Intelligent contract vulnerability detection method based on combination of neural network and dynamic fuzzy test

Abstract

The invention discloses an intelligent contract vulnerability detection method based on combination of a neural network and a dynamic fuzzy test, and the method comprises the steps: carrying out the static analysis of intelligent contract vulnerabilities through constructing a feedforward neural network model, marking a function execution path which may have vulnerabilities, carrying out the instrumentation of the function execution path which may have vulnerabilities through employing an SIF, utilizing a look-ahead analysis method to guide a fuzzy detector to carry out dynamic fuzzy detection on a function execution path which may have vulnerabilities, constructing a feedback mechanism based on a control flow and an intelligent contract state, guiding the fuzzy detector through feedback information to generate an effective test case, and carrying out the strategic dynamic fuzzy detection. Compared with a conventional intelligent contract vulnerability detection tool, the method has the advantages that a new scheme is provided, the situations of misjudgment, missing report and the like of a traditional single static detection or dynamic analysis method are effectively improved, and the method has good practical value and good reference significance.

Description

technical field [0001] The invention belongs to the technical field of blockchain smart contract security, and in particular relates to a smart contract loophole detection method based on the combination of neural network and dynamic fuzzy testing. Background technique [0002] A smart contract is a computer protocol that disseminates, verifies or executes a contract in an informatized manner. It has quickly become the focus of the industry due to its characteristics of decentralization and no need for third-party intervention. As of now, smart contracts deployed on various blockchain platforms control more than $10 billion worth of digital currency; it is worth mentioning that smart contracts allow users to conduct digital currency transactions without third-party intervention, and These transactions are irreversible. [0003] Because smart contracts manipulate huge wealth, they are easy targets for hackers. For example, in the 2016 The DAO attack incident, the attacker u...

AI Technical Summary

Problems solved by technology

However, since most test cases are often generated randomly, the test case redundancy is high, the path coverage is low, and it is difficult to handle different execution paths in a balanced manner, such as Echidna [Echidna, a smart fuzzer for Ethereum.Trail of Bits Blog, Mar.2018] provides a complete Ethereum smart contract fuzz testing framework, which can analyze and simulate the execution of the smart contract source code, and generate random transaction data that conforms to the contract call specification to fuzz the contract. More effective seed generation strategies are not explored in depth

ContractFuzzer[Bo J, Ye L, Chan W K.ContractFuzzer:fuzzing smart contracts forvulnerability detection[C] / / the 33rd ACM / IEEE International Conference.ACM,2018.] By randomly generating call parameters, transaction amount, transaction sending address The method generates random transactions, and performs offline vulnerability detection by recording the instruction log when the smart contract is executed. However, ContractFuzzer randomly generates test cases, which cannot achieve the ideal path coverage rate and has a high false negative rate.

Images