Information processing method, information processing device, and program

Abstract

An information processing method according to the present invention involves: acquiring a first contract code of a smart contract for transactions of crypto-assets (S101); determining whether the first contract code includes a second contract code that causes a computer constituting a distributed ledger system to execute a second function for performing a second transaction of the crypto-assets after causing the computer to execute a first function for restricting a first transaction of the crypto-assets (S102); and outputting information indicating the result of the determination (S103).

Description

Information Processing Method, Information Processing Apparatus, and Program

[0001] The present invention relates to an information processing method, an information processing apparatus, and a program.

[0002] Conventionally, there have been cyberattacks related to cryptographic assets (also referred to as backdoor attacks), such as illegally manipulating cryptographic assets.

[0003] There is a technique for detecting that a backdoor attack can be carried out when the code of a program for managing cryptographic assets is executed by searching the code (see Non-Patent Document 1).

[0004] Fuchen Ma et al., “Pied-Piper: Revealing the Backdoor Threats in Ethereum ERC Token Contracts,” ACM Transactions on Software Engineering and Methodology, Volume 32, Issue 3, Article No.: 61, Pages 1 - 24.

[0005] In the conventional backdoor attack detection technique, there is a problem that false detections are relatively frequent.

[0006] Therefore, the present invention provides an information processing method and the like that contribute to detecting with higher accuracy the code that executes a backdoor attack.

[0007] An information processing method according to an aspect of the present invention acquires a first contract code of a smart contract for trading cryptographic assets, causes a computer constituting a distributed ledger system to execute a first function that restricts a first transaction of the cryptographic assets, and then determines whether a second contract code that causes the computer to execute a second function for performing a second transaction of the cryptographic assets is included in the first contract code, and outputs information indicating the result of the determination.

[0008] These comprehensive or specific embodiments may be implemented as a system, device, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or as any combination of a system, device, integrated circuit, computer program, and recording medium.

[0009] This invention contributes to detecting code that executes backdoor attacks with greater accuracy.

[0010] This is a block diagram showing an example of the functional configuration of the information processing device in the embodiment. This is a flowchart showing a first example of processing performed by the information processing device in the embodiment. This is an explanatory diagram showing an example of contract code. This is a flowchart showing a second example of processing performed by the information processing device in the embodiment. This is an explanatory diagram showing an example of code detected by the information processing device in the embodiment. This is a flowchart showing a third example of processing performed by the information processing device in the embodiment. This is an explanatory diagram showing a first example of a graph in which contract code that causes a backdoor attack to be performed by the information processing device in the embodiment is detected. This is an explanatory diagram showing a second example of a graph in which contract code that causes a backdoor attack to be performed by the information processing device in the embodiment is detected. This is an explanatory diagram showing a third example of a graph in which contract code that causes a backdoor attack to be performed by the information processing device in the embodiment is detected. This is an explanatory diagram showing a fourth example of a graph in which contract code that causes a backdoor attack to be performed by the information processing device in the embodiment is detected. This is an explanatory diagram showing a fifth example of a graph in which contract code that causes a backdoor attack to be performed by the information processing device in the embodiment is detected. This is an explanatory diagram showing a sixth example of a graph in which contract code that causes a backdoor attack to be performed by the information processing device in the embodiment is detected. This is an explanatory diagram showing the first example of contract code in the comparative technology. This is an explanatory diagram showing the second example of contract code in the comparative technology.

[0011] (Knowledge that formed the basis of this invention) The inventors identified the following problems with the backdoor attack detection technology described in the "Background Art" section.

[0012] In the code detection technique for which a backdoor attack may be carried out, as described in Non-Patent Document 1, a backdoor attack may be carried out if the code in question contains code that causes a computer to execute at least one of the following functions.

[0013] • Arbitrary Transfer function: A function that allows the transfer of any token.

[0014] • Generate Token function: A function that generates tokens for any account.

[0015] • Destroy Token function: A function to destroy tokens.

[0016] • Disable Transfer function: A function that restricts token transfers by users other than specified accounts.

[0017] • Frozen Account feature: A feature that allows you to freeze the assets of any account.

