Role-based guidance retrieval enhanced generation arbitrage robot fraud detection method and system

Abstract

The present application relates to a kind of based on role guide search enhancement generated arbitrage robot fraud detection method and system.The method includes: the bytecode of the smart contract to be detected is obtained to be decompiled and is mapped to the intermediate representation of static single assignment form, and control flow graph is built;Extracting transfer flow, address flow, data flow forms role guide flow;Based on known fraud contract and legal contract, vector database is built;The role guide flow is vectorized to obtain the feature vector to be measured, and is retrieved in vector database, the cosine similarity of the feature vector to be measured and sample feature vector is calculated, and example contract is screened out;Based on preset prompt word template, role guide flow and the example contract screened out are spliced and structured into enhanced prompt word input into large language model, and output result is obtained and whether the smart contract to be detected is arbitrage robot fraud contract is judged.In the meantime of enhancing detection effect, reduce the false positive rate and the consumption of computing resources of detection.

Description

Technical Field

[0001] This invention relates to the fields of blockchain security and artificial intelligence technology, and in particular to a method and system for detecting fraudulent arbitrage robots based on role-guided retrieval enhancement. Background Technology

[0002] Arbitrage bots are important participants in the decentralized finance (DeFi) ecosystem, generating profits by automatically executing price arbitrage strategies across trading platforms. However, they have also spawned blockchain scams that rely on arbitrage bots. Currently, arbitrage bot scams have become a typical risk in the blockchain security field. These scams typically spread through social networking platforms such as X and Telegram, distributing fake arbitrage programs to users. While the smart contracts corresponding to these fake programs superficially appear legitimate with identical function names to legitimate arbitrage trading contracts, their underlying code hides malicious operations that illegally transfer users' digital assets to the scammer's wallet. Once users deploy or use such contracts, they face serious losses due to asset theft, posing a significant threat to the secure and stable development of the blockchain DeFi ecosystem.

[0003] While existing technologies have developed detection methods to combat arbitrage bot fraud, limitations in their underlying principles and application scenarios prevent them from efficiently and accurately identifying such fraudulent contracts, thus hindering effective prevention of this type of scam. Specifically, traditional social network analysis methods primarily focus on off-chain social platform data, failing to delve into the underlying code logic of blockchain contracts. Existing social bot detection relies mainly on relationship patterns and content similarity for identification, whereas arbitrage bots are profit-making entities within DeFi protocols, requiring analysis of blockchain transaction or contract code logic to determine their true intentions. Traditional static analysis (such as symbolic execution) is prone to state explosion due to the surge in execution paths caused by complex address obfuscation strategies (such as XOR obfuscation and fragmented distribution), making rapid and accurate vulnerability identification difficult.

[0004] Therefore, traditional methods for detecting arbitrage bot fraud are limited by various static analysis techniques and cannot delve into the contract bytecode level to analyze malicious transfer logic, often resulting in low detection accuracy and high resource consumption. Summary of the Invention

[0005] In order to solve the above-mentioned technical problems, a method and system for detecting arbitrage robot fraud based on role-guided retrieval enhancement is provided, which can improve the detection effect while reducing the false alarm rate and computational resource consumption.

[0006] A method for detecting fraudulent arbitrage bots based on role-guided retrieval enhancement, the method comprising:

[0007] Obtain the bytecode of the smart contract to be tested, decompile and parse the bytecode and map it into an intermediate representation in static single-assignment form, and construct a control flow graph based on the intermediate representation;

[0008] Based on the control flow graph, the transfer flow, address flow, and data flow are extracted respectively to form a role guidance flow;

[0009] Obtain a sample library of known fraudulent contracts and legitimate contracts, extract sample role guidance flows from the sample library, map them into sample feature vectors, and construct a vector database;

[0010] The role-guided flow is vectorized to obtain the feature vector to be tested. The vector is then searched in the vector database. The cosine similarity between the feature vector to be tested and the sample feature vector is calculated to select example contracts.

[0011] Based on the preset prompt word template, the role-guided flow and the selected example contracts are combined to construct enhanced prompt words;

[0012] The enhanced prompt words are input into a large language model to obtain the output results and determine whether the smart contract to be detected is a fraudulent contract of an arbitrage bot.

[0013] In one embodiment, the bytecode is decompiled and parsed and mapped into an intermediate representation in static single-assignment form. A control flow graph is constructed based on the intermediate representation, including:

[0014] The bytecode is decompiled and parsed to obtain an intermediate representation.

[0015] The intermediate representation is reconstructed according to the static single assignment rule, so that each variable in the intermediate representation is assigned a value only once, thus forming a static single assignment intermediate representation.

[0016] Traverse all instructions in the intermediate representation, divide consecutive instructions into multiple basic blocks, and treat each basic block as a node;

[0017] Identify jump instructions in the instructions and use the jump instructions as edges connecting each of the basic block nodes;

[0018] Using each of the basic blocks as nodes and each of the jump instructions as edges, a control flow graph in the form of contract opcodes is constructed.

