Vulnerability detection method, device, equipment, medium and program product

Abstract

This application provides a vulnerability detection method, apparatus, device, medium, and program product, relating to the field of computer technology, for improving the accuracy of detecting vulnerabilities in smart contracts. The specific technical solution is as follows: Based on relevant data of the smart contract to be detected, a composite contract graph is constructed. Each node of the composite contract graph represents a basic element in the source code, and each edge of the composite contract graph represents the element relationship between two basic elements. This element relationship includes at least one of the following: control dependency, data dependency, and call relationship. Based on the node characteristics of the central node and adjacent nodes of the composite contract graph, edge attention weights are calculated. These edge attention weights are used to characterize the semantic importance of the edge between the central node and adjacent nodes. Based on the edge attention weights, vulnerability detection results for the smart contract to be detected are generated. This application is applied to scenarios requiring vulnerability detection in smart contracts.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a vulnerability detection method, apparatus, device, medium, and program product. Background Technology

[0002] As data becomes a key production factor, building a trusted data space to achieve secure and reliable data circulation has become an important development trend. Against this backdrop, smart contracts, as a crucial technological layer for constructing this data space, require careful vulnerability detection.

[0003] In related technologies, the source code corresponding to the smart contract is first converted into graph data with nodes and edges representing the program structure. Then, a graph convolutional network model is used to learn from the graph data. The core step of the graph convolutional network model is to aggregate the features of the neighboring nodes of each node in the graph through the mean aggregation function to update the node features of each node, thereby detecting vulnerabilities in the smart contract based on the updated node features of each node.

[0004] However, the above scheme uses a fixed mean aggregation function to aggregate the features of neighboring nodes of each node in the graph, which makes it impossible to distinguish the differences in the semantic contributions of different neighboring nodes to the central node, resulting in low accuracy in detecting vulnerabilities in smart contracts. Summary of the Invention

[0005] This application provides a vulnerability detection method, apparatus, device, medium, and program product to improve the accuracy of smart contract vulnerability detection.

[0006] In a first aspect, embodiments of this application provide a vulnerability detection method, which includes: constructing a composite contract graph based on relevant data of the smart contract to be detected, wherein the relevant data includes: source code, compiled bytecode, and historical transaction data, each node of the composite contract graph represents a basic element in the source code, and each edge of the composite contract graph represents an element relationship between two basic elements, wherein the element relationship includes at least one of the following: control dependency, data dependency, and call relationship; calculating edge attention weights based on the node features of the central node and adjacent nodes of the composite contract graph, wherein the edge attention weights are used to characterize the semantic importance of the edge between the central node and adjacent nodes; and generating vulnerability detection results for the smart contract to be detected based on the edge attention weights.

[0007] The technical solution provided in this application brings at least the following beneficial effects: In this solution, the edge attention weight is generated by the feature vector between the central node and adjacent nodes in the composite contract graph, which accurately quantifies the semantic importance of the edges between nodes, realizes more refined neighbor information aggregation, avoids the problem of being unable to distinguish the differences in the semantic contributions of different adjacent nodes to the central node caused by aggregating the features of adjacent nodes of each node in the graph based on a fixed mean aggregation function, and improves the accuracy of detecting vulnerabilities in smart contracts.

[0008] One possible implementation involves constructing a composite contract graph based on the relevant data of the smart contract to be tested. This includes: parsing the relevant data to generate an abstract syntax tree, a control flow graph, and a program dependency graph. The abstract syntax tree represents the hierarchical relationship of the basic elements in the source code, the control flow graph represents the execution order and jump relationship of the basic elements in the source code, and the program dependency graph represents the data dependency relationship between the basic elements in the source code. The abstract syntax tree, the control flow graph, and the program dependency graph are then fused to obtain the composite contract graph.

[0009] Another possible implementation, which calculates the edge attention weights based on the node characteristics of the central node and adjacent nodes of the composite contract graph, includes: calculating a first difference based on the node characteristics of the central node and adjacent nodes, wherein the first difference characterizes the degree of logical deviation between the central node and the adjacent nodes; and calculating the edge attention weights based on the first difference and the node characteristics of the central node and adjacent nodes.

[0010] Another possible implementation, based on the aforementioned edge attention weights, generates the vulnerability detection result of the smart contract to be tested, including: weighted fusion of the node features of the central node and the adjacent nodes based on the aforementioned edge attention weights to obtain the updated node features of the central node and the adjacent nodes; and generating the vulnerability detection result of the smart contract to be tested based on the updated node features.

[0011] Another possible implementation is that, based on the updated node characteristics, generating the vulnerability detection result of the smart contract to be tested includes: determining at least one first probability based on the updated node characteristics, wherein the first probability represents the probability that the smart contract to be tested has a vulnerability of the corresponding type; generating the vulnerability detection result of the smart contract to be tested based on the at least one first probability; wherein the vulnerability detection result includes at least one of the following: vulnerability level, vulnerability location, and vulnerability remediation suggestion.

[0012] Secondly, embodiments of this application provide a vulnerability detection device, comprising: a construction module, a calculation module, and a generation module; the construction module is used to construct a composite contract graph based on relevant data of the smart contract to be detected, the relevant data including: source code, compiled bytecode, and historical transaction data, each node of the composite contract graph representing a basic element in the source code, and each edge of the composite contract graph representing an element relationship between two basic elements, the element relationship including at least one of the following: control dependency, data dependency, and call relationship; the calculation module is used to calculate edge attention weights based on the node characteristics of the central node and adjacent nodes of the composite contract graph, the edge attention weights being used to characterize the semantic importance of the edge between the central node and the adjacent nodes; the generation module is used to generate vulnerability detection results of the smart contract to be detected based on the edge attention weights.

[0013] One possible implementation is that the aforementioned construction module is specifically used to: parse the aforementioned relevant data to generate an abstract syntax tree, a control flow graph, and a program dependency graph. The abstract syntax tree is used to represent the hierarchical relationship of the basic elements in the aforementioned source code, the control flow graph is used to represent the execution order and jump relationship of the basic elements in the aforementioned source code, and the program dependency graph is used to represent the data dependency relationship between the basic elements in the aforementioned source code; and the abstract syntax tree, the control flow graph, and the program dependency graph are fused to obtain the aforementioned composite contract graph.