[0018] However, the detection techniques described above may incorrectly identify code that performs functions included in the normal operation (in other words, legitimate operation) of crypto assets as code that performs backdoor attacks.

[0019] For example, in the normal operation of crypto assets, there is a service that makes token transfer fees free. The code to implement the above service may include code that restricts token transfers between accounts. This code that restricts token transfers between accounts may be detected as code that executes the Disable Transfer function. As a result, the code to implement the service that makes token transfer fees free may be mistakenly detected as code that executes a backdoor attack. Note that the service that makes fees free may also be called a service that waives fees.

[0020] Thus, conventional backdoor attack detection technologies have the problem of a relatively high rate of false positives.

[0021] Therefore, the present invention provides an information processing method and the like that contributes to detecting code that executes backdoor attacks with higher accuracy.

[0022] The following describes examples of inventions that can be obtained from the disclosures in this specification, and explains the effects and other benefits that can be obtained from such inventions.

[0023] (1) An information processing method that obtains a first contract code for a smart contract for trading crypto assets, determines whether the first contract code contains a second contract code that causes a computer constituting a distributed ledger system to execute a first function that restricts the first trading of the crypto assets, and then causes the computer to execute a second function that performs a second trading of the crypto assets, and outputs information indicating the result of the determination.

[0024] According to the above embodiment, an information processing device that executes an information processing method can appropriately detect contract code that includes contract code that causes a second function to perform cryptocurrency transactions after the execution of a first function to restrict cryptocurrency transactions as contract code that causes a computer to perform a backdoor attack. In other words, the information processing device can appropriately detect the contract code as contract code that causes a computer to perform a backdoor attack, provided that the contract code has a pattern of executing the second function after the execution of the first function. At this time, the information processing device can avoid detecting the contract code as contract code that causes a backdoor attack, solely based on the condition that it includes contract code that executes a function to restrict cryptocurrency transactions, or solely based on the condition that it includes contract code that executes a function to perform cryptocurrency transactions. A function to restrict cryptocurrency transactions, or a function to perform cryptocurrency transactions, may be included in contract code that performs a backdoor attack, but it may also be included in contract code for legitimate cryptocurrency operations (i.e., operations that are not backdoor attacks). Therefore, if the information processing device inspects contract code only on the condition that it contains contract code that executes a function to restrict cryptocurrency transactions, or contract code that executes a function to perform cryptocurrency transactions, it may mistakenly detect contract code for legitimate operations as contract code that executes a backdoor attack. In this way, the information processing device can appropriately detect contract code that executes a backdoor attack by inspecting the contract code on the condition that it contains contract code that executes the second function after the execution of the first function.

[0025] (2) The information processing method according to (1), wherein the first function includes a function to destroy the crypto asset, a function to stop the transfer of the crypto asset, or a function to freeze the account of the crypto asset, and the second function includes a function to transfer the crypto asset or a function to generate the crypto asset.

[0026] According to the above embodiment, the information processing device that executes the information processing method uses a function to destroy crypto assets, a function to stop the transfer of crypto assets, or a function to freeze a crypto asset account as a first function, and uses a function to transfer crypto assets or a function to generate crypto assets as a second function, thereby contributing to detecting code that causes a backdoor attack with higher accuracy.

[0027] (3) The information processing method according to (1), wherein the determination includes determining whether a first code that causes the computer to execute the first function is included in the first contract code, and if it is determined that the first code is included in the first contract code, it determines whether a second code that causes the computer to execute the second function after the first function has been executed is included in the first contract code, and if it is determined that the second code is included in the first contract code, it determines that the first contract code includes the second contract code.

[0028] According to the above embodiment, the information processing device that executes the information processing method can more easily determine whether both the first code and the second code are included in the first contract code by sequentially determining whether the first code that executes the first function and the second code that executes the second function are included in the first contract code. Therefore, the information processing device contributes to detecting code that executes a backdoor attack with higher accuracy and more ease.