[0019] In one embodiment, based on the control flow graph, the transfer flow is extracted, including:

[0020] Find the target function and its signature, and obtain the first recipient address and the first transfer amount parameters based on the target function and its signature;

[0021] Tag analysis technology is used to track all flows of the first recipient address and the first transfer amount parameters in the control flow graph and arrange them in the order of operation to form the first transfer flow of ERC20 token transfer;

[0022] Find the CALL opcode and locate the ETH transfer operation to obtain the second recipient's address and the second transfer amount parameters;

[0023] Tag analysis technology is used to track all flows of the second recipient address and the second transfer amount parameters in the control flow graph and arrange them in the order of operation to form the second transfer flow of ETH token transfer;

[0024] The first and second transfer flows are integrated to obtain the final transfer flow.

[0025] In one embodiment, based on the control flow graph, the address flow is extracted, including:

[0026] Extract the sender's address and receiver's address of the transfer transaction from the transfer stream;

[0027] Use a decompilation tool to import the corresponding global variable value in the control flow graph based on the sender address, and determine whether the global variable value is the slot value of the owner of the smart contract to be detected;

[0028] If so, taint analysis technology is used to extract all opcodes between the sender address and the receiver address, and the opcodes are arranged in the order of execution to obtain the address stream.

[0029] In one embodiment, based on the control flow graph, data flow is extracted, including:

[0030] In the intermediate representation of the static single assignment form, the start and end points of the private function are located through the first opcode;

[0031] The second opcode guides the flow of data between the start and end points of the private function, obtains all opcodes in the flow process, and arranges them in the order of flow to obtain the data stream.

[0032] In one embodiment, a sample library of known fraudulent contracts and legitimate contracts is obtained, and sample role guidance flows are extracted from the sample library, mapped to sample feature vectors, and a vector database is constructed, including:

[0033] Obtain a sample library of known fraudulent contracts and legitimate contracts;

[0034] For each contract in the sample library, convert it into a sample control flow graph in contract opcode format;

[0035] Based on the sample control flow graph, the sample transfer flow, address flow, and data flow are extracted respectively to form the sample role guidance flow;

[0036] The vector embedding model is invoked to map the sample role guidance flow into sample feature vectors. The sample feature vectors are associated with the corresponding fraud tags and legal tags and stored in the database to construct a vector database.

[0037] In one embodiment, the role-guided flow is vectorized to obtain a feature vector to be tested, which is then searched in the vector database. The cosine similarity between the feature vector to be tested and the sample feature vector is calculated to select example contracts, including:

[0038] The character guidance flow is input into a vector embedding model for vectorization to obtain the feature vector to be tested;

[0039] Based on the vector database, the cosine similarity between the feature vector to be tested and all the sample feature vectors in the vector database is calculated one by one to obtain each cosine similarity value.

[0040] The cosine similarity values ​​are sorted, and example contracts and their corresponding tags are selected according to preset filtering rules.

[0041] In one embodiment, based on a preset prompt word template, the enhanced prompt words are constructed by concatenating the role-guided flow and the selected example contracts, including:

[0042] Retrieve a preset arbitrage robot fraud detection prompt template and obtain the filling detection task description at the corresponding position of the prompt template;

[0043] According to the description of the detection task, the code of the contract to be detected, the role guide flow, the example contract and its corresponding tags are filled into the prompt word template to obtain the enhanced prompt words.

[0044] A fraud detection system for arbitrage bots based on role-guided retrieval enhancement, the system comprising:

[0045] The preprocessing module is used to obtain the bytecode of the smart contract to be tested, decompile and parse the bytecode and map it into an intermediate representation in static single-assignment form, and construct a control flow graph based on the intermediate representation;

[0046] The role feature extraction module is used to extract the transfer flow, address flow, and data flow based on the control flow graph to form a role guidance flow;

[0047] The vector database construction module is used to obtain a sample library of known fraudulent contracts and legitimate contracts, and extract sample role guidance flows based on the sample library, map them into sample feature vectors, and construct a vector database.

[0048] The vector retrieval module is used to vectorize the role guidance flow to obtain the feature vector to be tested, search the vector database, calculate the cosine similarity between the feature vector to be tested and the sample feature vector, and filter out example contracts.

[0049] The retrieval enhancement module is used to construct enhanced prompts by concatenating the role-guided traffic and the selected example contracts based on a preset prompt template.

[0050] The fraud prediction module is used to input the enhanced prompt words into a large language model, obtain the output results, and determine whether the smart contract to be detected is a fraudulent contract of an arbitrage robot.

[0051] In one embodiment, the preprocessing module is further configured to: perform decompilation and parsing operations on the bytecode to obtain an intermediate representation; reconstruct the intermediate representation according to the static single assignment rule, so that each variable in the intermediate representation is assigned only once, forming a static single assignment intermediate representation; traverse all instructions in the intermediate representation, divide consecutive instructions in the instructions into multiple basic blocks, and use each basic block as a node; identify jump instructions in the instructions, and use the jump instructions as edges connecting each of the basic block nodes; and construct a control flow graph in the contract opcode format using each of the basic blocks as nodes and each of the jump instructions as edges.