[0014] Another possible implementation, the above calculation module is specifically used to: calculate a first difference based on the node characteristics of the above-mentioned central node and the above-mentioned adjacent nodes, the first difference representing the degree of logical deviation between the above-mentioned central node and the above-mentioned adjacent nodes; and calculate the above-mentioned edge attention weight based on the first difference and the node characteristics of the above-mentioned central node and the above-mentioned adjacent nodes.

[0015] Another possible implementation is that the above-mentioned generation module is specifically used to: perform weighted fusion of the node features of the above-mentioned central node and the above-mentioned adjacent nodes based on the above-mentioned edge attention weights to obtain the updated node features of the above-mentioned central node and the above-mentioned adjacent nodes; and generate the vulnerability detection result of the above-mentioned smart contract to be detected based on the updated node features.

[0016] Another possible implementation is that the above-mentioned generation module is specifically used to: determine at least one first probability based on the updated node characteristics, the first probability representing the probability that the smart contract to be detected has a corresponding type of vulnerability; and generate a vulnerability detection result for the smart contract to be detected based on the at least one first probability; wherein the vulnerability detection result includes at least one of the following: vulnerability level, vulnerability location, and vulnerability remediation suggestion.

[0017] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory stores a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect described above.

[0018] Fourthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect described above.

[0019] Fifthly, this application provides a computer program product stored in a storage medium, which, when executed by a computer, implements the method described in the first aspect.

[0020] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0021] The beneficial effects of the second to sixth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0022] Figure 1 A schematic diagram of the network architecture for an application of a vulnerability detection method provided in this application embodiment;

[0023] Figure 2 A flowchart illustrating a vulnerability detection method provided in an embodiment of this application;

[0024] Figure 3 A flowchart illustrating another vulnerability detection method provided in an embodiment of this application;

[0025] Figure 4 A flowchart illustrating another vulnerability detection method provided in this application embodiment;

[0026] Figure 5 A flowchart illustrating another vulnerability detection method provided in this application embodiment;

[0027] Figure 6 A flowchart illustrating another vulnerability detection method provided in this application embodiment;

[0028] Figure 7 A flowchart illustrating the implementation process of a vulnerability detection method provided in this application embodiment;

[0029] Figure 8 This is a schematic diagram of the structure of a vulnerability detection device provided in an embodiment of this application;

[0030] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] The vulnerability detection methods, apparatus, devices, media, and program products provided in this application will be described in detail below with reference to the accompanying drawings.

[0032] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0033] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0034] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0035] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0036] The vulnerability detection method, apparatus, device, medium, and program product provided in this application embodiment can be applied to scenarios where vulnerabilities in smart contracts need to be detected.

[0037] With the accelerated implementation of industry-level trusted data space construction, blockchain smart contracts, as the key execution layer for realizing data ownership confirmation, evidence verification, and autonomous circulation rules in the circulation of data elements, directly determine the trusted foundation of the entire data space. Especially in enterprise-level consortium blockchain scenarios, smart contracts carry complex business logic such as cross-organizational collaboration, multi-departmental linkage, and data asset transfer. Their interaction modes far exceed the simple fund transfers in public blockchains, involving multi-party state reading and writing, complex permission control, and timing dependencies. This exposes contracts to more complex and hidden security vulnerabilities (such as permission bypass, race conditions, and business logic defects). However, existing smart contract vulnerability detection technologies are significantly insufficient in handling the complex interaction logic and hidden vulnerability patterns unique to enterprise consortium blockchains.

[0038] In related technologies, traditional Graph Neural Networks (GNNs) are used to detect vulnerabilities in smart contracts. This involves converting the contract code into a graph structure, and then using this graph structure to detect vulnerabilities. However, this approach uses a fixed aggregation function to convert the contract code into a graph structure, which fails to reflect the importance of neighbors, resulting in low accuracy in detecting vulnerabilities in smart contracts based on the graph structure.

[0039] To address the aforementioned technical problems, this application provides a vulnerability detection method, apparatus, device, medium, and program product. Based on relevant data of the smart contract to be detected, a composite contract graph is constructed. This relevant data includes source code, compiled bytecode, and historical transaction data. Each node in the composite contract graph represents a basic element in the source code, and each edge represents an element relationship between two basic elements. This element relationship includes at least one of the following: control dependency, data dependency, and call relationship. Based on the node features of the central node and adjacent nodes in the composite contract graph, edge attention weights are calculated. These edge attention weights characterize the semantic importance of the edges between the central node and adjacent nodes. Based on these edge attention weights, vulnerability detection results for the smart contract to be detected are generated. In this solution, edge attention weights are generated through the feature vectors between the central node and adjacent nodes in the composite contract graph. This accurately quantifies the semantic importance of edges between nodes, achieving more refined neighbor information aggregation. It avoids the problem of being unable to distinguish the differences in the semantic contributions of different adjacent nodes to the central node caused by aggregating the features of adjacent nodes of each node in the graph based on a fixed mean aggregation function, thus improving the accuracy of detecting smart contract vulnerabilities.

[0040] The vulnerability detection methods, apparatus, devices, media, and program products provided in this application will be described in detail below with reference to the accompanying drawings.

[0041] Figure 1 The diagram illustrates a network architecture for a vulnerability detection method provided in an embodiment of this application. For example... Figure 1 As shown, the network architecture includes a vulnerability detection device 101 and a terminal device 102. The vulnerability detection device 101 and the terminal device 102 are interconnected.

[0042] In some embodiments, the vulnerability detection device 101 may be a server, a computer, or a processor or processing unit within a server or computer. The server may be a single server or a server cluster consisting of multiple servers. It should be noted that the embodiments of this application do not limit the specific device form of the vulnerability detection device 101. Figure 1 The vulnerability detection device 101 is used as an example of a single server.