[0029] (4) The information processing method according to (1), wherein the determination involves converting the first contract code into a first graph which includes nodes representing one or more functions expressed by the first contract code and edges indicating the execution order of the one or more functions, determining whether the second function is executed after the first function is executed using the connection relationships between the nodes and edges in the first graph, and determining that the first contract code includes the second contract code if it is determined that the second function is executed after the first function is executed.

[0030] According to the above embodiment, an information processing device that executes an information processing method can determine whether a first code that executes a first function and a second code that executes a second function are included in the first contract code, using the connection relationships of a graph representing the first contract code. Generally, contract code that executes an unauthorized function, such as the execution of a backdoor attack, may be written in a way that makes it difficult or virtually impossible for humans to read. Even if the first contract code is written in a way that makes it difficult or virtually impossible for humans to read, if the graph into which the first contract code is transformed can appropriately represent the relationships of the functions that the first contract code possesses, the graph can be used to appropriately determine whether the first code and the second code are included in the first contract code. Therefore, the information processing device contributes to detecting code that executes a backdoor attack with higher accuracy and more appropriateness.

[0031] (5) An information processing device comprising a processor and a memory connected to the processor, wherein the processor uses the memory to obtain a first contract code of a smart contract for trading crypto assets, determines whether the first contract code includes a second contract code that causes a computer constituting a distributed ledger system to execute a first function that restricts the first trading of the crypto assets, and then causes the computer to execute a second function that performs a second trading of the crypto assets, and outputs information indicating the result of the determination.

[0032] According to the above embodiment, the same effects as the above information processing method are achieved.

[0033] (6) A program that causes an information processing device to execute the information processing method described in (1).

[0034] According to the above embodiment, the same effects as the above information processing method are achieved.

[0035] These comprehensive or specific embodiments may be implemented as a system, device, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or as any combination of a system, device, integrated circuit, computer program, or recording medium.

[0036] The embodiments will be described in detail below with reference to the drawings.

[0037] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement and connection configurations of components, steps, and the order of steps shown in the following embodiments are examples only and are not intended to limit the present invention. Furthermore, among the components in the following embodiments, those not described in the independent claim representing the highest-level concept will be described as optional components.

[0038] (Embodiment) In this embodiment, an information processing method and an information processing device that contribute to detecting code that executes a backdoor attack with higher accuracy will be described.

[0039] Figure 1 is a block diagram showing an example of the functional configuration of the information processing device 10 in this embodiment.

[0040] As shown in Figure 1, the information processing device 10 includes an acquisition unit 11, a determination unit 12, and an output unit 13 as functional units. At least a portion of the functional units of the information processing device 10 are realized by the processor (e.g., CPU (Central Processing Unit)) of the information processing device 10 executing a program using memory.

[0041] The acquisition unit 11 acquires contract code of a smart contract (corresponding to the first contract code) for trading cryptocurrency. The contract code acquired by the acquisition unit 11 is executed by at least one computer (also simply referred to as a computer) constituting a distributed ledger system (not shown) (for example, a blockchain system).

[0042] The determination unit 12 determines whether the contract code acquired by the acquisition unit 11 includes a contract code (corresponding to the second contract code) that causes a computer to execute a trading function after executing a trading restriction function.

[0043] Here, the trading restriction function corresponds to a first function that restricts trading of cryptocurrency (corresponding to the first trading). Also, the trading function corresponds to a second function that conducts trading of cryptocurrency (corresponding to the second trading).

[0044] The output unit 13 outputs information indicating the result of the determination by the determination unit 12. For example, when the determination unit 12 determines that the first contract code includes the second contract code, the output unit 13 outputs information indicating that the contract code for executing a cyber-attack on the cryptocurrency, that is, a backdoor attack, is included in the first contract code.

[0045] The processing of the information processing apparatus 10 configured as described above will be described in detail hereinafter.

[0046] FIG. 2 is a flowchart showing a first example of processing (or algorithm) executed by the information processing apparatus 10 in the present embodiment. FIG. 3 is an explanatory diagram showing an example of contract code.