[0052] The aforementioned method and system for detecting fraudulent arbitrage robots based on role-guided retrieval enhancement extracts transfer flow, address flow, and data flow from the control flow graph. By combining precise matching of similar contracts with enhanced inference, it can deeply analyze the underlying code logic of contracts, accurately identify hidden malicious operations, and effectively improve the accuracy of fraudulent contract detection. By using role-guided flow for vectorization and retrieval, redundant information is eliminated, simplifying the analysis process of complex contracts. This can enhance the detection effect while reducing the false alarm rate and computational resource consumption. Attached Figure Description

[0053] Figure 1 This is an application environment diagram of an arbitrage robot fraud detection method based on role-guided retrieval enhancement in one embodiment;

[0054] Figure 2 This is a flowchart illustrating a method for detecting fraudulent arbitrage robots based on role-guided retrieval enhancement in one embodiment.

[0055] Figure 3This is a schematic diagram of the enhanced prompt word structure in one embodiment;

[0056] Figure 4 This is a schematic diagram illustrating the application framework of an arbitrage robot fraud detection method based on role-guided retrieval enhancement in one embodiment.

[0057] Figure 5 This is a schematic diagram showing the comparison of detection rates between a role-guided retrieval-enhanced arbitrage robot fraud detection method in one embodiment and existing tools.

[0058] Figure 6 This is a structural block diagram of an arbitrage bot fraud detection system based on role-guided retrieval enhancement in one embodiment;

[0059] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0061] It is understood that the terms "first," "second," etc., used in this application may be used herein to describe recipient addresses, transfer amount parameters, transfer flows, and opcodes, but these recipient addresses, transfer amount parameters, transfer flows, and opcodes are not limited by these terms. These terms are only used to distinguish the first transfer flow from the other. For example, without departing from the scope of this application, the first transfer flow may be referred to as the second transfer flow, and similarly, the second transfer flow may be referred to as the first transfer flow. Both the first and second transfer flows are transfer flows, but they are not the same transfer flow.

[0062] The arbitrage bot fraud detection method based on role-guided retrieval enhancement provided in this application can be applied to, for example... Figure 1 The application environment shown. For example... Figure 1As shown, the application environment includes computer device 110. Computer device 110 can acquire the bytecode of the smart contract to be detected, decompile and parse the bytecode, and map it into an intermediate representation in static single-assignment form. Based on this intermediate representation, a control flow graph is constructed. Based on the control flow graph, computer device 110 can extract the transfer flow, address flow, and data flow to form a role guidance flow. Computer device 110 can acquire a sample library of known fraudulent and legitimate contracts, extract sample role guidance flows from the sample library, map them into sample feature vectors, and construct a vector database. Computer device 110 can vectorize the role guidance flows to obtain the feature vector to be tested, search the vector database, calculate the cosine similarity between the feature vector to be tested and the sample feature vectors, and filter out example contracts. Computer device 110 can construct enhanced prompts by concatenating the role guidance flows and the filtered example contracts based on a preset prompt word template. Computer device 110 can input the enhanced prompts into a large language model, obtain the output results, and determine whether the smart contract to be detected is a fraudulent contract from an arbitrage bot. Among them, computer equipment 110 may include, but is not limited to, various personal computers, laptops, smartphones, robots, unmanned aerial vehicles, tablets, and other devices.

[0063] In one embodiment, such as Figure 2 As shown, a method for detecting fraudulent arbitrage bots based on role-guided retrieval enhancement is provided, including the following steps:

[0064] Step 202: Obtain the bytecode of the smart contract to be tested, decompile and parse the bytecode and map it into an intermediate representation in the form of static single assignment, and construct a control flow graph based on the intermediate representation.

[0065] Computer devices can first obtain the raw bytecode of the smart contract to be tested. The bytecode is the underlying execution code of the smart contract deployed on the blockchain, which is the basic data for subsequent parsing and analysis.

[0066] In one embodiment, the provided method for detecting arbitrage bot fraud based on role-guided retrieval enhancement may further include a process of constructing a control flow graph. The specific process includes: performing decompilation and parsing operations on the bytecode to obtain an intermediate representation; reconstructing the intermediate representation according to the static single-assignment rule, so that each variable in the intermediate representation is assigned a value only once, forming a static single-assignment intermediate representation; traversing all instructions in the intermediate representation, dividing consecutive instructions into multiple basic blocks, and using each basic block as a node; identifying jump instructions in the instructions, and using jump instructions as edges connecting the nodes of each basic block; and constructing a control flow graph in contract opcode format using each basic block as a node and each jump instruction as an edge.

[0067] After obtaining the bytecode of the smart contract to be tested, the computer device can decompile and parse the bytecode, mapping it into an intermediate representation (IR) in the form of static single assignment (SSA); then, it traverses the IR instructions, using basic blocks as nodes and jump instructions as edges, to construct a control flow graph (CFG), and outputs the control flow graph CFG in the form of contract opcode.

[0068] Specifically, the computer equipment can perform decompilation and parsing operations on the acquired original bytecode of the contract, converting the machine-executable bytecode into an intermediate representation; at the same time, it reconstructs the intermediate representation according to the static single assignment rule, so that each variable in the intermediate representation is assigned only once, eliminating the variable redefinition problem in the code, forming an intermediate representation IR in the form of SSA, providing structured and standardized instruction data for the subsequent construction of the control flow graph.