[0043] In some embodiments, the terminal device may be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, personal computer (PC), ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., and the embodiments of this application do not specifically limit it. Figure 1 The example shown is a mobile phone, with terminal device 102 as an example.

[0044] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0045] See Figure 2 This is a flowchart illustrating a vulnerability detection method provided in an embodiment of this application. Figure 2 As shown, the vulnerability detection method provided in this application embodiment can be implemented by the above-mentioned vulnerability detection device, specifically including the following steps 201 to 203.

[0046] Step 201: The vulnerability detection device constructs a composite contract graph based on the relevant data of the smart contract to be detected.

[0047] In some embodiments, the smart contract to be detected may be a blockchain smart contract.

[0048] In some embodiments, the aforementioned blockchain smart contract refers to a programmatic contract deployed in a blockchain network that can automatically execute preset rules and whose state cannot be tampered with.

[0049] In some embodiments, the aforementioned related data includes: source code, compiled bytecode, and historical transaction data. Each node of the aforementioned composite contract graph represents a basic element in the aforementioned source code, and each edge of the aforementioned composite contract graph represents the element relationship between two basic elements. The aforementioned element relationship includes at least one of the following: control dependency, data dependency, and call relationship.

[0050] In some embodiments, the aforementioned historical transaction data refers to the full set of interaction records generated after the smart contract to be tested is deployed to the blockchain network.

[0051] In some embodiments, the aforementioned basic elements refer to the smallest semantic units that constitute the source code of a smart contract.

[0052] In some embodiments, the control dependency relationship mentioned above refers to the execution logic constraint relationship between code elements in a smart contract.

[0053] In some embodiments, the aforementioned data dependency refers to the association formed between code elements in a smart contract based on data flow.

[0054] In some embodiments, the above-mentioned calling relationship refers to the active triggering association between code elements in a smart contract.

[0055] In some embodiments, combined with Figure 2 ,like Figure 3 As shown, step 201 above can be implemented through steps 201a and 201b.

[0056] Step 201a: The vulnerability detection device parses the above-mentioned relevant data and generates an abstract syntax tree, a control flow graph, and a program dependency graph.

[0057] In some embodiments, the abstract syntax tree is used to represent the hierarchical relationship of the basic elements in the source code, the control flow graph is used to represent the execution order and jump relationship of the basic elements in the source code, and the program dependency graph is used to represent the data dependency relationship between the basic elements in the source code.

[0058] Step 201b: The vulnerability detection device merges the above-mentioned abstract syntax tree, control flow graph, and program dependency graph to obtain the above-mentioned composite contract graph.

[0059] In some embodiments, the vulnerability detection device can fuse the abstract syntax tree, the control flow graph, and the program dependency graph to obtain a unified composite contract graph. Among them, nodes Represents the basic elements of the code, edges This represents control flow transfer, data flow dependency, or external call relationship.

[0060] In this way, by parsing the relevant data of smart contracts, an abstract syntax tree, a control flow graph, and a program dependency graph are generated and merged into a composite contract graph. This integrates the hierarchical structure of the code, the execution logic, and the data dependencies, providing a computational foundation for subsequent calculation of edge attention weights and further improving the accuracy of smart contract vulnerability detection.

[0061] Step 202: The vulnerability detection device calculates the edge attention weights based on the node characteristics of the central node and adjacent nodes of the above composite contract graph.

[0062] In some embodiments, the edge attention weights are used to characterize the semantic importance of the edges between the central node and the adjacent nodes.

[0063] In some embodiments, the vulnerability detection device can calculate the edge attention weight based on the difference between the node features of the central node and the adjacent nodes.

[0064] It should be noted that the specific implementation process of the vulnerability detection device calculating the edge attention weight based on the difference between the node features of the central node and the adjacent nodes can be found in the relevant description in the following embodiments. To avoid repetition, this application will not elaborate on it here.

[0065] In some embodiments, combined with Figure 2 ,like Figure 4 As shown, step 202 above can be implemented through steps 202a and 202b.

[0066] Step 202a: The vulnerability detection device calculates the first difference based on the node characteristics of the central node and the adjacent nodes.

[0067] In some embodiments, the first difference represents the degree of logical deviation between the central node and the adjacent nodes.

[0068] Step 202b: The vulnerability detection device calculates the edge attention weight based on the first difference, the node characteristics of the central node and the adjacent nodes.

[0069] In some embodiments, the vulnerability detection device can horizontally concatenate the first difference, the node features of the central node, the node features of adjacent nodes, the category semantic vector of the edge, and the inherent relationship features of the edge to construct a full-element heterogeneous edge feature tensor; then, based on the full-element heterogeneous edge feature tensor, a dynamic edge attention score is calculated through a scoring function and an activation function; then, based on a learnable temperature parameter, the dynamic edge attention score is smoothed and normalized to obtain the dynamic edge attention weight.

[0070] In this way, by calculating the difference in feature vectors between the central node and its adjacent nodes to characterize the degree of logical deviation between them, and combining the node features to calculate the edge attention weight, the quantification of the edge attention weight is more in line with the code semantic logic of the smart contract, thereby improving the accuracy of vulnerability detection.

[0071] Step 203: The vulnerability detection device generates vulnerability detection results for the smart contract to be detected based on the aforementioned edge attention weights.

[0072] In some embodiments, the vulnerability detection device may perform weighted fusion of the node features of the central node and the adjacent nodes based on the aforementioned edge attention weights to obtain updated node features of the central node and the adjacent nodes, and then generate vulnerability detection results of the smart contract to be detected based on the updated node features.

[0073] It should be noted that the specific implementation process of the vulnerability detection device performing weighted fusion of the node features of the central node and the adjacent nodes based on the aforementioned edge attention weights to obtain the updated node features of the central node and the adjacent nodes, and then generating the vulnerability detection result of the smart contract to be detected based on the updated node features, can be found in the relevant description in the following embodiments. To avoid repetition, this application will not elaborate further here.

[0074] In some embodiments, combined with Figure 2 ,like Figure 5 As shown, step 203 above can be implemented through steps 203a and 203b.