[0047] As shown in FIG. 2, in step S101, the acquisition unit 11 acquires a contract code (corresponding to the first contract code) of a smart contract for trading cryptographic assets. The contract code acquired by the acquisition unit 11 can be a contract code of a smart contract executed in a distributed ledger system (not shown) (for example, a blockchain system). Contract code 30, which is an example of the contract code acquired by the acquisition unit 11 in step S101, is shown in FIG. 3.

[0048] In step S102, the determination unit 12 determines whether the contract code acquired by the acquisition unit 11 in step S101 includes a contract code (corresponding to the second contract code) for executing the trading function after executing the trading restriction function. Here, the trading restriction function corresponds to a first function for restricting the trading of cryptographic assets (corresponding to the first trading). The trading function corresponds to a second function for performing the trading of cryptographic assets (corresponding to the second trading).

[0049] More specifically, the first function includes a function of destroying cryptographic assets (corresponding to the Destroy Token function), a function of stopping the transfer of cryptographic assets (corresponding to the Disable Transfer function), or a function of freezing the account of cryptographic assets (corresponding to the Frozen Account function). More specifically, the second function includes a function of transferring cryptographic assets (corresponding to the Arbitrary Transfer function) or a function of generating cryptographic assets (corresponding to the Generate Token function). The above determination method will be described in detail later.

[0050] In step S103, the output unit 13 outputs information indicating the result of the determination by the determination unit 12. For example, when the determination unit 12 determines that the first contract code includes the second contract code, the output unit 13 outputs information indicating that the contract code for executing a cyber attack on cryptographic assets, that is, a backdoor attack, is included in the first contract code.

[0051] Figure 4 is a flowchart showing a second example of the processing (or algorithm) executed by the information processing device 10 in this embodiment. The flowchart shown in Figure 4 is a flowchart showing the detailed processing included in step S102 of Figure 2. Figure 5 is an explanatory diagram showing an example of code detected by the information processing device 10 in this embodiment. A first example of a method for detecting code related to backdoor attacks will be described with reference to Figures 4 and 5.

[0052] In step S201 shown in Figure 4, the determination unit 12 determines whether the contract code acquired by the acquisition unit 11 in step S101 includes a code that executes the transaction restriction function (also called the first code).

[0053] For example, the code 31 "if ( msg.sender == contractPreICO || msg.sender == contractICO )" included in the contract code 30 shown in Figure 5 has the function of restricting token transfers by users other than contractICO (i.e., the fundraiser of the ICO (Initial Coin Offering)), and therefore corresponds to the code that implements the Disable Transfer function, or in other words, corresponds to the first code.

[0054] If the determination unit 12 determines that the above contract code includes a first code that executes the transaction restriction function, the process proceeds to step S202 (Yes in step S201); otherwise, the process proceeds to step S211.

[0055] In step S202, the determination unit 12 determines whether the contract code acquired by the acquisition unit 11 in step S101 includes a code (also called a second code) that causes the trading function to be executed after the trading restriction function has been executed. If it is determined that the contract code includes a second code that causes the trading function to be executed after the trading restriction function has been executed (Yes in step S202), the process proceeds to step S203; otherwise (No in step S202), the process proceeds to step S211.

[0056] For example, code 32 "referrals [referral] += amount;" included in contract code 30 shown in Figure 5 has the function of increasing crypto assets, and therefore corresponds to the code that realizes the Generate Token function, or in other words, corresponds to the second code.

[0057] In step S203, the determination unit 12 determines that the contract code includes a contract code that causes the trading function to be executed after the trading restriction function has been executed.

[0058] In step S211, the determination unit 12 determines that the contract code does not contain a contract code that causes the trading function to be executed after the trading restriction function has been executed.

[0059] The result of the determination in step S203 or S211 above becomes the result of the determination in step S102 (see Figure 2).

[0060] Figure 6 is a flowchart showing a third example of the processing (or algorithm) executed by the information processing device 10 in this embodiment. The flowchart shown in Figure 6 is a flowchart showing the detailed processing included in step S102 of Figure 2. Figure 7 is an explanatory diagram showing a first example of a graph in which the information processing device 10 in this embodiment detects contract code that causes a backdoor attack. A second example of a method for detecting code related to a backdoor attack will be described with reference to Figures 6 and 7.