[0069] Next, using the generated SSA-formatted intermediate representation as the data foundation, all instructions within it are traversed, and the control flow graph is constructed following the core rule of using basic blocks as nodes and jump instructions as edges. Specifically, the computer device can first divide the continuous instructions in the intermediate representation into multiple basic blocks, and treat each basic block as an independent node in the control flow graph; then, it can identify jump instructions in the instructions and use them as edges connecting the nodes of each basic block, representing the execution order and jump logic of the contract code; finally, it can integrate all nodes and edges to generate a control flow graph (CFG) in contract opcode format.

[0070] Step 204: Based on the control flow graph, extract the transfer flow, address flow, and data flow to form the role guidance flow.

[0071] After the control flow graph is constructed, the computer device can perform role-guided feature extraction, transforming the complex CFG into opcode sequences for three types of roles.

[0072] In one embodiment, a method for detecting arbitrage bot fraud based on role-guided retrieval enhancement may further include the process of extracting transfer flows. Specifically, this process includes: finding the target function and its signature; obtaining the first recipient address and first transfer amount parameters based on the target function and its signature; tracing all flows of the first recipient address and first transfer amount parameters in the control flow graph using taint analysis technology, arranging them in the order of execution to form the first transfer flow for ERC20 token transfers; finding the CALL opcode and locating the ETH transfer operation to obtain the second recipient address and second transfer amount parameters; tracing all flows of the second recipient address and second transfer amount parameters in the control flow graph using taint analysis technology, arranging them in the order of execution to form the second transfer flow for ETH token transfers; and integrating the first and second transfer flows to obtain the final transfer flow.

[0073] For ERC20 token transfers, computer devices can check for the presence of target function signatures 0xa9059cbb and 0x23b872dd in function call operations, locate the target functions transfer(address, uint256) and transferFrom(address, address, uint256), obtain the first recipient address and the first transfer amount parameters, and trace all flows of the first recipient address and the first transfer amount parameters in the control flow graph using taint analysis technology. The relevant opcodes are then arranged in execution order to form the first transfer flow of the ERC20 token transfer. Specifically, the transfer(address, uint256) function refers to transferring uint256 tokens to the address, and the transferFrom(address, address, uint256) function refers to transferring uint256 tokens from the previous address to the next address. Since the function signatures corresponding to transfer(address, uint256) and transferFrom(address, address, uint256) in the opcode are 0xa9059cbb and 0x23b872dd respectively, we can locate these two target functions by looking for the presence of 0xa9059cbb and 0x23b872dd in the function call operation.

[0074] For Ethereum's native token ETH transfers, computer devices can search for the existence of CALL opcodes in functions and locate the ETH transfer operation. They can then extract the second recipient address and the second transfer amount parameters. Through taint analysis technology, they can track the execution flow of the second recipient address and the second transfer amount parameters in the control flow graph and arrange the relevant opcodes in the execution order to form the second transfer flow of ETH token transfers.

[0075] Finally, the transaction flows of ERC20 tokens and ETH tokens are integrated to obtain the final transaction flow.

[0076] In one embodiment, the provided method for detecting arbitrage bot fraud based on role-guided retrieval enhancement may further include the process of extracting the address stream. The specific process includes: extracting the sender address and receiver address of the transfer transaction from the transfer stream; using a decompilation tool to import the corresponding global variable value in the control flow graph according to the sender address, and determining whether the global variable value is the slot value of the owner of the smart contract to be detected; if so, using taint analysis technology to extract all opcodes between the sender address and the receiver address, and arranging the opcodes in the execution order to obtain the address stream.

[0077] The computer device can first obtain the opcode sequence of ERC20 transfers and native token ETH transfers, and extract the sender address and receiver address of the transaction in the transfer; then use the Gigahorse tool to import the corresponding global variable value in CFG according to the sender address, and then compare whether the global variable value is the slot of the contract owner; use taint analysis technology to extract all opcodes from the sender address to the receiver address, and arrange them in the order of execution as an address flow.

[0078] In one embodiment, the provided arbitrage robot fraud detection method based on role-guided retrieval enhancement may further include a data stream extraction process, specifically including: in the intermediate representation of the opcode in static single assignment form, locating the start and end points of the private function through the first opcode; guiding the flow of data between the start and end points of the private function through the second opcode, obtaining all opcodes in the flow process, and arranging them in the flow order to obtain the data stream.

[0079] Computer devices can monitor the flow of variable data within private functions. In SSA-formatted IR opcodes, PHI opcodes are used to represent the flow between variables. The first opcodes, CALLPRIVATE and RETURNPRIVATE, represent the call and return operations of the private function. The CALLPRIVATE and RETURNPRIVATE opcodes are used to locate the start and end points of the private function. The second opcode, the PHI opcode, guides the flow of data between the start and end points, and all opcodes involved in the flow process are collected and arranged in order of flow as a data flow.