[0075] Step 203a: Based on the aforementioned edge attention weights, the vulnerability detection device performs weighted fusion of the node features of the aforementioned central node and the aforementioned adjacent nodes to obtain the updated node features of the aforementioned central node and the aforementioned adjacent nodes.

[0076] In some embodiments, the vulnerability detection device can input the contract graph and its features from... A graph attention network consisting of layers. In any given... In the layer, the input is the feature of the node in the previous layer. This layer dynamically aggregates neighbor information and updates node features through the following steps: First, using the learnable weight matrix according to the following formula 1... The node features are mapped to a higher-order feature space; then, the absolute difference between the feature vectors of adjacent nodes is explicitly calculated using the following formula 2. As an explicit difference representation. Combined with central node features. Neighbor node characteristics semantics of edge categories and specific relational characteristics Perform a four-in-one joint splicing, using scoring vectors. and Activation function calculates the raw attention score Then, a learnable temperature parameter is introduced using the following formula 3. Smoothing is applied to the raw scores, and at the center node local neighborhood Internal use The transformation yields the normalized attention weights. Then, using the splicing features through the first linear layer via the following formula 4, Activation functions construct edge semantic gating signals This is used to coordinate the input intensity of local and global information flows; then, the gating signal and attention weights are multiplicatively fused using the following formula 5 to construct a dynamic aggregation weight that takes into account both topological structure and relational semantic constraints. Finally, based on the dynamic fusion weights, the following formula 6 is used. The features of neighboring nodes are weighted and summed, and then combined with a non-linear activation function. Get the hidden state of the nodes in the next layer .

[0077] (Formula 1)

[0078] (Formula 2)

[0079] (Formula 3)

[0080] (Formula 4)

[0081] (Formula 5)

[0082] (Formula 6)

[0083] Step 203b: Based on the updated node characteristics, the vulnerability detection device generates vulnerability detection results for the smart contract to be detected.

[0084] In some embodiments, combined with Figure 5 ,like Figure 6 As shown, step 203b above can be implemented through steps 203b1 and 203b2.

[0085] Step 203b1: The vulnerability detection device determines at least one first probability based on the updated node characteristics described above.

[0086] In some embodiments, the first probability represents the probability that the smart contract to be detected has a corresponding type of vulnerability.

[0087] In some embodiments, the vulnerability detection device may perform cross-layer spatial alignment, graph-level average pooling, and inter-layer adaptive weighting operations sequentially based on the updated node features output by the multi-layer encoding module to obtain a global graph representation, and then determine at least one of the aforementioned first probabilities based on the global graph representation.

[0088] Step 203b2: The vulnerability detection device generates vulnerability detection results for the smart contract to be detected based on at least one of the above-mentioned first probabilities.

[0089] The vulnerability detection results mentioned above include at least one of the following: vulnerability level, vulnerability location, and vulnerability remediation recommendations.

[0090] In some embodiments, the vulnerability detection device may perform mapping processing on at least one first probability based on a mapping function to obtain the vulnerability detection result of the smart contract to be detected.

[0091] In some embodiments, the vulnerability level described above characterizes the severity of the vulnerability.

[0092] In some embodiments, the aforementioned vulnerability location represents the precise location information of the specific code segment or code element in the smart contract to be detected that has a security risk.

[0093] In this way, probability values ​​for corresponding vulnerability types are generated based on the updated node features, and vulnerability detection results are obtained based on the probability values. This avoids the problem of not being able to distinguish the differences in the semantic contributions of different adjacent nodes to the central node due to the use of a fixed aggregation function, and improves the accuracy of vulnerability detection.

[0094] In this way, by updating the features of the central node and its neighboring nodes based on edge attention weights, the features of the central node can be combined with the information of neighboring nodes with different semantic contributions. This avoids the problem of not being able to distinguish the differences in the semantic contributions of different neighboring nodes to the central node due to the use of a fixed aggregation function, and improves the accuracy of vulnerability detection.

[0095] The vulnerability detection method provided in this application generates edge attention weights by using the feature vectors between the central node and adjacent nodes in the composite contract graph. This accurately quantifies the semantic importance of edges between nodes, achieving more refined neighbor information aggregation. It avoids the problem of being unable to distinguish the differences in the semantic contributions of different adjacent nodes to the central node caused by aggregating the features of adjacent nodes of each node in the graph based on a fixed mean aggregation function, thus improving the accuracy of detecting smart contract vulnerabilities.

[0096] The vulnerability detection method of this application will be described below through specific embodiments.

[0097] For example, such as Figure 7 As shown, the implementation process of the vulnerability detection method provided in this application embodiment includes the following S1 to S7:

[0098] S1. The vulnerability detection device parses the relevant data of the smart contract to be detected and generates an abstract syntax tree, a control flow graph, and a program dependency graph.

[0099] S2. The vulnerability detection device performs fusion processing on the abstract syntax tree, the control flow graph, and the program dependency graph to obtain the composite contract graph.

[0100] S3. The vulnerability detection device calculates the first difference based on the node characteristics of the central node and adjacent nodes of the smart contract to be detected.

[0101] S4. The vulnerability detection device calculates the edge attention weight based on the first difference, the node characteristics of the central node and the adjacent nodes.

[0102] S5. Based on the aforementioned edge attention weights, the vulnerability detection device performs weighted fusion of the node features of the aforementioned central node and the aforementioned adjacent nodes to obtain the updated node features of the aforementioned central node and the aforementioned adjacent nodes.

[0103] S6. The vulnerability detection device determines at least one first probability based on the updated node characteristics described above.

[0104] S7. The vulnerability detection device generates vulnerability detection results for the smart contract to be detected based on at least one of the above-mentioned first probabilities.

[0105] Therefore, this application proposes a smart contract vulnerability detection method based on a multi-level attention fusion graph attention network. By introducing a dynamic neighborhood attention mechanism that explicitly characterizes edge semantic differences at the node level, and a feature fusion architecture with cross-layer adaptive weight allocation at the layer level, this method addresses the problems of inaccurate neighbor information aggregation, excessive smoothness in deep networks, and low efficiency in utilizing multi-layer features in existing technologies. This significantly improves the detection accuracy and robustness of smart contract vulnerabilities with complex business logic in trusted data space scenarios.