[0061] In step S301 shown in Figure 6, the determination unit 12 converts the first contract code acquired by the acquisition unit 11 in step S101 into a graph (also called the first graph). The first graph is a graph that includes nodes representing one or more functions expressed by the first contract code, and edges indicating the execution order of one or more functions.

[0062] The conversion from contract code to graph can be performed, for example, by generating an abstract syntax tree during compilation or by symbolic execution. Alternatively, the conversion from contract code to graph can be achieved using a pre-trained model. In this case, the pre-trained model is a machine learning model trained to output a graph having features corresponding to the features of the input contract code. The determination unit 12 can convert the first contract code to the first graph by inputting the first contract code into the pre-trained model and obtaining the resulting graph as the first graph.

[0063] Figure 7 shows an example of a graph converted by the determination unit 12 in step S301.

[0064] The graph shown in Figure 7 includes nodes 41 and 42 and edge 45.

[0065] Node 41 is a node that supports the Disable Transfer function.

[0066] Node 42 is the node that supports the Generate Token function.

[0067] Edge 45 is the edge extending from node 41, which supports the Disable Transfer function, to node 42, which supports the Generate Token function. Edge 45 corresponds to the fact that the Disable Transfer function is related to the Generate Token function, and more specifically, it corresponds to the fact that the Generate Token function is executed after the Disable Transfer function has been executed.

[0068] In step S302, the determination unit 12 uses the connection relationships of nodes and edges in the graph converted in step S301 to determine whether or not a trading function is executed after the trading restriction function is executed. In other words, the determination unit 12 determines whether or not the graph converted in step S301 is a graph corresponding to a contract code that causes a trading function to be executed after the trading restriction function is executed. If it is determined that a trading function is executed after the trading restriction function is executed (in other words, it is a graph corresponding to a contract code that causes a trading function to be executed after the trading restriction function is executed) (Yes in step S302), the process proceeds to step S303; otherwise (No in step S302), the process proceeds to step S311.

[0069] As described above, the graph shown in Figure 7 corresponds to the Generate Token function being executed after the Disable Transfer function is executed. Therefore, the determination unit 12 can determine that the graph corresponds to a contract code that executes the transaction function after the transaction restriction function is executed.

[0070] In step S303, the determination unit 12 determines that the contract code includes code that causes the trading function to be executed after the trading restriction function has been executed.

[0071] In step S311, the determination unit 12 determines that the contract code does not contain any code that would cause the trading function to be executed after the trading restriction function has been executed.

[0072] The result of the determination in step S303 or S311 above becomes the result of the determination in step S102 (see Figure 2).

[0073] In the following sections, other examples of how the information processing device 10 detects contract code that allows a backdoor attack to be executed will be described.

[0074] As described above, the information processing device 10 detects contract code that causes a backdoor attack if the graph into which the contract code is transformed corresponds to a graph of contract code that causes a transaction function to be executed after the transaction restriction function has been executed. More specifically, this occurs when the graph into which the contract code is transformed includes a node corresponding to the transaction restriction function, a node corresponding to the transaction function, and an edge from the node corresponding to the transaction restriction function to the node corresponding to the transaction function. Specific examples of the transaction restriction function are the Destroy Token function, the Disable Transfer function, or the Frozen Account function. Specific examples of the transaction function are the Arbitrary Transfer function or the Generate Token function. There may be one or more nodes corresponding to the transaction restriction function. There may be one or more nodes corresponding to the transaction function.

[0075] Specific examples of the above graph will be explained below.

[0076] Figure 8 is an explanatory diagram showing a second example of a graph in which the information processing device 10 in this embodiment detects contract code that causes a backdoor attack.

[0077] The graph shown in Figure 8 includes nodes 51, 52, and 53, and edges 55 and 56.

[0078] Node 51 is the node that supports the Destroy Token function.

[0079] Node 52 is a node that supports the Arbitrary Transfer function.

[0080] Node 53 is the node that supports the Generate Token function.

