| Since the release of the Bitcoin white paper by Satoshi Nakamoto in 2008,blockchain has been widely used as a distributed ledger technology.Nowadays,it has entered the era of "Blockchain 3.0" and has been incorporated into the "14th Five-Year Plan for Digital Economic Development" issued by the State Council.Smart contracts,as decentralized applications deployed on blockchain,help to achieve secure and efficient information storage,asset management,and value transfer.In recent years,there have been frequent security threats to blockchain smart contracts,causing huge economic losses and affecting the credit system of the blockchain.So far,many researchers have carried out research on smart contract security to varying degrees.The currently mainstream methods for detecting threats in smart contracts include symbolic execution,formal verification,and fuzzing,most of which only target specific known threats.When facing unknown threats that lack predefined vulnerability patterns,it is difficult to effectively detect them.As a result,there are still few contract security detection methods for unknown threats.Therefore,this thesis focuses on the detection of unknown threats in smart contracts.Starting from the principles of smart contract threats and considering the characteristic of smart contracts that cannot be modified after deployment,this thesis proposes a path profiling-based method for detecting and protecting against unknown threats.To address the scarcity of unknown threat samples,a threat detection method based on few-shot learning is proposed.The contributions and innovations of this thesis are as follows:1.This thesis comprehensively analyzes the principles of 20 smart contract vulnerabilities and proposes preventive measures.It also summarizes the causes of typical smart contract security events in recent years.Existing unknown threat detection methods are categorized into four types: intermediate representation,deep learning,fuzzing,and threat intelligence,and the advantages and disadvantages of specific tools are analyzed and compared.Three common threat indicators,namely threat address correlation,abnormal Gas consumption in transactions,and static bytecode features,are proposed,and the effectiveness of these threat indicators is demonstrated through experimentation.2.This thesis proposes an unknown threat detection and protection method based on path profiling.To achieve accurate tracking and protection of cyclic and acyclic paths,the profiling all paths algorithm is combined with efficient path profiling algorithm to record contract execution paths with lower Gas overhead and improve the effectiveness of threat detection and prevention.As this method instruments the smart contract source code,it can detect threats and prevent attacks after the contract is deployed.Finally,through experiments,it is demonstrated that this method can accurately detect unknown threats that trigger abnormal control flow paths with low Gas overhead.3.This thesis proposes a smart contract threat detection method based on few-shot learning.The method constructs a control flow graph by using smart contract bytecode,and simulates the execution sequence of opcodes.By combining model-agnostic meta-learning algorithm and convolutional neural network,the method only requires a small number of threat samples to achieve high accuracy in threat detection,and is able to adapt to scenarios where unknown threat samples for smart contracts are rare.Finally,the detection performance of the method in scenarios with a small number of threat samples is evaluated through experiments. |
