CN112115326B - A multi-label classification and vulnerability detection method for Ethereum smart contracts - Google Patents

Abstract

The invention provides a multi-label classification and vulnerability detection method for an Ether house intelligent contract. The method comprises the following steps: forming a sample data set by using the verified intelligent contract, extracting the characteristics of the samples in the sample data set, and expressing the samples by using the characteristic vector; training various multi-label classification models based on the feature vectors of the samples, evaluating the classification effect of the multi-label classification models, and selecting the multi-label classification model with the best classification effect; and inputting the Ether house intelligent contracts to be classified into the selected multi-label classification model, and outputting the vulnerability detection results of the Ether house intelligent contracts to be classified by the multi-label classification model. The method realizes automatic and efficient detection of the intelligent contract vulnerability of the Etheng by extracting the static characteristics and utilizing the machine learning algorithm, and is more suitable for application scenes of large-batch contract vulnerability detection.

Description

A multi-label classification and vulnerability detection method for Ethereum smart contracts

technical field

The invention relates to the technical field of distributed application vulnerability detection of blockchain, in particular to a multi-label classification and vulnerability detection method of an Ethereum smart contract.

Background technique

With the development of social economy and a new round of technological changes, blockchain, as an emerging technology, ensures transaction data by integrating multiple technologies, including encryption algorithms, consensus mechanisms, distributed data storage and point-to-point transmission mechanisms, etc. The untamperable and decentralized storage of the token creates a credible trading environment.

As an open public chain platform, Ethereum implements smart contract functions by supporting the decentralized Ethereum virtual machine, and then processes peer-to-peer transactions through smart contract functions. Ethereum smart contracts are widely used in many fields, such as financial services, infrastructure, Internet of Things, and healthcare, etc., which makes the industrial application value of blockchain technology gradually clear. The frequent outbreak of smart contract security incidents in recent years has not only resulted in huge economic losses, but also seriously reduced people's trust in blockchain smart contracts.

At present, the main methods of smart contract vulnerability detection include formal verification, symbolic execution or symbolic analysis, and fuzzing. However, formal verification has the disadvantage that it cannot be fully automated; symbolic execution or symbolic analysis often needs to explore all executable paths in the contract or symbolically analyze the dependency graph in the contract, so the time overhead is large and the execution efficiency is low, which is not suitable for Large-scale contract vulnerability detection; the test samples generated by the fuzzing method have strong randomness, which easily leads to low code coverage, and often cannot effectively detect all the vulnerabilities in the smart contract code, and also has the disadvantage of a long detection cycle. Faced with the ever-increasing number of smart contracts, existing methods are overwhelmed.

Machine learning is a multi-domain interdisciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in how computers simulate or realize human learning behaviors to acquire new knowledge or skills, and to reorganize existing knowledge structures to continuously improve their performance. In recent years, machine learning algorithms have been widely used in various fields.

Therefore, it is of great practical significance to use machine learning technology to develop an accurate and efficient vulnerability detection method for Ethereum smart contracts.

SUMMARY OF THE INVENTION

The implementation of the present invention provides a vulnerability detection method for Ethereum smart contracts, so as to realize accurate and efficient classification and vulnerability detection of Ethereum smart contracts.

In order to achieve the above objects, the present invention adopts the following technical solutions.

A vulnerability detection method for an Ethereum smart contract, including:

Use verified smart contracts to form a sample data set, extract features from the samples in the sample data set, and use feature vectors to represent the samples;

Train various multi-label classification models based on the feature vector of each sample, evaluate the classification effect of each multi-label classification model, and select the multi-label classification model with the best classification effect;

Input the Ethereum smart contract to be classified into the selected multi-label classification model, and the multi-label classification model outputs the vulnerability detection result of the Ethereum smart contract to be classified.

Preferably, the use of verified smart contracts to form a sample data set includes:

Crawl a certain amount of verified smart contract data from the Etherscan website, and use all the smart contract data to form a sample data set.