[0081] Edge 55 is the edge from node 51, which supports the Destroy Token function, to node 52, which supports the Arbitrary Transfer function. Edge 55 corresponds to the fact that the Destroy Token function is related to the Arbitrary Transfer function, and more specifically, it corresponds to the fact that the Arbitrary Transfer function is executed after the Destroy Token function has been executed.

[0082] Edge 56 is the edge from node 51, which corresponds to the Destroy Token function, to node 53, which corresponds to the Generate Token function. Edge 56 corresponds to the fact that the Destroy Token function is related to the Generate Token function, and more specifically, it corresponds to the fact that the Generate Token function is executed after the Destroy Token function has been executed.

[0083] The graph shown in Figure 8, as a whole, corresponds to the contract code in which the Arbitrary Transfer and Generate Token functions are executed after the Destroy Token function is executed, and therefore corresponds to the contract code that executes the trading function after the trading restriction function is executed.

[0084] Figure 9 is an explanatory diagram showing a third example of a graph in which the information processing device 10 in this embodiment detects contract code that causes a backdoor attack.

[0085] The graph shown in Figure 9 includes nodes 51 and 52 and edge 55.

[0086] Nodes 51 and 52 and edge 55 shown in Figure 9 are the same as the elements with the same names shown in Figure 8.

[0087] The graph shown in Figure 9, as a whole, corresponds to the contract code that executes the Arbitrary Transfer function after the Destroy Token function is executed, and therefore corresponds to the contract code that executes the trading function after the trading restriction function is executed.

[0088] Figure 10 is an explanatory diagram showing a fourth example of a graph in which the information processing device 10 in this embodiment detects contract code that causes a backdoor attack to be executed.

[0089] The graph shown in Figure 10 includes nodes 51 and 53 and edge 56.

[0090] Nodes 51 and 53 and edge 56 shown in Figure 10 are the same as the elements with the same names shown in Figure 8.

[0091] The graph shown in Figure 10, as a whole, corresponds to contract code in which the Generate Token function is executed after the Destroy Token function is executed, and therefore corresponds to contract code in which the trading function is executed after the trading restriction function is executed.

[0092] Figure 11 is an explanatory diagram showing a fifth example of a graph in which the information processing device 10 in this embodiment detects contract code that causes a backdoor attack.

[0093] The graph shown in Figure 11 includes nodes 61, 62, and 63, and edges 65 and 66.

[0094] Node 61 is a node that supports the Disable Transfer function.

[0095] Node 62 is a node that supports the Arbitrary Transfer function.

[0096] Node 63 is the node that supports the Generate Token function.

[0097] Edge 65 is the edge that runs from node 61, which supports the Disable Transfer function, to node 62, which supports the Arbitrary Transfer function. Edge 65 corresponds to the fact that the Disable Transfer function is related to the Arbitrary Transfer function, and more specifically, it corresponds to the fact that the Arbitrary Transfer function is executed after the Disable Transfer function has been executed.

[0098] Edge 66 is the edge from node 61, which supports the Disable Transfer function, to node 63, which supports the Generate Token function. Edge 66 corresponds to the fact that the Disable Transfer function is related to the Generate Token function, and more specifically, it corresponds to the fact that the Generate Token function is executed after the Disable Transfer function has been executed.

[0099] The graph shown in Figure 11, as a whole, corresponds to the contract code in which the Arbitrary Transfer function and the Generate Token function are executed after the Disable Transfer function is executed, and therefore corresponds to the contract code in which the trading function is executed after the trading restriction function is executed.

[0100] Furthermore, the graph shown in Figure 11, which includes nodes 61 and 62 and edge 65 (in other words, a graph that does not include node 63 and edge 66) (not shown), or the graph shown in Figure 11, which includes nodes 61 and 63 and edge 66 (in other words, a graph that does not include node 62 and edge 65) (corresponding to Figure 7), also corresponds to the contract code that executes the trading function after the trading restriction function has been executed.

[0101] Figure 12 is an explanatory diagram showing a sixth example of a graph in which the information processing device 10 in this embodiment detects contract code that causes a backdoor attack.