[0106] It should be noted that the descriptions of each step S1 to S7 in this embodiment can be found in the descriptions in the above embodiments, and will not be repeated here.

[0107] The following is a general overview of the vulnerability detection method proposed in this application.

[0108] This application discloses a smart contract vulnerability detection method based on a multi-level attention fusion graph attention network. This method establishes a deterministic technical path from contract parsing to risk assessment through explicit construction of a graph structure, employing both node-level and layer-level adaptive control. Specifically, it includes the following steps:

[0109] First, multi-dimensional data input and contract graph structure construction: The system acquires the source code, compiled bytecode, and historical transaction data of the smart contract to be tested. Through program analysis tools, it parses the data to obtain an Abstract Syntax Tree (AST), a Control Flow Graph (CFG), and a Program Dependency Graph (PDG), which are then merged to construct a composite contract graph. Among them, nodes Represents basic code elements such as variables, functions, or opcodes, and... It represents control dependency, data dependency, or call relationship, and assigns a feature vector that combines source code semantics and opcode type to the initialization of nodes and edges respectively.

[0110] Secondly, the evolution of the two-level attention mechanism based on multi-layer graph attention network encoding: the input of the constructed contract graph is... In the encoding module of the layered graph attention network, during the hierarchical encoding process, deterministic attention operators at the following two levels (node ​​level and layer level) are used to co-modulate the neighbor information flow and the network depth axis information flow:

[0111] Node level: at any number In layer encoding, the model first calculates the absolute difference of the feature vectors of adjacent node pairs in the higher-order mapping space. This is used as an explicit representation of local grammatical perturbation; subsequently, the features of the central node, neighboring nodes, explicit difference vectors, edge category semantic vectors, and edge inherent relation features are horizontally concatenated to construct a full-element heterogeneous edge feature tensor. Using scoring vectors and Function mapping yields the original edge attention score. Then, a learnable scalar temperature parameter is introduced to adaptively and smoothly scale the score. and in the local topological neighborhood Internal execution Normalization yields local attention weights Simultaneously, by utilizing the full-element splicing feature through linear mapping and... Activation functions construct edge semantic gating signals Finally, the gating signal and the local attention weights are fused through a dot-multiplicative process to construct a dynamic aggregation weight that takes into account both topological structure and relational semantic constraints. and based on The mechanism updates the node features of neighboring nodes (i.e., the adjacent nodes mentioned above) by weighted summation, and provides an implementation method for dynamically filtering noisy edges based on the semantic differences in the actual code.

[0112] Layer-level: To address the issue of node feature homogenization that occurs as graph neural networks deepen with increasing layer count, the vulnerability detection method proposed in this application... arrive All evolutionary features of the layer are vertically optimized and fused. First, independent linear transformation matrices are configured. The heterogeneous node feature matrices output from each layer are projected onto a uniform feature space of equal length. Then, graph-level mean-pooling readout is performed independently on the aligned node feature set of each layer to eliminate the influence of the number of nodes and extract a one-dimensional graph-level global vector representing the topological semantics of the receptive field of each layer. Subsequently, the full-layer graph-level global vector sequence is... The input is fed into an inter-layer attention-aware network containing a hyperbolic tangent activation function to compute the importance scores of each layer. It also performs global softmax normalization on the depth axis and outputs adaptive inter-layer weights. Finally, the layer weights are used to perform a weighted summation of the graph-level representations at each layer, and the resulting vector is the final global graph representation vector. This architecture achieves dynamic adaptive optimal extraction of multi-scale features through nonlinear scoring and axial normalization.

[0113] Finally, downstream classification and vulnerability risk scoring are mapped. Specifically, the final fused global graph representation vector is... The input is fed into a fully connected classifier (classification head), which predicts and outputs the continuous confidence probability distribution vector of the smart contract for each preset vulnerability category. Finally, the continuous probabilities are converted into intuitive discrete industrial risk scores, suspicious code locations, and remediation suggestions through an established probability mapping function, completing the closed loop of security vulnerability detection for the contract.

[0114] The core algorithms in this application are described below.

[0115] Algorithm A: Dynamic Neighborhood Attention Mechanism.

[0116] The dynamic neighborhood attention mechanism described in this invention does not rely solely on node features themselves, but is achieved through explicit calculation of node feature differences, introduction of learnable temperature parameters, and dual-gated collaborative modulation. It is applicable to any given node... The specific mathematical logic and computational steps in the Layered Graph Attention Network (GAT) are as follows:

[0117] Step A1: Higher-order linear feature mapping

[0118] Let the first The node feature matrix input to the layer is ,in The total number of nodes. This represents the feature dimension of the current layer.

[0119] For any central node in the graph Using the learnable weight matrix of this layer Perform a linear transformation and project it onto a unified hidden layer space to obtain the higher-order node feature vectors. :

[0120]

[0121] Step A2: Joint Construction of Heterogeneous Features at the Edge Level

[0122] For any node in the graph that is a source node (or neighbor node) Points to the target node (center node). edge :

[0123] First, calculate the absolute value of the feature differences between the nodes: explicitly calculate the absolute difference vector between the two nodes in the higher-order space. This is used to directly characterize the degree of perturbation in the local grammar:

[0124]

[0125] Then, heterogeneous full-feature concatenation is performed: the edge category label corresponding to the edge is retrieved. And mapped to low-dimensional dense semantic vectors At the same time, obtain the inherent relation feature vector of the edge. The above elements are then horizontally spliced ​​together. (This represents the splicing operation), constructing a full-feature heterogeneous edge feature tensor. :

[0126]

[0127] Step A3: Attention scoring and normalization based on temperature parameter scaling

[0128] First, score the original edge attention: introduce a learnable scoring parameter vector. A nonlinear mapping is performed on the concatenated edge features to obtain a scalar score. :