Preferably, the feature extraction is performed on the samples in the sample data set, and a feature vector is used to represent the samples, including:

Calibrate whether the samples in the sample data set have loopholes, and further refine and classify the loopholes;

By compiling and analyzing the bytecode of the contract source code of the sample after vulnerability calibration, the Solidity high-level language for writing smart contracts is converted into an opcode stream, and the opcode stream of the sample is abstracted using the set opcode abstraction rules. , using the n-gram algorithm to divide the abstract opcode data stream into a series of bigram feature segments, and extract a total of 1619-dimensional bigram features for all bigram feature segments;

Calculate the eigenvalues of the bigram feature by defining the feature calculation formula, form all the eigenvalues into a feature set, format the feature set into a vector format, and obtain the feature vector set of the sample, each eigenvector represents a sample, and each eigenvector represents a sample. The feature vector contains the classification and feature data of the sample.

Preferably, the calibration is performed on whether the samples in the sample data set have loopholes, and the samples with loopholes are further refined and classified, including:

Use Oyente, Securify and Mythril to scan the contract source code of the samples in the sample data set, determine whether the contract source code has loopholes, and what kinds of loopholes it has, get the preliminary data calibration results of the sample, and calibrate the contract source code of the samples with loopholes. By writing a contract transaction test case and deploying the debug transaction in the Remix IDE, verify whether the contract has loopholes, and obtain the data calibration results of the refined classification of the sample.

Preferably, the set opcode abstraction rules include: the opcode abstraction rules shown in Table 2:

Table 2 Opcode abstraction rules

Preferably, various multi-label classification models are trained based on the feature vector of each sample, the classification effect of each multi-label classification model is evaluated, and the multi-label classification model with the best classification effect is selected, including:

Based on the feature vector data of each sample, a machine learning classification algorithm is used to train each multi-label classification model of the sample. The various multi-label classification models include XGBoost, AdaBoost, random forest, support vector machine and k-nearest neighbors. Multi-label classification of 5 kinds of samples Model, the feature vector of each sample is input into the multi-label classification model of each sample, and the multi-label classification model of each sample outputs the classification results of whether the sample has loopholes and what kinds of loopholes it has. The loopholes of the samples include integer underflow. Vulnerability, integer overflow vulnerability, transaction order dependency vulnerability, timestamp dependency vulnerability, return value vulnerability and code reentrancy vulnerability;

Through micro-F1, macro-F1 and F1-score evaluation indicators, the classification results of the samples output by each multi-label classification model are compared with the refined classification results of the vulnerabilities of the samples, and the classification effect of each multi-label classification model is compared according to the comparison results. For evaluation, select the multi-label classification model with the best classification effect after training.

Preferably, the classification result of whether the sample has a vulnerability and what kinds of vulnerabilities it has are represented by a classification label, each item in the classification label represents a type of vulnerability, and the value of each item is 1 to represent that type of vulnerability, which is 0 means no such vulnerability.

It can be seen from the technical solutions provided by the above embodiments of the present invention that the multi-label classification and vulnerability detection method proposed by the embodiments of the present invention realizes accurate and efficient automatic detection of six types of contract vulnerabilities by extracting static features and utilizing machine learning algorithms. This method is more suitable for application scenarios of large-scale contract vulnerability detection.

Additional aspects and advantages of the present invention will be set forth in part in the following description, which will be apparent from the following description, or may be learned by practice of the present invention.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

FIG. 1 is a process flow chart of a method for detecting vulnerabilities in an Ethereum smart contract based on a machine learning algorithm provided by an embodiment of the present invention.

Detailed ways

Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals refer to the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but not to be construed as a limitation of the present invention.

