Junjun Guo

Vulnerabilities in smart contracts may trigger serious security events, and the detection of smart contract vulnerabilities has become a significant problem. In this paper, to solve the limitations of current deep learning-based vulnerability detection methods in extracting various code critical features, using the multi-scale cascade encoder architecture as the backbone, we propose a novel Multi-Scale Encoder Vulnerability Detection (MEVD) approach to hit well-known high-risk vulnerabilities in smart contracts. Firstly, we use the gating mechanism to design a unique Surface Feature Encoder (SFE) to enrich the semantic information of code features. Then, by combining a Base Transformer Encoder (BTE) and a Detail CNN Encoder (DCE), we introduce a dual-branch encoder to capture the global structure and local detail features of the smart contract code, respectively. Finally, to focus the model’s attention on vulnerability-related characteristics, we employ the Deep Residual Shrinkage Network (DRSN). Experimental results on three types of high-risk vulnerability datasets demonstrate performance compared to state-of-the-art methods, and our method achieves an average detection accuracy of 90%.

Vulnerabilities in smart contracts may trigger serious security events, and the detection of smart contract vulnerabilities has become a significant problem. In this paper, by using the multi-scale cascade encoder architecture as the backbone, we propose a novel Multi-scale Encoder Vulnerability Detection (MEVD) approach to detect well-known high-risk vulnerabilities in smart contracts. Firstly, we use the gating mechanism to design a unique Surface Feature Encoder (SFE) to enrich the semantic information of code features. Then, by combining a Base Transformer Encoder (BTE) and a Detail CNN Encoder (DCE), we introduce a dual-branch encoder to capture the global structure and local detail features of the smart contract code, respectively. Finally, to focus the model's attention on vulnerability-related characteristics, we employ the Deep Residual Shrinkage Network (DRSN). Experimental results on three types of high-risk vulnerability datasets demonstrate performance compared to state-of-the-art methods, and our method achieves an average detection accuracy of 90%.

Vulnerability detection technology has become a hotspot in the field of software security, and most of the current methods do not have a complete consideration during code characterizing, which leads to problems such as information loss. Therefore, this paper proposes one class of Scalable Feature Network (SFN), a composite feature extraction method based on Continuous Bag of Words and Convolutional Neural Network. In addition, to characterize the source code more comprehensively, we construct multiscale code metrics in terms of semantic-, line-, and function granularity. In order to verify the effectiveness of the SFN, this paper builds a Scalable Vulnerability Detection Model (SVDM) by combining SFN with Bi-LSTM. The experimental results show that the proposed SVDM can obtain precision over 84.3 and recall at 83.4, respectively, while both FNR and FPR are less than 17.

With the rapid growth of open‐source software, code cloning has become increasingly prevalent. If there are security vulnerabilities in a cloned code segment, those vulnerabilities may spread in the related software to potentially lead to security incidents. The existing methods of vulnerable code detection are performed on the condition that the source code is converted into an intermediate representation. However, these methods do not fully consider the rich semantic knowledge and patch information available for vulnerable codes, which can induce a high false positive rate (FPR). To address this problem, this paper proposes a vulnerable code clone detection method based on code fingerprints, named the Context‐enhanced and Patch‐validation‐based Vulnerable code clone Detector (CPVDetector). A fingerprint database is built for functions, code snippets, and patches derived from preprocessed vulnerable source code. The target code to be detected is firstly transformed into function‐level fingerprints. If clone detection fails at this coarse granularity, the detector is then applied at the finer line‐level granularity. When fingerprint matching is successful between the target code and the vulnerable code segments, the detector will proceed to verify the context of vulnerable codes. Finally, CPVDetector can verify the fingerprints of patches corresponding to vulnerable codes to further reduce the FPR. Based on the generally accepted classification of code clones, CPVDetector can identify Type 1 and Type 2 vulnerable code clones at the coarse‐grained level and offers significantly improved detection sensitivity for Type 3 and Type 4 code clones at the fine‐grained level. Experimental results show that the proposed method can achieve high accuracy with a fast detection speed, and the FPR is as low as 2.35%, which is less than one‐third of that of other existing methods. In view of its competitive performance and efficiency, CPVDetector can be applied in large‐scale vulnerable code detection scenarios.

Vulnerabilities can have very serious consequences for information security, with huge implications for economic, social, and even national security. Automated vulnerability detection has always been a keen topic for researchers. From traditional manual vulnerability mining to static detection and dynamic detection, all rely on human experts to define features. The rapid development of machine learning and deep learning has alleviated the tedious task of manually defining features by human experts while reducing the lack of objectivity caused by human subjective awareness. However, we still need to find an objective characterization method to define the features of vulnerabilities. Therefore, we use code metrics for code characterization, which are sequences of metrics that represent code. To use code metrics for vulnerability detection, we propose VulnExplore, a deep learning-based vulnerability detection model that uses a composite neural network of CNN + LSTM for feature extraction and learning of code metrics. Experimental results show that VulnExplore has a lower false positive rate, a lower miss rate, and a better accuracy rate compared to other deep learning-based vulnerability detection models.