[0080] After extracting the transfer flow, address flow, and data flow, the computer device can output role-guided flows composed of the features of the transfer flow, address flow, and data flow.

[0081] Step 206: Obtain a sample library of known fraudulent contracts and legitimate contracts, extract sample role guidance flows from the sample library, map them into sample feature vectors, and construct a vector database.

[0082] The process of acquiring a sample library of known fraudulent and legitimate contracts and building a vector database based on it is the core step in building a domain-specific feature knowledge base for arbitrage robot fraud detection.

[0083] In one embodiment, the provided method for detecting arbitrage bot fraud based on role-guided retrieval enhancement may further include a process of constructing a vector database. The specific process includes: obtaining a sample library of known fraudulent contracts and legitimate contracts; for each contract in the sample library, converting it into a sample control flow graph in contract opcode format; based on the sample control flow graph, extracting the sample transfer flow, address flow, and data flow to form a sample role-guided flow; calling a vector embedding model to map the sample role-guided flow into sample feature vectors, associating the sample feature vectors with corresponding fraudulent and legitimate tags, and storing them in the database to construct the vector database.

[0084] The computer device can obtain a sample library of known fraudulent and legitimate contracts, and obtain the role guidance flow of the samples; call a vector embedding model (such as text-embedding-ada-002) to map the role guidance flow into a numerical vector; and store the vector and its corresponding label (fraudulent / legitimate) into a vector database.

[0085] Specifically, the computer device can collect qualitatively defined arbitrage bot-related smart contracts in the blockchain field as basic samples, forming a sample library containing known fraudulent contracts and legitimate arbitrage contracts. Next, the computer device can perform extraction operations on each contract in the sample library according to unified rules for role-guided feature extraction, sequentially extracting the transfer flow, address flow, and data flow, and integrating these three types of flows into the sample role-guided flow of the sample contract according to the rules. Then, the computer device can call a vector embedding model to map the extracted sample role-guided flows into computer-recognizable sample feature vectors, completing the transformation from unstructured feature sequences to structured numerical vectors, achieving quantitative representation of sample features. Finally, the sample feature vector corresponding to each sample contract is associated and bound with the original label of that contract, and all labeled sample feature vectors are uniformly stored in a vector database, completing the construction of the vector database.

[0086] Step 208: Vectorize the role guidance flow to obtain the feature vector to be tested, search in the vector database, calculate the cosine similarity between the feature vector to be tested and the sample feature vector, and select example contracts.

[0087] In one embodiment, the provided arbitrage robot fraud detection method based on role-guided retrieval enhancement may further include a retrieval process, specifically including: inputting the role-guided flow into a vector embedding model for vectorization processing to obtain the feature vector to be tested; based on the vector database, calculating the cosine similarity between the feature vector to be tested and all sample feature vectors in the vector database one by one to obtain each cosine similarity value; sorting each cosine similarity value, and selecting example contracts and their corresponding tags according to preset filtering rules.

[0088] The computer device can vectorize the role guidance flow of the contract under test, calculate its cosine similarity with the sample vectors in the vector database, and select the top k example contracts with the highest similarity and their labels.

[0089] Specifically, in this embodiment, the computer device can take the extracted role guidance flow as input, call the same vector embedding model as the sample library vectorization stage, and convert the unstructured role guidance flow into a computer-computable numerical feature vector to be tested according to a unified vector mapping rule. Then, based on the vector database, the generated feature vector to be tested is compared with all the sample feature vectors stored in the database one by one using cosine similarity calculation. The cosine similarity algorithm quantifies the feature similarity between the feature vector to be tested and each sample feature vector. The higher the similarity value, the closer the core behavioral features of the contract to be tested are to the corresponding sample contract. Then, all the calculated cosine similarity values ​​are sorted, and the top k sample contracts with the highest similarity are selected as example contracts according to the preset screening rules. At the same time, the original tags and complete role guidance flow and contract-related information corresponding to the top k example contracts are extracted to complete the screening of example contracts.

[0090] Step 210: Based on the preset prompt word template, construct an enhanced prompt word by splicing together the role-guided flow and the selected example contracts.

[0091] In one embodiment, the provided method for detecting arbitrage bot fraud based on role-guided retrieval enhancement also includes a prompt word enhancement process. The specific process includes: retrieving a preset arbitrage bot fraud detection prompt word template and obtaining the filling detection task description at the corresponding position of the prompt word template; according to the filling detection task description, filling the code of the contract to be detected, the role-guided flow, the example contract and its corresponding tags into the prompt word template to obtain enhanced prompt words.

[0092] The computer device can concatenate strings according to a preset prompt word template. The preset prompt word template consists of the following components in sequence: the description of the detection task, the contract code to be detected plus the role guidance flow, the retrieved similar examples, and the detection task instructions. Each part is arranged in a predetermined format to ensure that the large language model can accurately identify the reasoning requirements and reference data.

[0093] Next, the computer device can extract the original code of the smart contract to be tested, as well as the role guidance flow, which is formed by integrating the transfer flow, address flow, and data flow extracted for the contract. The two types of data are combined into the code of the contract to be tested + the role guidance flow according to the template requirements, and then filled into the corresponding position of the template to obtain the enhanced prompt words.

