arXiv:2411.06221cs.CRcs.AI2024-11被引 26

用大模型检测智能合约漏洞并给出清晰解释,提升安全性和可读性。

Smart-LLaMA: Two-Stage Post-Training of Large Language Models for Smart Contract Vulnerability Detection and Explanation

  • 构建含详细标注的漏洞数据集,覆盖四类常见漏洞。
  • 通过合约特有预训练和解释引导微调,提升模型检测与解释能力。
  • 在真实场景中表现优于现有方法,适合开发者快速定位修复漏洞。

随着区块链技术快速发展,智能合约安全成为关键挑战。现有检测方法存在三大问题:(1)数据集质量不足,缺乏详细解释和精准漏洞定位;(2)大语言模型对智能合约领域适应性差,因多数模型基于通用文本预训练,缺少合约特定数据;(3)缺乏高质量解释,现有方法仅关注检测而无清晰说明。这些限制影响检测性能,使开发者难以快速理解并修复漏洞,可能导致重大经济损失。为此,我们提出 Smart-LLaMA,基于 LLaMA 模型的先进检测方法。首先,构建涵盖四类漏洞的综合数据集,包含标签、详细解释和精确位置标注。其次,引入智能合约特有持续预训练,利用原始合约数据让模型学习语法与语义,增强领域适应性。此外,提出解释引导微调,使用漏洞代码与解释的配对数据进行微调,实现检测与合理解释同步。通过大模型与人工评估验证解释质量,关注正确性、完整性和简洁性。实验结果表明,Smart-LLaMA 在 F1 分数上平均提升 6.49%,准确率提升 3.78%,显著优于当前最优基线,并提供可靠解释。

原文摘要 · Abstract (English)

With the rapid development of blockchain technology, smart contract security has become a critical challenge. Existing smart contract vulnerability detection methods face three main issues: (1) Insufficient quality of datasets, lacking detailed explanations and precise vulnerability locations. (2) Limited adaptability of large language models (LLMs) to the smart contract domain, as most LLMs are pre-trained on general text data but minimal smart contract-specific data. (3) Lack of high-quality explanations for detected vulnerabilities, as existing methods focus solely on detection without clear explanations. These limitations hinder detection performance and make it harder for developers to understand and fix vulnerabilities quickly, potentially leading to severe financial losses. To address these problems, we propose Smart-LLaMA, an advanced detection method based on the LLaMA language model. First, we construct a comprehensive dataset covering four vulnerability types with labels, detailed explanations, and precise vulnerability locations. Second, we introduce Smart Contract-Specific Continual Pre-Training, using raw smart contract data to enable the LLM to learn smart contract syntax and semantics, enhancing their domain adaptability. Furthermore, we propose Explanation-Guided Fine-Tuning, which fine-tunes the LLM using paired vulnerable code and explanations, enabling both vulnerability detection and reasoned explanations. We evaluate explanation quality through LLM and human evaluation, focusing on Correctness, Completeness, and Conciseness. Experimental results show that Smart-LLaMA outperforms state-of-the-art baselines, with average improvements of 6.49% in F1 score and 3.78% in accuracy, while providing reliable explanations.

智能合约漏洞检测大模型解释生成

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。