[论文解读] ESCORT: Ethereum Smart COntRacTs Vulnerability Detection using Deep Neural Network and Transfer Learning

O. Lutz, Huili Chen+5 more|arXiv (Cornell University)|Mar 23, 2021

Blockchain Technology Applications and Security参考文献 53被引用 32

一句话总结

ESCORT 引入一个多输出深度神经网络框架，能够从字节码检测以太坊智能合约中的多种漏洞，并通过迁移学习高效添加新漏洞类型。

ABSTRACT

Ethereum smart contracts are automated decentralized applications on the blockchain that describe the terms of the agreement between buyers and sellers, reducing the need for trusted intermediaries and arbitration. However, the deployment of smart contracts introduces new attack vectors into the cryptocurrency systems. In particular, programming flaws in smart contracts can be and have already been exploited to gain enormous financial profits. It is thus an emerging yet crucial issue to detect vulnerabilities of different classes in contracts in an efficient manner. Existing machine learning-based vulnerability detection methods are limited and only inspect whether the smart contract is vulnerable, or train individual classifiers for each specific vulnerability, or demonstrate multi-class vulnerability detection without extensibility consideration. To overcome the scalability and generalization limitations of existing works, we propose ESCORT, the first Deep Neural Network (DNN)-based vulnerability detection framework for Ethereum smart contracts that support lightweight transfer learning on unseen security vulnerabilities, thus is extensible and generalizable. ESCORT leverages a multi-output NN architecture that consists of two parts: (i) A common feature extractor that learns the semantics of the input contract; (ii) Multiple branch structures where each branch learns a specific vulnerability type based on features obtained from the feature extractor. Experimental results show that ESCORT achieves an average F1-score of 95% on six vulnerability types and the detection time is 0.02 seconds per contract. When extended to new vulnerability types, ESCORT yields an average F1-score of 93%. To the best of our knowledge, ESCORT is the first framework that enables transfer learning on new vulnerability types with minimal modification of the DNN model architecture and re-training overhead.

研究动机与目标

• 高效检测以太坊智能合约中多种漏洞类型的动机。
• 开发一个可扩展、能够在无源代码访问的前提下对字节码进行处理的DNN框架。
• 实现迁移学习，使在最小重新训练下就能纳入新的漏洞类型。
• 为每种漏洞提供概率输出，以提升可解释性。

提出的方法

• 提出一个多输出DNN，具有共享特征提取器（主干）和针对每种漏洞的分支（头）。
• 使用嵌入层处理较长的合约字节码，并使用GRU/LSTM层来捕获序列语义。
• 每个漏洞分支输出其类型的sigmoid概率，支持多标签检测。
• 引入一种迁移学习策略，在新增漏洞分支时冻结特征提取器和现有分支，同时添加/训练新的分支以应对新漏洞。
• 在一个大型字节码数据集上进行评估，使用 Oyente、Mythril 和 Dedaub 工具对合约进行标签。
• 展示每份合约推断时间为 0.02 秒，六种类型的平均 F1 为 95%；迁移学习在新类型上实现 93% 的平均 F1。

实验结果

研究问题

• RQ1 RQ1：单个深度学习模型是否能够检测智能合约中的多种漏洞类型？
• RQ2 RQ2：是否可以通过迁移学习在最小重新训练的情况下扩展模型以涵盖新的漏洞？
• RQ3 RQ3：与现有工具相比，ESCORT 在准确性、效率和可扩展性方面的表现如何？

主要发现

• ESCORT 在六种漏洞类型上实现平均 F1 值为 95%。
• 每份合约的推断时间为 0.02 秒。
• 扩展到新漏洞类型时，ESCORT 的平均 F1 为 93%。
• ESCORT 是首个能够在几乎不修改、极少重新训练开销的情况下对新漏洞类型进行迁移学习的框架。
• 一个包含 93,497 份合约的数据集通过 Oyente、Mythril 和 Dedaub 标注，支持评估。
• 该架构通过向现有多输出模型添加新的分支实现快速扩展。