[0094] In this embodiment, the enhanced prompt word structure diagram is as follows: Figure 3As shown, the computer device can determine whether an arbitrage bot fraud exists in a smart contract based on its related data, including transaction flow, address flow, and data flow. Next, it can populate the original code of the contract to be detected, along with complete information on the transaction flow, address flow, and data flow extracted from that contract. It can also populate the information of the top k most similar example contracts selected from a vector database, each example containing contract code, transaction flow, address flow, data flow, and detection result tags. Finally, the computer device can detect task instructions to determine whether an arbitrage bot fraud exists in the contract.

[0095] Step 212: Input the enhanced prompt words into the large language model, obtain the output results, and determine whether the smart contract to be detected is a fraudulent contract of an arbitrage bot.

[0096] The computer device can send enhanced prompts to the large language model API; set the model parameters: Temperature=0.2 (to ensure determinism); obtain the output results through the large language model and extract keywords (fraud / legitimate) to determine whether it is a fraudulent contract by an arbitrage bot.

[0097] In one embodiment, a role-guided retrieval-enhanced arbitrage bot fraud detection method can be applied to, for example... Figure 4 In the architecture shown, as Figure 4 The diagram illustrates the entire data processing logic from inputting the contract to be detected to outputting the detection conclusion. By inputting the blockchain smart contract to be detected, the process involves: role guidance flow extraction → vector mapping → cosine similarity retrieval → construction of enhanced prompt words, and finally, outputting the detection conclusion. Specifically, three types of role guidance flows—transfer flow, address flow, and data flow—are extracted from the contract to be detected; labeled fraudulent / legitimate contract feature vectors are stored to provide sample data for similarity retrieval; the large language model receives the constructed enhanced prompt words and completes the final fraud detection inference; and the detection conclusion, i.e., the judgment result that the contract to be detected is "fraudulent" or "legitimate," is output.

[0098] In one embodiment, to verify the detection accuracy of the provided arbitrage bot fraud detection method based on role-guided retrieval enhancement, this method was experimentally compared with the methods of Mythril, Maian, Kai Li, Chen, and Chong. The comparison results are shown in the table below:

[0099]

[0100] As shown in the table above and Figure 5 As shown, in an arbitrage bot fraud dataset with 1889 contracts, our method improves the F1 score by 20.66 percentage points compared to existing methods.

[0101] In this embodiment, the Token represents the smallest basic unit in artificial intelligence technology. The following table compares this method with GraphRAG and SCALM methods in terms of Token usage and time consumption:

[0102]

[0103] As shown in the table above, in the arbitrage bot fraud dataset with 1889 contracts, this method reduced token consumption by at least 69.84% compared to other RAG techniques; at the same time, the detection time was reduced by 88.76% and 75.77% compared to GraphRAG and SCALM, respectively. SCALM is a large language model smart contract code auditing method based on retrieval enhancement generation and backtracking prompts.

[0104] It should be understood that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart above may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0105] In one embodiment, such as Figure 6 As shown, a fraud detection system for arbitrage robots based on role-guided retrieval enhancement is provided, including: a preprocessing module 610, a role feature extraction module 620, a vector database construction module 630, a vector retrieval module 640, a retrieval enhancement module 650, and a fraud prediction module 660, wherein:

[0106] The preprocessing module 610 is used to obtain the bytecode of the smart contract to be tested, decompile and parse the bytecode and map it into an intermediate representation in static single assignment form, and construct a control flow graph based on the intermediate representation;

[0107] The role feature extraction module 620 is used to extract the transfer flow, address flow, and data flow based on the control flow graph to form a role guidance flow;

[0108] The vector database construction module 630 is used to obtain a sample library of known fraudulent contracts and legitimate contracts, extract sample role guidance flows from the sample library, map them into sample feature vectors, and construct a vector database.

[0109] The vector retrieval module 640 is used to vectorize the role guidance flow to obtain the feature vector to be tested, search in the vector database, calculate the cosine similarity between the feature vector to be tested and the sample feature vector, and filter out example contracts.

[0110] The retrieval enhancement module 650 is used to construct enhanced prompts by combining the role-guided traffic and the filtered example contracts based on the preset prompt template;

[0111] The fraud prediction module 660 is used to input enhanced prompt words into a large language model, obtain the output results, and determine whether the smart contract to be detected is a fraudulent contract of an arbitrage bot.

[0112] In one embodiment, the preprocessing module 610 is further configured to perform decompilation and parsing operations on the bytecode to obtain an intermediate representation; reconstruct the intermediate representation according to the static single assignment rule so that each variable in the intermediate representation is assigned only once, forming an intermediate representation in the static single assignment form; traverse all instructions in the intermediate representation, divide consecutive instructions in the instructions into multiple basic blocks, and use each basic block as a node; identify jump instructions in the instructions, and use jump instructions as edges connecting the nodes of each basic block; and construct a control flow graph in the contract opcode format with each basic block as a node and each jump instruction as an edge.