[0129] Next, learnable temperature scaling is performed: to dynamically control the sharpness of the attention distribution and avoid gradient vanishing, a learnable scalar temperature parameter is introduced. (Initialized to 1.0), adaptive scaling of scores:

[0130]

[0131] Finally, perform neighborhood local normalization: for the central node... All first-order topological neighbors implement Transformation yields locally normalized attention weights. :

[0132]

[0133] Step A4: Local and Global Dual-Gated Modulation

[0134] To explicitly filter noisy edges in the graph topology, a dual gating mechanism is designed to finely block the information flow:

[0135] First, construct dual-gated features: introduce learnable gating parameter vectors. ,pass The activation function outputs gating control coefficients that take into account both local structure and global edge semantics. :

[0136]

[0137] Next, dynamic multiplicative fusion weights are constructed: the normalized attention weights and the gating control coefficients are multiplied and fused to construct the final dynamic fusion weights. :

[0138]

[0139] Step A5: Feature Aggregation and State Update

[0140] Utilizing dynamic fusion weights Nonlinear weighted aggregation of the higher-order features of neighboring nodes is performed to complete the central node's... Hidden state update of layer:

[0141]

[0142] in for or Nonlinear activation function.

[0143] Algorithm B: Cross-layer adaptive attention algorithm.

[0144] The vulnerability detection method proposed in this application adopts a cross-layer adaptive attention fusion architecture. It achieves adaptive fusion of shallow local details and deep global semantics by explicitly aligning, scale-reading, non-linearly scoring, and weighting features from GNN hidden layers of different depths at the layer level. The specific substantive execution steps are as follows:

[0145] Step B1: Spatial Dimension Feature Alignment

[0146] Due to the different layers in the multi-layer GAT model encoding process Node feature matrix The channel dimensions may exhibit heterogeneity. This invention first configures an independent linear feature alignment matrix for each layer. Projecting all layer features of all nodes in the entire graph onto a dimension of... In the feature space of equal length:

[0147]

[0148] Step B2: Multi-scale map-level global readout

[0149] To perform cross-level fusion at the full graph scale (smart contract global graph), graph-level mean-pooling is performed on the aligned node feature set of each layer to eliminate the influence of the number of nodes and extract graph-level feature vectors representing the specific receptive field topological semantics of that layer. :

[0150]

[0151] Step B3: Cross-layer adaptive attention scoring

[0152] Graph-level global vectors extracted from all levels A unified input is fed into an inter-layer attention-based perceptual network. A shared hidden layer mapping matrix is ​​introduced. Bias vector and layer attention projection vector Calculate the first Layer diagrams represent the scalar score of the "value" of the final vulnerability classification task. :

[0153]

[0154] Step A4: Depth Axis Softmax Weight Assignment

[0155] Scalar scores for all layers on the network's depth axis. implement Normalization adaptively outputs the weights assigned to the features of the current contract graph at each layer. And the sum of all layer weights is 1:

[0156]

[0157] Step A5: Adaptive weighted summation and fusion

[0158] Using the calculated layer attention weights Graph hierarchy representation of each layer Linear weighted fusion is performed to construct a final global graph representation vector rich in both "local micro-code operations" and "global macro-context logic". :

[0159]

[0160] The vector The data is then directly input into the downstream multi-layer fully connected classification header, which maps and outputs the probability distribution of vulnerability categories and quantitative risk scores for smart contracts.

[0161] The vulnerability detection method proposed in this application will be described below through specific embodiments.

[0162] Step C1: Multidimensional data input and preprocessing

[0163] First, acquire relevant data about the consortium blockchain smart contract to be trained or tested, including the source code of the smart contract written in Solidity or Go, the compiled bytecode, and historical transaction data.

[0164] The source code is then subjected to standardized preprocessing, such as removing comments and standardizing the format.

[0165] Step C2: Construction of Multidimensional Fusion Contract Graph Structure

[0166] First, standardized data is parsed using program analysis tools to generate static ASTs, CFGs, and PDGs representing data and control dependencies between statements.

[0167] The aforementioned multi-source graph representations are then fused into a unified composite contract graph. Among them, nodes Represents the basic elements of the code, edges This represents control flow transfers, data flow dependencies, or external call relationships. A feature vector, incorporating source code semantics and opcode types, is initialized for each node and edge; the initial feature dimension is denoted as [insert dimension here]. .

[0168] Step C3: Hierarchical encoding based on dynamic neighborhood attention at the node level

[0169] Input the contract diagram and its features from A graph attention network consisting of layers. In any given... In the layer, the input is the feature of the node in the previous layer. This layer dynamically aggregates neighbor information and updates node characteristics through the following steps C3a to C3d:

[0170] Step C3a: Linear Feature Mapping: Utilizing a Learnable Weight Matrix Map node features to a higher-order feature space:

[0171]

[0172] Step C3b: Edge-level semantic scoring and feature difference calculation: Explicitly calculate the absolute difference between feature vectors of adjacent nodes. As an explicit difference representation. Combined with central node features. Neighbor node characteristics semantics of edge categories and specific relational characteristics Perform a four-in-one joint splicing, using scoring vectors. and Activation function calculates the raw attention score :

[0173]

[0174] Step C3c: Temperature Parameter Scaling and Neighborhood Normalization: Introducing Learnable Temperature Parameters Smoothing is applied to the raw scores, and at the center node local neighborhood Internal use The transformation yields the normalized attention weights. :

[0175]

[0176] Step C3d: Dual-gating modulation mechanism: utilizing splicing features through the first linear layer and Activation functions construct edge semantic gating signals This is used to coordinate the control of the incoming intensity of local and global information flows.

[0177]

[0178] By multiplicatively fusing the gating signal and attention weights, a dynamic aggregation weight is constructed that takes into account both topological structure and relational semantic constraints. :

[0179]

[0180] Neighbor state aggregation update: based on dynamic fusion weights The features of neighboring nodes are weighted and summed, and then combined with a non-linear activation function. Get the hidden state of the nodes in the next layer :

[0181]

[0182] Step C4: Layer-level, cross-layer adaptive attention fusion

[0183] To overcome the oversmoothing phenomenon in deep network training and to organically combine shallow local details with deep global semantics, the following cross-layer adaptive fusion mechanism is designed:

[0184] Layer feature alignment: Aligning each evolution layer Output heterogeneous node features Each is projected onto a unified hidden layer dimension using an independent linear transformation matrix. .

