Improving Smart Contract Vulnerability Detection With Correlation-Driven Semi-Supervised Learning

Abstract

Deep neural networks (DNNs) are one of the most effective methods available for detecting smart contract vulner-abilities (SCVs). The performance of current DNN approaches relies heavily on a large number of training samples and labels. The semi-supervised learning (SSL) trains the pseudo-labeling mechanism and performs label propagation on unlabeled data, thereby mitigating this problem. However, these approaches are not suitable for tasks related to Smart Contract Vulnerability Detection (SCVD) due to their limitations in capturing subtle faults, which are the primary causes of SCVD. We believe that subtle faults are contained in the correlation feature, which encompasses both commonalities among vulnerable contracts and differences between vulnerable and non-vulnerable contracts. Therefore, we propose a correlation-driven SSL method called Jupiter to solve this limitation. Specifically, Jupiter incorporates a contrastive learning module that conducts pairwise comparisons between smart contracts and captures correlation features. These correlation features facilitate the separation of feature distributions in vulnerable and non-vulnerable contracts. Then, a support vector machine with a built-in RBF kernel function is utilized to establish a decision boundary between the two types of contract distributions. We employ the distance from data to the decision boundary as a confidence score and propagate high-quality pseudo-labels to each unlabeled data surpassing the threshold. This process is iterated, where the labeled dataset is constructed using a combination of pseudo-labeled and reallabeled data to be re-input into the contrastive learning model until all data is labeled. Finally, the combination of semantic information and correlation features accurately detects SCVs.By conducting an empirical evaluation on a large-scale realworld dataset comprising over 40,000 smart contracts, we compare the performance of 6 state-of-the-art SSL methods and 5 state-of-the-art SCVD methods. Our findings demonstrate the effectiveness of our proposed method, Jupiter, in two key aspects: (1) Jupiter achieves optimal performance across all SSL methods, outperforming them by 18.89% to 28.42% in terms of F1- score; (2) Current state-of-the-art SCVD methods fail to deliver satisfactory results when only small amounts of labeled data are available. Specifically, these methods achieve F1-scores ranging from 49.72% to 50.98% when utilizing just 10% of the labeled data. In contrast, under the same conditions, Jupiter outperforms all baselines, achieving an F1-score of 89.28%, which represents an improvement of 75.12% to 79.56%.