[0113] In one embodiment, the role feature extraction module 620 is further used to find the target function and the target function signature, and obtain the first recipient address and the first transfer amount parameter based on the target function and the target function signature; track all flows of the first recipient address and the first transfer amount parameter in the control flow graph through taint analysis technology, arrange them in the running order to form the first transfer flow of ERC20 token transfer; find the CALL opcode and locate the ETH transfer operation to obtain the second recipient address and the second transfer amount parameter; track all flows of the second recipient address and the second transfer amount parameter in the control flow graph through taint analysis technology, arrange them in the running order to form the second transfer flow of ETH token transfer; integrate the first transfer flow and the second transfer flow to obtain the final transfer flow.

[0114] In one embodiment, the role feature extraction module 620 is further used to extract the sender address and receiver address of the transfer transaction from the transfer stream; use a decompilation tool to import the corresponding global variable value in the control flow graph according to the sender address, and determine whether the global variable value is the slot value of the owner of the smart contract to be detected; if so, use taint analysis technology to extract all opcodes between the sender address and the receiver address, and arrange the opcodes in the execution order to obtain the address stream.

[0115] In one embodiment, the role feature extraction module 620 is further used to locate the start and end points of the private function through the first opcode in the intermediate representation of the static single assignment form; guide the flow of data between the start and end points of the private function through the second opcode, obtain all opcodes in the flow process, and arrange them in the flow order to obtain the data stream.

[0116] In one embodiment, the vector database construction module 630 is further used to obtain a sample library of known fraudulent contracts and legitimate contracts; for each contract in the sample library, it is converted into a sample control flow graph in contract opcode format; based on the sample control flow graph, the sample transfer flow, address flow, and data flow are extracted respectively to form a sample role guidance flow; the vector embedding model is called to map the sample role guidance flow into a sample feature vector, the sample feature vector is associated with the corresponding fraud label and legitimate label, and stored in the database to construct the vector database.

[0117] In one embodiment, the vector retrieval module 640 is further configured to input the role guidance flow into the vector embedding model for vectorization processing to obtain the feature vector to be tested; based on the vector database, calculate the cosine similarity between the feature vector to be tested and all sample feature vectors in the vector database one by one to obtain each cosine similarity value; sort the cosine similarity values ​​and select example contracts and their corresponding tags according to preset filtering rules.

[0118] In one embodiment, the retrieval enhancement module 650 is further configured to retrieve a preset arbitrage robot fraud detection prompt word template and obtain the filling detection task description at the corresponding position of the prompt word template; according to the filling detection task description, the code of the contract to be detected, the role guidance flow, the example contract and its corresponding tags are filled into the prompt word template to obtain the enhanced prompt word.

[0119] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a role-guided retrieval enhancement generation method for detecting arbitrage robot fraud. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device casing, or an external keyboard, touchpad, or mouse.

[0120] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0121] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of a role-guided retrieval enhancement generation arbitrage robot fraud detection method.

[0122] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of a role-guided retrieval enhancement generation arbitrage robot fraud detection method.

[0123] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0124] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for detecting arbitrage bot fraud based on role-guided retrieval enhancement, characterized in that, The method includes: Obtain the bytecode of the smart contract to be tested, decompile and parse the bytecode and map it into an intermediate representation in static single-assignment form, and construct a control flow graph based on the intermediate representation; Based on the control flow graph, the transfer flow, address flow, and data flow are extracted respectively to form a role guidance flow; Obtain a sample library of known fraudulent contracts and legitimate contracts, extract sample role guidance flows from the sample library, map them into sample feature vectors, and construct a vector database; The role-guided flow is vectorized to obtain the feature vector to be tested. The vector is then searched in the vector database. The cosine similarity between the feature vector to be tested and the sample feature vector is calculated to select example contracts. Based on the preset prompt word template, the role-guided flow and the selected example contracts are combined to construct enhanced prompt words; The enhanced prompt words are input into a large language model to obtain the output results and determine whether the smart contract to be detected is a fraudulent contract of an arbitrage bot.

2. The arbitrage robot fraud detection method based on role-guided retrieval enhancement generation according to claim 1, characterized in that, The bytecode is decompiled and parsed, and mapped into an intermediate representation in static single-assignment form. A control flow graph is constructed based on the intermediate representation, including: The bytecode is decompiled and parsed to obtain an intermediate representation. The intermediate representation is reconstructed according to the static single assignment rule, so that each variable in the intermediate representation is assigned a value only once, thus forming a static single assignment intermediate representation. Traverse all instructions in the intermediate representation, divide consecutive instructions into multiple basic blocks, and treat each basic block as a node; Identify jump instructions in the instructions and use the jump instructions as edges connecting each of the basic block nodes; Using each of the basic blocks as nodes and each of the jump instructions as edges, a control flow graph in the form of contract opcodes is constructed.

