A Novel Smart Contract Vulnerability Detection Method Based on Information Graph and Ensemble Learning

Sensors

Chunhui Zhao¹  Jinlong Wang²  Lejun Zhang²  Weizheng Wang³  Zhennao Cai⁴  Huiling Chen⁴  Zilong Jin⁵ 

[1]College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China

[2]College of Information Engineering, Yangzhou University, Yangzhou 225127, China

[3]Computer Science Department, City University of Hong Kong, Kowloon Tong, Hong Kong

[4]Department of Computer Science and Artificial Intelligence, Wenzhou University, Wenzhou 325035, China

[5]School of Computer and Software, Nanjing University of Information Science and Technology, Nanjing 210044, China

关键词: smart contract;    vulnerability detection;    blockchain security;    operation flow;    Ensemble Learning;    information graph;   

DOI  :  10.3390/s22093581

来源: DOAJ

【 摘 要 】

Blockchain presents a chance to address the security and privacy issues of the Internet of Things; however, blockchain itself has certain security issues. How to accurately identify smart contract vulnerabilities is one of the key issues at hand. Most existing methods require large-scale data support to avoid overfitting; machine learning (ML) models trained on small-scale vulnerability data are often difficult to produce satisfactory results in smart contract vulnerability prediction. However, in the real world, collecting contractual vulnerability data requires huge human and time costs. To alleviate these problems, this paper proposed an ensemble learning (EL)-based contract vulnerability prediction method, which is based on seven different neural networks using contract vulnerability data for contract-level vulnerability detection. Seven neural network (NN) models were first pretrained using an information graph (IG) consisting of source datasets, which then were integrated into an ensemble model called Smart Contract Vulnerability Detection method based on Information Graph and Ensemble Learning (SCVDIE). The effectiveness of the SCVDIE model was verified using a target dataset composed of IG, and then its performances were compared with static tools and seven independent data-driven methods. The verification and comparison results show that the proposed SCVDIE method has higher accuracy and robustness than other data-driven methods in the target task of predicting smart contract vulnerabilities.

【 授权许可】

Unknown