculation methods are as follows:
[0056]
[0057]
[0058]
[0059] in, To determine the number of positive classes predicted as positive, To determine the number of negative classes predicted as negative, To determine the number of negative classes predicted as positive, This represents the number of positive classes predicted as negative classes.
[0060] (7) Present the results. Visualize the vulnerability identification results obtained in step (5) and the evaluation index results obtained in step (6) using a confusion matrix or ROC curve.
[0061] As attached Figure 2 As shown, this invention also provides a functional module diagram of a smart contract security vulnerability identification system based on multimodal feature learning, including a code structure graph construction module, a sequence semantic feature extraction module, a graph structure feature extraction module, a multimodal feature fusion module, a vulnerability identification module, a performance evaluation module, and a result display module connected in sequence. The specific details of the code structure graph construction module, sequence semantic feature extraction module, graph structure feature extraction module, multimodal feature fusion module, vulnerability identification module, performance evaluation module, and result display module are as follows: Code structure diagram construction module: Standardizes smart contract source code; constructs the processed code into a code structure diagram; Sequence semantic feature extraction module: The standardized source code is segmented into token sequences, and after adding positional encoding, it is input into the CodeBERT model. The hidden state at the [CLS] position is used as the sequence semantic feature. Graph structure feature extraction module: The extended graph convolutional network is used to extract features from the code structure graph. The extended graph convolutional network includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operation and graph-level feature aggregation. Multimodal feature fusion module: It fuses sequence semantic features and graph structure features through an adaptive weight learning mechanism to obtain fused features; Vulnerability identification module: Inputs fused features into a multilayer perceptron classifier and outputs vulnerability identification results; Performance evaluation module: Based on the vulnerability identification results, calculate the corresponding accuracy, precision, recall and F1 score to measure the identification effect and performance; Results Display Module: Visualizes the vulnerability identification results obtained by the vulnerability identification module and the evaluation index results obtained by the performance evaluation module through confusion matrix or ROC curve.
[0062] Accordingly, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; and when the one or more programs are executed by the one or more processors, the one or more processors implement the smart contract security vulnerability identification method based on multimodal feature learning as described above.
[0063] like Figure 3 The diagram shown is a hardware structure diagram of any device with data processing capabilities, used in an embodiment of the present invention to provide a smart contract security vulnerability identification system based on multimodal feature learning. (Except for...) Figure 3 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.
[0064] Accordingly, this application also provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the smart contract security vulnerability identification method based on multimodal feature learning described above. The computer-readable storage medium can be an internal storage unit of any data-processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data-processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data-processing device, and can also be used to temporarily store data that has been output or will be output.
[0065] The embodiments described in this specification are merely examples of implementations of the inventive concept. The scope of protection of this invention should not be considered as limited to the specific forms stated in the embodiments. The scope of protection of this invention also extends to equivalent technical means that can be conceived by those skilled in the art based on the inventive concept.
Claims
1. A method for identifying smart contract security vulnerabilities based on multimodal feature learning, characterized in that, Includes the following steps: (1) Code structure diagram construction: Standardize the source code of smart contracts; The processed code is then constructed into a code structure diagram; (2) Sequence semantic feature extraction: The standardized source code is segmented into token sequences, and after adding position encoding, it is input into the CodeBERT model. The hidden state at the [CLS] position is used as the sequence semantic feature. (3) Graph structure feature extraction: Extended graph convolutional network is used to extract features from the code structure graph to obtain graph structure features; The extended graph convolutional network includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operations, and graph-level feature aggregation. (4) Multimodal feature fusion: Sequence semantic features and graph structure features are fused through an adaptive weight learning mechanism to obtain fused features; (5) Vulnerability identification: Input the fused features into the multilayer perceptron classifier and output the vulnerability identification results; (6) Performance evaluation: Based on the vulnerability identification results in step (5), calculate the corresponding accuracy, precision, recall and F1 score, and then evaluate the identification effect and performance to obtain the evaluation index results; (7) Results Display: The vulnerability identification results and evaluation index results are visualized through confusion matrix or ROC curve.
2. The method according to claim 1, characterized in that, The standardization process in step (1) specifically includes removing single-line comments and multi-line comments, deleting redundant blank lines and whitespace characters, and adopting a unified indentation rule.
3. The method according to claim 1, characterized in that, The code structure graph in step (1) is G=(V, E), which defines two types of graph nodes and three types of edge relationships, where V is the set of nodes and E is the set of edges. This code structure graph is used to model the control flow and data dependency relationships in smart contract code. The two types of graph nodes include general nodes and core nodes, and the three types of edge relationships include control flow edges, data flow edges and fallback edges.