It will be understood by those skilled in the art that the singular forms "a", "an", "the" and "the" as used herein can include the plural forms as well, unless expressly stated otherwise. It should be further understood that the word "comprising" used in the description of the present invention refers to the presence of stated features, integers, steps, operations, elements and/or components, but does not exclude the presence or addition of one or more other features, Integers, steps, operations, elements, components and/or groups thereof. It will be understood that when we refer to an element as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may also be present. Furthermore, "connected" or "coupled" as used herein may include wirelessly connected or coupled. As used herein, the term "and/or" includes any and all combinations of one or more of the associated listed items.

It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and, unless defined as herein, are not to be taken in an idealized or overly formal sense. explain.

In order to facilitate the understanding of the embodiments of the present invention, the following will take several specific embodiments as examples for further explanation and description in conjunction with the accompanying drawings, and each embodiment does not constitute a limitation to the embodiments of the present invention.

The embodiment of the present invention provides an automatic detection method for Ethereum smart contract vulnerabilities based on a machine learning algorithm, which can make full use of the advantages of the machine learning algorithm and improve the detection efficiency. The present invention adopts a more comprehensive feature set, so it can effectively describe the static characteristics of the contract.

The processing flow of a method for detecting vulnerabilities in an Ethereum smart contract based on a machine learning algorithm provided by the present invention is shown in Figure 1, including the following processing steps:

Step S110: Crawl the verified smart contract data from the Etherscan website, and use the smart contract data to form a sample data set.

Etherscan is one of the most famous Ethereum browsers with the domain name etherscan.io. It is essentially a search engine that allows users to find, confirm and verify transactions on the Ethereum distributed smart contract platform. There are a large number of open source smart contract codes on Etherscan, including the source code of smart contracts, the corresponding Token name and Solidity version and other useful information, which provides convenience for researchers to study the blockchain. However, Etherscan does not provide a public smart contract download interface, and requires scripting to crawl. In practice, we scraped 49,502 Ethereum smart contract data.

The embodiment of the present invention crawls verified smart contract data from the Etherscan website, and uses the smart contract data to form a sample data set.

Step S120: Calibrate whether the samples in the sample data set have loopholes, and further refine and classify the samples with loopholes.

(1) Sample calibration

First, scan the contract source code of the sample in the sample data set with three tools, Oyente, Securify and Mythril, to determine whether the contract source code has loopholes, and what kinds of loopholes it has, and obtain the preliminary data calibration results of the sample. Then, the contract source code of the sample with loopholes is calibrated by writing a contract transaction test case, and deploying the debugging transaction in the Remix IDE, and manually verifying whether the contract has loopholes, so as to obtain the final data calibration results of the samples shown in Table 1.

Table 1. Refinement category calibration of vulnerable samples

Numbering Vulnerability Type Number of samples 1 Integer Overflow Vulnerability (C₁) 22128 2 Integer underflow vulnerability (C₂) 9699 3 Transaction Order Dependency Vulnerability (C₃) 1436 4 Unchecked Return Value Vulnerability (C₄) 192 5 Timestamp dependency vulnerability (C₅) 477 6 Code reentrancy vulnerability (C₆) 100

Step S130: Perform feature extraction on the sample to obtain the static feature of the opcode.

By compiling the contract source code of the sample and parsing the bytecode, the Solidity high-level language for writing smart contracts is converted into an opcode stream, and then the opcode abstraction rules shown in Table 2 are used to abstract the opcode stream, avoiding the need for Dimensional disaster caused by too many features. Then, the abstract opcode data stream is divided into a series of bigram feature segments by the n-gram algorithm, and a total of 1619-dimensional bigram features are extracted from all bigram feature segments to describe the behavior of the sample. Then, the eigenvalues of the bigram feature are calculated by defining the feature calculation formula, and all the eigenvalues are formed into a feature set.

Table 2 Opcode abstraction rules

Step S140: Vectorize the feature set, and use the feature vector to represent the application sample.

The above feature set is formatted into a vector format to obtain a feature vector set of the sample. Each feature vector represents a sample, and each feature vector contains the classification and feature data of the sample.