[0185] Multi-scale graph-level readout: Graph-level mean-pooling is performed on the aligned node features of each layer to aggregate all graph nodes into a single fixed-dimensional graph-level representation that represents the global information of that layer. :

[0186]

[0187] Inter-layer attention scoring and weight allocation: Representing each layer in the graph The input is fed into an inter-layer scoring network containing a hyperbolic tangent activation function, and the importance score of each layer is calculated. :

[0188]

[0189] Execute on the layer dimension axis Normalization yields adaptive inter-layer weight allocation. (satisfy ):

[0190]

[0191] Multi-scale weighted fusion: The graph-level representations at each level are weighted and summed using inter-layer weights to construct the final global graph representation. :

[0192]

[0193] Step C5: Downstream Classification and Vulnerability Risk Scoring Mapping

[0194] First, represent the global graph. In the multi-layer fully connected network classifier of the input classification and detection module, the classification head is used to output the continuous probability distribution vector of the current smart contract in each preset vulnerability category.

[0195] Then, a mapping function (such as piecewise mapping or linear scaling) is established from the confidence probability of the target category to the specific industrial risk score, outputting an intuitive quantitative risk score of the vulnerability, the location of suspicious code, and remediation suggestions.

[0196] It should be noted that the above-described method embodiments, or the various possible implementations of the method embodiments, can be executed individually, or, provided there is no conflict, they can be combined with each other. The specific implementation can be determined according to actual usage requirements, and this application embodiment does not impose any restrictions on this.

[0197] It should be noted that for a detailed explanation of the steps performed by each module and their beneficial effects, please refer to the description in the above embodiments, which will not be repeated here.

[0198] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0199] This application embodiment can divide the vulnerability detection device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0200] In some embodiments, this application also provides a vulnerability detection apparatus. The vulnerability detection apparatus may include one or more functional modules for implementing the vulnerability detection method described in the above embodiments.

[0201] For example, Figure 8 This is a schematic diagram of a vulnerability detection device provided in an embodiment of this application. Figure 8 As shown, the vulnerability detection device 900 includes: a construction module 901, a calculation module 902, and a generation module 903.

[0202] The aforementioned construction module 901 is used to construct a composite contract graph based on the relevant data of the smart contract to be detected. The relevant data includes: source code, compiled bytecode, and historical transaction data. Each node of the composite contract graph represents a basic element in the source code, and each edge of the composite contract graph represents the element relationship between two basic elements. The element relationship includes at least one of the following: control dependency, data dependency, and call relationship. The aforementioned calculation module 902 is used to calculate the edge attention weight based on the node characteristics of the central node and adjacent nodes of the composite contract graph. The edge attention weight is used to characterize the semantic importance of the edge between the central node and the adjacent node. The aforementioned generation module 903 is used to generate the vulnerability detection result of the smart contract to be detected based on the aforementioned edge attention weight.

[0203] One possible implementation is that the aforementioned construction module 901 is specifically used to: parse the aforementioned relevant data to generate an abstract syntax tree, a control flow graph, and a program dependency graph. The abstract syntax tree is used to represent the hierarchical relationship of the basic elements in the aforementioned source code, the control flow graph is used to represent the execution order and jump relationship of the basic elements in the aforementioned source code, and the program dependency graph is used to represent the data dependency relationship between the basic elements in the aforementioned source code; and to fuse the aforementioned abstract syntax tree, the aforementioned control flow graph, and the aforementioned program dependency graph to obtain the aforementioned composite contract graph.

[0204] Another possible implementation, the above calculation module 902 is specifically used to: calculate a first difference based on the node characteristics of the above-mentioned center node and the above-mentioned adjacent nodes, the first difference representing the degree of logical deviation between the above-mentioned center node and the above-mentioned adjacent nodes; and calculate the above-mentioned edge attention weight based on the first difference and the node characteristics of the above-mentioned center node and the above-mentioned adjacent nodes.

[0205] Another possible implementation is that the above-mentioned generation module 903 is specifically used to: perform weighted fusion of the node features of the above-mentioned center node and the above-mentioned adjacent nodes based on the above-mentioned edge attention weights to obtain the updated node features of the above-mentioned center node and the above-mentioned adjacent nodes; and generate the vulnerability detection result of the above-mentioned smart contract to be detected based on the updated node features.

[0206] Another possible implementation is that the generation module 903 is specifically used to: determine at least one first probability based on the updated node characteristics, the first probability representing the probability that the smart contract to be detected has a corresponding type of vulnerability; and generate a vulnerability detection result for the smart contract to be detected based on the at least one first probability; wherein the vulnerability detection result includes at least one of the following: vulnerability level, vulnerability location, and vulnerability remediation suggestion.

[0207] The vulnerability detection device provided in this application generates edge attention weights by using the feature vectors between the central node and adjacent nodes in the composite contract graph. This accurately quantifies the semantic importance of edges between nodes, enabling more refined aggregation of neighbor information. It avoids the problem of being unable to distinguish the differences in the semantic contributions of different adjacent nodes to the central node caused by aggregating the features of adjacent nodes of each node in the graph based on a fixed mean aggregation function, thus improving the accuracy of detecting vulnerabilities in smart contracts.

[0208] It should be noted that the vulnerability detection device can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0209] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 9 As shown, the electronic device 90 includes: a processor 92, a communication interface 93, and a bus 94. Optionally, the electronic device 90 may also include a memory 91.

[0210] Processor 92 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 92 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0211] Communication interface 93 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0212] The memory 91 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0213] As one possible implementation, the memory 91 can exist independently of the processor 92. The memory 91 can be connected to the processor 92 via a bus 94 and is used to store instructions or program code. When the processor 92 calls and executes the instructions or program code stored in the memory 91, it can implement the vulnerability detection method provided in the embodiments of this application.