3. The arbitrage robot fraud detection method based on role-guided retrieval enhancement generation according to claim 1, characterized in that, Based on the control flow graph, the transfer flow is extracted, including: Find the target function and its signature, and obtain the first recipient address and the first transfer amount parameters based on the target function and its signature; Tag analysis technology is used to track all flows of the first recipient address and the first transfer amount parameters in the control flow graph and arrange them in the order of operation to form the first transfer flow of ERC20 token transfer; Find the CALL opcode and locate the ETH transfer operation to obtain the second recipient's address and the second transfer amount parameters; Tag analysis technology is used to track all flows of the second recipient address and the second transfer amount parameters in the control flow graph and arrange them in the order of operation to form the second transfer flow of ETH token transfer; The first and second transfer flows are integrated to obtain the final transfer flow.

4. The arbitrage robot fraud detection method based on role-guided retrieval enhancement generation according to claim 1, characterized in that, Based on the control flow graph, the address flow is extracted, including: Extract the sender's address and receiver's address of the transfer transaction from the transfer stream; Use a decompilation tool to import the corresponding global variable value in the control flow graph based on the sender address, and determine whether the global variable value is the slot value of the owner of the smart contract to be detected; If so, taint analysis technology is used to extract all opcodes between the sender address and the receiver address, and the opcodes are arranged in the order of execution to obtain the address stream.

5. The arbitrage robot fraud detection method based on role-guided retrieval enhancement generation according to claim 1, characterized in that, Based on the control flow graph, the data flow is extracted, including: In the intermediate representation of the static single assignment form, the start and end points of the private function are located through the first opcode; The second opcode guides the flow of data between the start and end points of the private function, obtains all opcodes in the flow process, and arranges them in the order of flow to obtain the data stream.

6. The arbitrage robot fraud detection method based on role-guided retrieval enhancement generation according to claim 1, characterized in that, Obtain a sample library of known fraudulent and legitimate contracts, extract sample role guidance flows from the sample library, map them to sample feature vectors, and construct a vector database, including: Obtain a sample library of known fraudulent contracts and legitimate contracts; For each contract in the sample library, convert it into a sample control flow graph in contract opcode format; Based on the sample control flow graph, the sample transfer flow, address flow, and data flow are extracted respectively to form the sample role guidance flow; The vector embedding model is invoked to map the sample role guidance flow into sample feature vectors. The sample feature vectors are associated with the corresponding fraud tags and legal tags and stored in the database to construct a vector database.

7. The arbitrage robot fraud detection method based on role-guided retrieval enhancement generation according to claim 1, characterized in that, The role-guided flow is vectorized to obtain a feature vector to be tested. This vector is then searched in the vector database. The cosine similarity between the feature vector to be tested and the sample feature vector is calculated to select example contracts, including: The character guidance flow is input into a vector embedding model for vectorization to obtain the feature vector to be tested; Based on the vector database, the cosine similarity between the feature vector to be tested and all the sample feature vectors in the vector database is calculated one by one to obtain each cosine similarity value. The cosine similarity values ​​are sorted, and example contracts and their corresponding tags are selected according to preset filtering rules.

8. The arbitrage robot fraud detection method based on role-guided retrieval enhancement generation according to claim 7, characterized in that, Based on a preset prompt template, the enhanced prompts are constructed by combining the role-guided flow and the selected example contracts, including: Retrieve a preset arbitrage robot fraud detection prompt template and obtain the filling detection task description at the corresponding position of the prompt template; According to the description of the detection task, the code of the contract to be detected, the role guide flow, the example contract and its corresponding tags are filled into the prompt word template to obtain the enhanced prompt words.

9. A fraud detection system for arbitrage bots based on role-guided retrieval enhancement, characterized in that, The system includes: The preprocessing module is used to obtain the bytecode of the smart contract to be tested, decompile and parse the bytecode and map it into an intermediate representation in static single-assignment form, and construct a control flow graph based on the intermediate representation; The role feature extraction module is used to extract the transfer flow, address flow, and data flow based on the control flow graph to form a role guidance flow; The vector database construction module is used to obtain a sample library of known fraudulent contracts and legitimate contracts, and extract sample role guidance flows based on the sample library, map them into sample feature vectors, and construct a vector database. The vector retrieval module is used to vectorize the role guidance flow to obtain the feature vector to be tested, search the vector database, calculate the cosine similarity between the feature vector to be tested and the sample feature vector, and filter out example contracts. The retrieval enhancement module is used to construct enhanced prompts by concatenating the role-guided traffic and the selected example contracts based on a preset prompt template. The fraud prediction module is used to input the enhanced prompt words into a large language model, obtain the output results, and determine whether the smart contract to be detected is a fraudulent contract of an arbitrage robot.

10. The arbitrage robot fraud detection system based on role-guided retrieval enhancement as described in claim 9, characterized in that, The preprocessing module is further configured to: perform decompilation and parsing operations on the bytecode to obtain an intermediate representation; reconstruct the intermediate representation according to the static single assignment rule, so that each variable in the intermediate representation is assigned only once, forming an intermediate representation in the static single assignment form; traverse all instructions in the intermediate representation, divide consecutive instructions in the instructions into multiple basic blocks, and use each basic block as a node; identify jump instructions in the instructions, and use the jump instructions as edges connecting each of the basic block nodes; Using each of the basic blocks as nodes and each of the jump instructions as edges, a control flow graph in the form of contract opcodes is constructed.

Images