Step S150: Based on the feature vector set of the samples, various multi-label classification models are trained, the classification effect of each multi-label classification model is evaluated, and the trained multi-label classification model with the best classification effect is selected.

The feature vector data in the sample-based feature vector set adopts the machine learning classification algorithm, trains the multi-label classification model of the sample, and uses the multi-label classification model to discriminate whether the sample has loopholes and which kinds of loopholes it has. In the present invention, five kinds of multi-label classification models of samples including XGBoost, AdaBoost, Random Forest (RF), Support Vector Machine (SVM) and K-Nearest Neighbor (KNN) are adopted, and the feature vector sets of the above samples are respectively input into each In the multi-label classification model of the sample, the multi-label classification model of each sample outputs the classification results of whether the sample has loopholes and which kinds of loopholes it has. The loopholes of the samples include integer underflow vulnerability, integer overflow vulnerability, transaction order dependency vulnerability, Timestamp dependency vulnerability, return value vulnerability and code reentrancy vulnerability, etc. The above classification result can be represented by a classification label. Each item in the classification label represents a type of vulnerability, and the value of each item is 1 to represent the vulnerability, and 0 to represent the vulnerability. For example, if a smart contract is classified as [0, 1, 1, 0, 1, 0], it means that the contract has integer underflow vulnerability, transaction order dependency vulnerability and timestamp dependency vulnerability, and does not have integer overflow vulnerability, Unchecked return value vulnerabilities and code reentrancy vulnerabilities.

Then, through the micro-F1, macro-F1 and F1-score evaluation indicators, the classification results of the samples output by each multi-label classification model are compared with the refined classification results of the vulnerabilities of the samples. The classification effect is evaluated, and the trained multi-label classification model with the best classification effect is selected.

After experimental verification, as shown in Table 3, the detection of smart contract vulnerabilities based on the XGBoost multi-label classification model is the best. As shown in Table 4, the XGBoost multi-label classification model takes about 4 seconds to detect a contract, Oyente takes about 28 seconds, and Securify takes about 18 seconds. It can be seen that the accuracy and efficiency of the XGBoost multi-label classification model for contract vulnerability detection is more suitable for the application scenario of large-scale detection of smart contract vulnerabilities.

Table 3 Classification performance comparison of five classification models

Table 4 XGBoost multi-label classification model, Oyente and Securify vulnerability detection time comparison

Step S160: Input the Ethereum smart contract to be classified into the trained multi-label classification model with the best classification effect, and the multi-label classification model outputs the vulnerability detection result of the Ethereum smart contract to be classified, the vulnerability detection result Including those vulnerabilities that Ethereum smart contracts have or do not have, the vulnerabilities include integer underflow vulnerability, integer overflow vulnerability, transaction order dependency vulnerability, timestamp dependency vulnerability, return value vulnerability and code reentrancy vulnerability.

To sum up, the multi-label classification and vulnerability detection method proposed in the embodiment of the present invention realizes accurate and efficient automatic detection of 6 types of contract vulnerabilities by extracting static features and using machine learning algorithms. This method is more suitable for large-scale contracts. Application scenarios of vulnerability detection.

The present invention proposes the static features of the Ethereum smart contract for the first time and applies these static features for the first time to the detection of contract vulnerabilities. The machine learning algorithm is used to automatically detect the vulnerabilities of the Ethereum smart contracts, so as to realize the automatic and efficient detection of the vulnerabilities of the Ethereum smart contracts. This method is more suitable for application scenarios of large-scale contract vulnerability detection.

Those of ordinary skill in the art can understand that the accompanying drawing is only a schematic diagram of an embodiment, and the modules or processes in the accompanying drawing are not necessarily necessary to implement the present invention.