[0214] In another possible implementation, memory 91 can also be integrated with processor 92.

[0215] Bus 94 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 94 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0216] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0217] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described vulnerability detection method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0218] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0219] This application also provides a readable storage medium storing a program or instructions that, when executed by a computer, implement the vulnerability detection method provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware; the readable storage medium can be any of the foregoing embodiments or memory; the readable storage medium can also be an external storage device of the service invocation device, such as a pluggable hard drive, Smart MediaCard (SMC), Secure Digital (SD) card, flash card, etc., equipped on the service invocation device. Further, the readable storage medium can include both internal storage units of the service invocation device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the service invocation device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0220] This application also provides a computer program product, which is stored in a storage medium and implements the vulnerability detection method provided in the above embodiments when the computer program product is executed by a computer.

[0221] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0222] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0223] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A vulnerability detection method, characterized in that, include: Based on the relevant data of the smart contract to be tested, a composite contract graph is constructed. The relevant data includes: source code, compiled bytecode, and historical transaction data. Each node of the composite contract graph represents a basic element in the source code, and each edge of the composite contract graph represents the element relationship between two basic elements. The element relationship includes at least one of the following: control dependency, data dependency, and call relationship. Based on the node features of the central node and adjacent nodes of the composite contract graph, edge attention weights are calculated, and the edge attention weights are used to characterize the semantic importance of the edges between the central node and the adjacent nodes. Based on the edge attention weights, the vulnerability detection results of the smart contract to be detected are generated.

2. The vulnerability detection method according to claim 1, characterized in that, The construction of a composite contract graph based on relevant data of the smart contract to be detected includes: The relevant data is parsed to generate an abstract syntax tree, a control flow graph, and a program dependency graph. The abstract syntax tree is used to represent the hierarchical relationship of the basic elements in the source code, the control flow graph is used to represent the execution order and jump relationship of the basic elements in the source code, and the program dependency graph is used to represent the data dependency relationship between the basic elements in the source code. The abstract syntax tree, the control flow graph, and the program dependency graph are fused together to obtain the composite contract graph.

3. The vulnerability detection method according to claim 1, characterized in that, The edge attention weights are calculated based on the node features of the center node and adjacent nodes of the composite contract graph, including: Based on the node characteristics of the central node and the adjacent nodes, a first difference is calculated, which characterizes the degree of logical deviation between the central node and the adjacent nodes. The edge attention weights are calculated based on the first difference, the node features of the center node and the adjacent nodes.

4. The vulnerability detection method according to claim 1, characterized in that, The step of generating vulnerability detection results for the smart contract to be detected based on the edge attention weights includes: Based on the edge attention weights, the node features of the center node and the adjacent nodes are weighted and fused to obtain the updated node features of the center node and the adjacent nodes. Based on the updated node characteristics, the vulnerability detection results of the smart contract to be detected are generated.

5. The vulnerability detection method according to claim 4, characterized in that, The step of generating vulnerability detection results for the smart contract to be detected based on the updated node characteristics includes: Based on the updated node characteristics, at least one first probability is determined, whereby the first probability represents the probability that the smart contract to be detected has a corresponding type of vulnerability. Based on the at least one first probability, generate the vulnerability detection result of the smart contract to be detected; The vulnerability detection results include at least one of the following: vulnerability level, vulnerability location, and vulnerability remediation recommendations.

6. A vulnerability detection device, characterized in that, include: Modules for building, computing, and generating; The construction module is used to construct a composite contract graph based on the relevant data of the smart contract to be detected. The relevant data includes: source code, compiled bytecode, and historical transaction data. Each node of the composite contract graph represents a basic element in the source code, and each edge of the composite contract graph represents the element relationship between two basic elements. The element relationship includes at least one of the following: control dependency, data dependency, and call relationship. The calculation module is used to calculate edge attention weights based on the node features of the central node and adjacent nodes of the composite contract graph constructed by the construction module. The edge attention weights are used to characterize the semantic importance of the edges between the central node and the adjacent nodes. The generation module is used to generate vulnerability detection results for the smart contract to be detected based on the edge attention weights calculated by the calculation module.

7. The vulnerability detection device according to claim 6, characterized in that, The building module is specifically used for: The relevant data is parsed to generate an abstract syntax tree, a control flow graph, and a program dependency graph. The abstract syntax tree is used to represent the hierarchical relationship of the basic elements in the source code, the control flow graph is used to represent the execution order and jump relationship of the basic elements in the source code, and the program dependency graph is used to represent the data dependency relationship between the basic elements in the source code. The abstract syntax tree, the control flow graph, and the program dependency graph are fused together to obtain the composite contract graph.

8. The vulnerability detection device according to claim 6, characterized in that, The computing module is specifically used for: Based on the node characteristics of the central node and the adjacent nodes, a first difference is calculated, which characterizes the degree of logical deviation between the central node and the adjacent nodes. The edge attention weights are calculated based on the first difference, the node features of the center node and the adjacent nodes.

9. The vulnerability detection device according to claim 6, characterized in that, The generation module is specifically used for: Based on the edge attention weights, the node features of the center node and the adjacent nodes are weighted and fused to obtain the updated node features of the center node and the adjacent nodes. Based on the updated node characteristics, the vulnerability detection results of the smart contract to be detected are generated.

10. The vulnerability detection device according to claim 9, characterized in that, The generation module is specifically used for: Based on the updated node characteristics, at least one first probability is determined, whereby the first probability represents the probability that the smart contract to be detected has a corresponding type of vulnerability. Based on the at least one first probability, generate the vulnerability detection result of the smart contract to be detected; The vulnerability detection results include at least one of the following: vulnerability level, vulnerability location, and vulnerability remediation recommendations.

11. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the vulnerability detection method as described in any one of claims 1 to 5.

12. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a computer, implement the vulnerability detection method as described in any one of claims 1 to 5.

13. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when executed by a computer, the computer program product implements the vulnerability detection method as described in any one of claims 1 to 5.

Images