用图神经网络分析合约函数间状态干扰,识别跨函数漏洞攻击路径。
AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling
- 构建状态干扰图,连接共享存储的函数并标注重入路径。
- 通过联合池化机制,任一防御措施到位即降低整体风险评分。
- 在多个基准上实现超90%准确率,输出可操作的修复建议。
现有基于学习的Solidity智能合约漏洞检测方法将问题简化为单个函数内的语法模式匹配,但许多重大漏洞(如The DAO、Cream Finance)并非源于单一函数,而是函数间的交互关系及多条件组合所致。为此,我们提出AttackPathGNN,一种图神经网络(GNN),将检测重构为对显式攻击路径的推理。其架构包含两项创新:(1) 状态干扰图,通过带类型、权重的边以及由五条件谓词定义的有向重入路径边,连接所有共享可变存储的函数对;(2) 联合池化,一种对八个命名漏洞前提的可微分逻辑与聚合器,其log-sigmoid形式使得只要任一缓解措施(重入防护、访问控制修饰符或SafeMath)存在,单函数漏洞得分即迅速下降。在五次独立训练中,AttackPathGNN在SmartBugs Wild测试集上达到92.3±0.2% F1(假阴性率4.3±0.3%,在独立人工标注的SmartBugs Curated基准上检测率达90.8±2.5%),在所有种子下恢复6/10 DASP10类别且每类均达100%,重入漏洞检测率达98.7±1.8%。每个预测均附带结构化修复报告,使每个判断变为可执行的函数级审计结论。
原文摘要 · Abstract (English)
Existing learning-based detectors for Solidity smart-contracts reduce vulnerability detection to syntactic pattern matching within single functions, yet many of the most consequential exploits (The DAO, Cream Finance) exist not in any individual function but in the relationship between functions and in the combination of conditions that made the attack feasible. Thus, we propose AttackPathGNN, a graph neural network (GNN) that reframes detection as reasoning over explicit attack paths. Two architectural choices distinguish it from prior GNN-based detectors: (1)a State Interference Graph that links every pair of functions sharing mutable storage through typed, weighted edges and through directed reentrancy-path edges defined by an explicit five-condition predicate; (2)conjunction pooling, a differentiable AND-aggregator over eight named exploit preconditions whose log-sigmoid form causes the per-function exploit score to collapse whenever any single mitigation (a reentrancy guard, an access-control modifier or SafeMath) is in place. Across five independent training runs, AttackPathGNN attains 92.3+/-0.2% F1 on the SmartBugs Wild held-out test partition (4.3+/-0.3% false-negative rate, 90.8+/-2.5% detection rate on the independently human-labelled SmartBugs Curated benchmark), recovering 6/10 DASP10 categories at 100% on every seed and Reentrancy at 98.7+/-1.8%. Each prediction is emitted with a structured remediation report, turning each verdict into an actionable, function-level audit finding.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。