Vulnerability-Hunter: An Adaptive Feature Perception Attention Network for Smart Contract Vulnerabilities

Yizhou Chen

2024-07-07

Abstract:Smart Contract Vulnerability Detection (SCVD) is crucial to guarantee the quality of blockchain-based systems. Graph neural networks have been shown to be effective in learning semantic representations of smart contract code and are commonly adopted by existing deep learning-based SCVD. However, the current methods still have limitations in their utilization of graph sampling or subgraph pooling based on predefined rules for extracting crucial components from structure graphs of smart contract code. These predefined rule-based strategies, typically designed using static rules or heuristics, demonstrate limited adaptability to dynamically adjust extraction strategies according to the structure and content of the graph in heterogeneous topologies of smart contract code. Consequently, these strategies may not possess universal applicability to all smart contracts, potentially leading to false positives or omissions. To address these problems, we propose AFPNet, a novel vulnerability detection model equipped with a feature perception module that has dynamic weights for comprehensive scanning of the entire smart contract code and automatic extraction of crucial code snippets (the $P$ snippets with the largest weights). Subsequently, the relationship perception attention module employs an attention mechanism to learn dependencies among these code snippets and detect smart contract vulnerabilities. The efforts made by AFPNet consistently enable the capture of crucial code snippets and enhance the performance of SCVD optimization. We conduct an evaluation of AFPNet in the several large-scale datasets with vulnerability labels. The experimental results show that our AFPNet significantly outperforms the state-of-the-art approach by 6.38\%-14.02\% in term of F1-score. The results demonstrate the effectiveness of AFPNet in dynamically extracting valuable information and vulnerability detection.

Cryptography and Security,Software Engineering

What problem does this paper attempt to address?

The paper attempts to address the limitations of existing methods in Smart Contract Vulnerability Detection (SCVD). Specifically, current graph neural network-based methods rely on predefined rules for graph sampling or subgraph pooling when extracting key components from the smart contract code structure graph. These predefined rules are usually based on static rules or heuristic methods, lacking adaptability and unable to dynamically adjust extraction strategies according to the graph's structure and content. This results in the general inadequacy of existing methods in handling smart contract codes with different topologies, potentially leading to false positives or omissions.

To address these issues, the authors propose a new model named AFPNet, which features a Feature Perception Module (FPM) and a Relationship Perception Attention Module (RPAM). FPM performs a comprehensive scan of the entire smart contract code with dynamic weights and automatically extracts key code fragments. RPAM uses an attention mechanism to learn the dependencies between these code fragments, thereby detecting smart contract vulnerabilities. Experimental results show that AFPNet significantly outperforms existing state-of-the-art methods on multiple large-scale datasets, with F1 scores improved by 6.38% to 14.02%.