[0102] The graph shown in Figure 12 includes nodes 71, 72, and 73, and edges 75 and 76.

[0103] Node 71 is the node that supports the Frozen Account function.

[0104] Node 72 is a node that supports the Arbitrary Transfer function.

[0105] Node 73 is a node that supports the Generate Token function.

[0106] Edge 75 is the edge from node 71, which supports the Frozen Account function, to node 72, which supports the Arbitrary Transfer function. Edge 75 corresponds to the fact that the Frozen Account function is related to the Arbitrary Transfer function, and more specifically, it corresponds to the fact that the Arbitrary Transfer function is executed after the Frozen Account function has been executed.

[0107] Edge 76 is the edge from node 71, which supports the Frozen Account function, to node 73, which supports the Generate Token function. Edge 76 corresponds to the fact that the Frozen Account function is related to the Generate Token function, and more specifically, it corresponds to the fact that the Generate Token function is executed after the Frozen Account function has been executed.

[0108] The graph shown in Figure 12, as a whole, corresponds to the contract code that executes the Arbitrary Transfer and Generate Token functions after the Frozen Account function has been executed, and therefore corresponds to the contract code that executes the trading function after the trading restriction function has been executed.

[0109] Furthermore, the graphs shown in Figure 12, including nodes 71 and 72 and edge 75 (in other words, graphs that do not include node 73 and edge 76) (not shown), or the graphs shown in Figure 12, including nodes 71 and 73 and edge 76 (in other words, graphs that do not include node 72 and edge 75) (not shown), also correspond to contract code that executes the trading function after the trading restriction function has been executed.

[0110] In the following, we will explain the case in which the backdoor attack detection technique (also called the comparative technique) shown in Non-Patent Document 1 detects that a backdoor attack may occur based on the fact that the target code contains code that executes the Frozen Account function.

[0111] In comparative technology, the conditions for detecting contract code that executes the Frozen Account function are that all of the following (1) to (3) are met.

[0112] (1) The argument consists of two parts: the address of the account to be frozen and a boolean value indicating the frozen status.

[0113] (2) A boolean value is associated with the above address within the function.

[0114] (3) The function must be executable only by the contract creator.

[0115] Figure 13 is an explanatory diagram showing the first example of contract code in the comparative technology. The contract code shown in Figure 13 is an example implementation of the freezeAccount function. Since the freezeAccount function shown in Figure 13 is an example of a function that executes the Frozen Account function, it is reasonable to detect the contract code of the freezeAccount function shown in Figure 13 as contract code that executes a backdoor attack.

[0116] The freezeAccount function shown in Figure 13 satisfies condition (1) above because its arguments are the address of the account to be frozen (i.e., address target) and a boolean value indicating the frozen state (i.e., boolean freeze).

[0117] Furthermore, the above condition (2) is satisfied because the boolean value "freeze" is assigned to the address to be frozen within the freezeAccount function shown in Figure 13.

[0118] Furthermore, since the declaration of the freezeAccount function shown in Figure 13 includes the modifier "onlyOwner", it is a function that can only be executed by the contract creator, and therefore condition (3) above is satisfied.

[0119] Based on the above, the code for the freezeAccount function shown in Figure 13 is detected as contract code that executes the Frozen Account function.

[0120] Figure 14 is an explanatory diagram showing a second example of contract code in the comparative technology.

[0121] The contract code shown in Figure 14 is an example implementation of the excludeFromFees function, which is part of the account management function that makes token transfer fees free. Since the excludeFromFees function shown in Figure 14 is an example of processing in the legitimate operation of crypto assets, it is reasonable that the contract code for the excludeFromFees function shown in Figure 14 will not be detected as contract code that executes a backdoor attack.

[0122] The excludeFromFees function shown in Figure 14 satisfies condition (1) above because its arguments consist of two parts: the address of the account to be frozen (i.e., address account) and a boolean value indicating the frozen status (i.e., boolean excluded).

[0123] Furthermore, the above condition (2) is satisfied because the boolean value "excluded" is assigned to the address to be frozen within the excludeFromFees function shown in Figure 14.