4. The method according to claim 1, characterized in that, The sequence semantic feature extraction in step (2) specifically includes the following sub-steps: (2.1) Segment the standardized code according to the vocabulary to obtain the token sequence: ； in, Indicates the first One token, The sequence length; (2.2) Add special markers at the beginning and end of the token sequence. and This leads to the complete input sequence: [CLS] [SEP]; and generate a position code for each position in the sequence and embed it into the token; (2.3) Input the sequence obtained in step (2.2) into the CodeBERT model, and the model outputs a hidden state matrix: ； in, The hidden state matrix, It is the dimension of the hidden state; (2.4) From the hidden state matrix Extract the vector corresponding to the first position, that is, the vector corresponding to the [CLS] marker: ； This vector is used as the semantic feature of the entire code sequence, and finally the sequence semantic features are output. : 。 5. The method according to claim 1, characterized in that, In step (3), the total number of layers in the extended graph convolutional network is L=3; specifically, it includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operations, and graph-level feature aggregation; wherein, the input-output change process of the multi-level feature preservation mechanism is as follows: ； ； in, For nodes In the The intermediate state of the layer, For nodes In the The hidden state of the layer For nodes The original characteristics, For nodes In the The hidden state of the layer For the first The learnable weight matrix of the layer, For nodes The set of neighboring nodes, This is an aggregation function used to integrate neighbor information. γ is a non-linear activation function, and β are learnable balance parameters. This mechanism balances local structure learning with the preservation of original information through residual connections and original feature injection, thereby enhancing the feature stability of deep networks. The input-output change process of the enhanced edge attention mechanism of the extended graph convolutional network is as follows: ； ； in, For the edge eigenvectors, and They are nodes and nodes In the The hidden state of the layer An embedded representation of the edge type. For the type of edge, For timing position encoding, Temporal information of edges, || represents feature concatenation operation, For the edge Attention weights The learnable weight matrix for the attention mechanism. For activation function, This is a normalization function; this mechanism comprehensively considers edge type and temporal information to improve the ability to distinguish different types of edge relationships. The input-output change process of the adaptive graph convolution operation in the extended graph convolutional network is as follows: ； in, For the first The hidden state matrix of all nodes in the layer. For the first The hidden state matrix of all nodes in the layer. It is an adjacency matrix. A second-order adjacency matrix is used to model the influence of two-hop neighbors. It is the identity matrix. For attention operations, For the first The weight matrix of the layer, It is a non-linear activation function; by introducing a second-order adjacency matrix, the connectivity between nodes is enhanced, which is used to capture indirect dependencies; The graph-level feature aggregation of the extended graph convolutional network adopts a multi-scale pooling strategy, and its input-output transformation process is as follows: ； ； ； ； in, Let be the hidden state matrix of all nodes in layer L, where L is the total number of layers in the extended graph convolutional network. For the max pooling result, This is a max pooling operation used to capture the most salient features. For the average pooling result, This is for average pooling operations, used to provide overall statistics. For the attention pooling result, This is an attention pooling operation used to learn weighted representations of important nodes. For graph structure features, This is a feature splicing operation.
6. The method according to claim 1, characterized in that, The multimodal feature fusion in step (4) specifically includes the following sub-steps: (4.1) Adaptive weight learning: based on input sequence features With graph features The adaptive weight learning mechanism learns the adaptive weights for the two modal features of the input. The input-output change process is as follows: ； ； in, For the gated weight matrix, For bias vectors, It is the Sigmoid activation function. For sequence feature weights, As a graph feature weighting mechanism, this mechanism can dynamically adjust the weights of the two modal features according to different vulnerability types; (4.2) Multi-level feature fusion: Based on the weights learned in step (4.1) , and original features , Multi-level feature fusion is performed to generate the final fused feature. The input and output change process is as follows: ； ； ； in, For linear fusion features, through learned weights and The two features are combined in a weighted manner. For interactive fusion features, ⊙ represents element-wise multiplication. It is a multilayer perceptron used to model the interaction relationships between features. For the final fusion feature, this multi-level fusion strategy retains the independent information of a single modality while incorporating cross-modal interactive features.
7. The method according to claim 1, characterized in that, The input-output change process of the multilayer perceptron classifier in step (5) is as follows: ； MLP is a multilayer perceptron with two hidden layers, using the ReLU activation function and Dropout regularization. Let y be the probability of belonging to category y given contract C, where y∈{0,1} represents the vulnerability identification result, y=1 indicates the existence of a vulnerability, and y=0 indicates the absence of a vulnerability.
8. The method according to claim 1, characterized in that, The method addresses the class imbalance problem in smart contract vulnerability data by introducing a focus loss function to dynamically reduce the contribution of easily classified samples to the total loss. This allows the training process to focus on difficult-to-classify samples, thereby improving the vulnerability identification capability. The specific expression of the focus loss function is as follows: ； in, For the focus of loss, α is the probability of identification, α is the class weight coefficient used to control the importance of positive and negative samples, and γ is the focusing parameter used to control the importance of easy and difficult samples.
9. The method according to claim 1, characterized in that, The method can identify smart contract vulnerability types including reentrancy vulnerabilities, timestamp dependency vulnerabilities, tx.origin vulnerabilities, and delegatecall vulnerabilities.
10. The system for identifying smart contract security vulnerabilities based on multimodal feature learning according to any one of claims 1-9, characterized in that, The system specifically includes the following modules: Code structure diagram construction module: Standardizes smart contract source code; constructs the processed code into a code structure diagram; Sequence semantic feature extraction module: The standardized source code is segmented into token sequences, and after adding positional encoding, it is input into the CodeBERT model. The hidden state at the [CLS] position is used as the sequence semantic feature. Graph structure feature extraction module: The extended graph convolutional network is used to extract features from the code structure graph. The extended graph convolutional network includes a multi-level feature preservation mechanism, an enhanced edge attention mechanism, adaptive graph convolution operation and graph-level feature aggregation. Multimodal feature fusion module: It fuses sequence semantic features and graph structure features through an adaptive weight learning mechanism to obtain fused features; Vulnerability identification module: Inputs fused features into a multilayer perceptron classifier and outputs vulnerability identification results; Performance evaluation module: Based on the vulnerability identification results, calculate the corresponding accuracy, precision, recall and F1 score to measure the identification effect and performance; Results Display Module: Visualizes the vulnerability identification results obtained by the vulnerability identification module and the evaluation index results obtained by the performance evaluation module through confusion matrix or ROC curve.