CCDetector: Detect Chaincode Vulnerabilities Based on Knowledge Graph

【Author】 Xu, Xiangfei; Hu, Tianyuan; Li, Bixin; Liao, Li

【Source】2023 IEEE 47TH ANNUAL COMPUTERS, SOFTWARE, AND APPLICATIONS CONFERENCE, COMPSAC

【影响因子】

【Abstract】Chaincode is the smart contract of the well-known blockchain platform Hyperledger Fabric. It can be developed in the general-purpose programming languages, such as Go, Java and Node.js. There are many vulnerability detection tools for these languages, but few tools can detect vulnerabilities in the chaincode written in them. In this paper, we propose an approach based on knowledge graph to detect vulnerabilities in the chaincode written in Go. The approach consists of three steps: 1) Generation of AST: an AST is generated from the chaincode source code; 2) Construction of knowledge graph: a knowledge graph is constructed based on the AST, including definition of ontology layer and extraction of instance layer; 3) Detection of vulnerabilities: the vulnerabilities are detected by pattern matching in the knowledge graph, including analysis of vulnerability patterns and localization of vulnerabilities. We develop a detection tool named CCDetector and construct two datasets to evaluate the detection effectiveness and accuracy of it. Right now, CCDetector can detect 21 types of vulnerabilities with 98.52% F1-score.

【Keywords】Hyperledger Fabric; Chaincode; Vulnerability Detection; Knowledge Graph

【发表时间】2023

【收录时间】2023-10-15

【文献类型】实验仿真

【主题类别】

区块链治理-技术治理-智能合约漏洞检测