[0124] Furthermore, since the declaration of the excludeFromFees function shown in Figure 14 includes the modifier "only Owner", it is a function that can only be executed by the contract creator, and therefore condition (3) above is satisfied.

[0125] Based on the above, the code shown in Figure 14 is detected as code that executes a backdoor attack. As stated above, the contract code of the excludeFromFees function shown in Figure 14 is not contract code that executes a backdoor attack, so the detection of the code shown in Figure 14 as code that executes a backdoor attack is a false positive.

[0126] As shown in Figures 13 and 14, comparative techniques can sometimes mistakenly identify code that performs functions included in the normal operation (in other words, legitimate operation) of a crypto asset as code that performs a backdoor attack.

[0127] In contrast, the information processing device 10 of this embodiment can appropriately detect contract code that executes a backdoor attack by checking the contract code on the condition that it includes contract code that executes a second function after the execution of a first function, thus contributing to the detection of code that executes a backdoor attack with higher accuracy.

[0128] In the above embodiment, each component may be implemented by dedicated hardware or by executing a software program suitable for each component. Each component may also be implemented by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the software that implements the information processing device, etc., of the above embodiment is the following program.

[0129] In other words, this program is a program that causes a computer to execute an information processing method that obtains a first contract code for a smart contract for trading crypto assets, determines whether the first contract code contains a second contract code that causes a computer constituting a distributed ledger system to execute a first function that restricts the first trading of the crypto assets, and then causes the computer to execute a second function that performs a second trading of the crypto assets, and outputs information indicating the result of the determination.

[0130] Although the information processing method and the like according to one or more embodiments have been described above based on embodiments, the present invention is not limited to these embodiments. Without departing from the spirit of the present invention, various modifications that a person skilled in the art can conceive of may be applied to these embodiments, and forms constructed by combining components from different embodiments may also be included within the scope of one or more embodiments.

[0131] This invention can be used in information processing equipment that detects code used to execute cyberattacks.

[0132] 10 Information processing device 11 Acquisition unit 12 Determination unit 13 Output unit 30 Contract code 31, 32 Codes 41, 42, 51, 52, 53, 61, 62, 63, 71, 72, 73 Nodes 45, 55, 56, 65, 66, 75, 76 Edges

Claims

1. An information processing method that obtains a first contract code for a smart contract for trading crypto assets, determines whether the first contract code contains a second contract code that causes a computer constituting a distributed ledger system to execute a first function that restricts the first trading of the crypto assets, and then causes the computer to execute a second function that performs a second trading of the crypto assets, and outputs information indicating the result of the determination.

2. The information processing method according to claim 1, wherein the first function includes a function to destroy the crypto asset, a function to stop the transfer of the crypto asset, or a function to freeze the account for the crypto asset, and the second function includes a function to transfer the crypto asset, or a function to generate the crypto asset.

3. The information processing method according to claim 1, wherein the determination includes determining whether a first code for causing the computer to execute the first function is included in the first contract code, and if it is determined that the first code is included in the first contract code, it determines whether a second code for causing the computer to execute the second function after the first function has been executed is included in the first contract code, and if it is determined that the second code is included in the first contract code, it determines that the first contract code includes the second contract code.

4. The information processing method according to claim 1, wherein the determination involves converting the first contract code into a first graph including nodes representing one or more functions expressed by the first contract code and edges indicating the execution order of the one or more functions; determining whether the second function is executed after the first function is executed using the connection relationships of the nodes and edges in the first graph; and determining that the first contract code includes the second contract code if it is determined that the second function is executed after the first function is executed.

5. An information processing device comprising a processor and a memory connected to the processor, wherein the processor uses the memory to obtain a first contract code of a smart contract for trading crypto assets, determines whether the first contract code includes a second contract code that causes a computer constituting a distributed ledger system to execute a first function that restricts the first trading of the crypto assets, and then causes the computer to execute a second function that performs a second trading of the crypto assets, and outputs information indicating the result of the determination.

6. A program that causes an information processing device to execute the information processing method described in claim 1.

Images