[论文解读] Vulnerability Detection in Smart Contracts: A Comprehensive Survey

Christopher De Baets, Basem Suleiman+2 more|arXiv (Cornell University)|Jul 8, 2024

Blockchain Technology Applications and Security被引用 5

一句话总结

本系统综述分析机器学习（ML）和深度学习（DL）技术如何提升智能合约的漏洞检测，比较 ML 模型与传统静态工具，并强调混合方法。

ABSTRACT

In the growing field of blockchain technology, smart contracts exist as transformative digital agreements that execute transactions autonomously in decentralised networks. However, these contracts face challenges in the form of security vulnerabilities, posing significant financial and operational risks. While traditional methods to detect and mitigate vulnerabilities in smart contracts are limited due to a lack of comprehensiveness and effectiveness, integrating advanced machine learning technologies presents an attractive approach to increasing effective vulnerability countermeasures. We endeavour to fill an important gap in the existing literature by conducting a rigorous systematic review, exploring the intersection between machine learning and smart contracts. Specifically, the study examines the potential of machine learning techniques to improve the detection and mitigation of vulnerabilities in smart contracts. We analysed 88 articles published between 2018 and 2023 from the following databases: IEEE, ACM, ScienceDirect, Scopus, and Google Scholar. The findings reveal that classical machine learning techniques, including KNN, RF, DT, XG-Boost, and SVM, outperform static tools in vulnerability detection. Moreover, multi-model approaches integrating deep learning and classical machine learning show significant improvements in precision and recall, while hybrid models employing various techniques achieve near-perfect performance in vulnerability detection accuracy. By integrating state-of-the-art solutions, this work synthesises current methods, thoroughly investigates research gaps, and suggests directions for future studies. The insights gathered from this study are intended to serve as a seminal reference for academics, industry experts, and bodies interested in leveraging machine learning to enhance smart contract security.

研究动机与目标

• 创建一个基于 ML 的智能合约漏洞检测研究的综合数据库。
• 分析并综合 ML 模型如何提升对智能合约漏洞的检测与缓解。
• 识别研究空白，并提出面向未来基于 ML 的智能合约安全研究方向。

提出的方法

• 对来自 IEEE、ACM、ScienceDirect、Scopus 和 Google Scholar 的 88 篇文章（2018–2023）进行系统性的文献综述。
• 按机器学习家族和漏洞类型对论文进行分类。
• 通过覆盖贡献、ML 技术、针对的漏洞、局限性和未来工作等要素的标准化矩阵进行数据提取。

实验结果

研究问题

• RQ1 在智能合约中识别和缓解特定漏洞的最前沿 ML 技术有哪些？
• RQ2 哪些 ML 算法已应用于智能合约漏洞检测，它们在有效性和局限性方面有何差异？
• RQ3 在将 ML 应用到智能合约漏洞检测方面，目前存在哪些研究空白和未来工作机会？

主要发现

• 经典 ML 技术（例如 KNN、RF、DT、XGBoost、SVM）在漏洞检测上优于传统静态分析工具。
• 将深度学习与经典 ML 相结合的多模型方法在精度和召回率方面取得提升。
• 采用多种技术的混合模型在漏洞检测准确性方面实现近乎完美的性能（如综述所述）。