From the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art. The computer software products can be stored in storage media, such as ROM/RAM, magnetic disks, etc. , CD, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of the present invention.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the apparatus or system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and reference may be made to some descriptions of the method embodiments for related parts. The apparatus and system embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, It can be located in one place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

The above description is only a preferred embodiment of the present invention, but the protection scope of the present invention is not limited to this. Substitutions should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims (4)

1. A vulnerability detection method for an Ethernet intelligent contract is characterized by comprising the following steps:

forming a sample data set by using the verified intelligent contract, extracting the characteristics of the samples in the sample data set, and expressing the samples by using the characteristic vector;

training various multi-label classification models based on the feature vectors of the samples, evaluating the classification effect of the multi-label classification models, and selecting the multi-label classification model with the best classification effect;

inputting the Ether house intelligent contracts to be classified into a selected multi-label classification model, and outputting the vulnerability detection results of the Ether house intelligent contracts to be classified by the multi-label classification model;

the performing feature extraction on the samples in the sample data set, using the feature vector to represent the samples, includes:

calibrating whether the samples in the sample data set have the holes or not, and further performing detailed classification on the samples with the holes;

compiling and byte code analyzing contract source codes of samples after vulnerability calibration, converting a Solidity high-level language for compiling an intelligent contract into an operation code stream, abstracting the operation code stream of the samples by using a set operation code abstraction rule, segmenting the abstracted operation code data stream into a series of bigram characteristic segments by adopting an n-gram algorithm, and extracting 1619-dimensional bigram characteristics from all bigram characteristic segments;

Calculating the characteristic values of bigram characteristics by defining a characteristic calculation formula, forming a characteristic set by all the characteristic values, formatting the characteristic set into a vector format to obtain a characteristic vector set of samples, wherein each characteristic vector represents one sample, and each characteristic vector comprises the classification and characteristic data of the sample;

the calibrating of the samples with the holes in the sample data set and the further refining and classifying of the samples with the holes comprise:

scanning a contract source code of a sample in a sample data set through an OYETE tool, a Security tool and a Mythril tool, judging whether the contract source code has a bug and what kinds of bugs, obtaining a preliminary data calibration result of the sample, compiling a contract transaction test case for the contract source code of the sample with the bug calibrated, deploying debugging transaction in a Remix IDE, verifying whether the contract has the bug, and obtaining a data calibration result of the sample in a refined classification mode;

the method comprises the following steps of training various multi-label classification models based on the characteristic vectors of all samples, evaluating the classification effect of each multi-label classification model, and selecting the multi-label classification model with the best classification effect, wherein the method comprises the following steps:

Training each multi-label classification model of the samples by adopting a machine learning classification algorithm based on feature vector data of each sample, wherein each multi-label classification model comprises XGboost, Adaboost, random forest, a multi-label classification model supporting a vector machine and 5 types of k adjacent samples, respectively inputting the feature vector of each sample into the multi-label classification model of each sample, outputting whether the sample has a vulnerability and classification results of which types of vulnerabilities by the multi-label classification model of each sample, and the vulnerabilities of the samples comprise integer underflow vulnerabilities, integer overflow vulnerabilities, transaction sequence dependence vulnerabilities, timestamp dependence vulnerabilities, return value vulnerabilities and code reentry vulnerabilities;

and comparing the classification result of the sample output by each multi-label classification model with the refined classification result of the vulnerability of the sample through micro-F1, macro-F1 and F1-score evaluation indexes, evaluating the classification effect of each multi-label classification model according to the comparison result, and selecting the multi-label classification model with the best trained classification effect.

2. The method of claim 1, wherein constructing a sample data set using the validated intelligent contract comprises:

And crawling a certain amount of verified intelligent contract data from the Etherscan website, and forming a sample data set by using all the intelligent contract data.

3. The method of claim 1, wherein the set opcode abstraction rule comprises:

4. the method of claim 1, wherein the classification of whether the sample has a vulnerability and which types of vulnerabilities are represented by classification tags, each entry in the classification tags represents a vulnerability, a value of 1 for each entry represents that the sample has a vulnerability, and a value of 0 represents that the sample does not have a vulnerability.

Images