.png){kind=icon}
.png){kind=icon}
Return
VulFinder: Exploring Chaincode Vulnerabilities More Effectively and Efficiently Using Knowledge Graph Based Defect Pattern Matching
.png){kind=icon}
PRE
AI
DOI：10.1109/TSE.2025.3605379.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Hyperledger Fabric is an open-source project of Linux Foundation, it is a modular blockchain framework and has become an unofficial standard for enterprise blockchain platforms. In Hyperledger Fabric, smart contract is also known as chaincode, which are usually written using general-purpose languages, including Go, Java or Node.js etc. Although there are some vulnerability detection methods for Java and Node.js, there are very few vulnerability detection methods for Go, especially when it is used as a smart contract programming language in Hyperledger Fabric. In this article, we propose a knowledge graph based defect pattern matching method and develop a tool called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">VulFinder</i> to detect vulnerabilities in chaincode, i.e. the smart contracts written using Go language. Knowledge graph is used because it can fully retain the syntax and logic information of smart contracts. The method consists of two key steps: a knowledge graph is constructed from <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Go language specification</i> and chaincode source code, including the definition of ontology layer and the construction of instance layer; the defect patterns are defined and SPARQL query statements are used to match and locate vulnerabilities on the knowledge graph. To evaluate the detection effectiveness and efficiency of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">VulFinder</i>, we construct two datasets through manual analysis and vulnerabilities injection due to the lack of public datasets. Experimental results show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">VulFinder</i> can detect 22 kinds of typical vulnerabilities of chaincode effectively, and the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">recall</i> is as high as 98.87%, while the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">false negative rate</i> is as low as 1.13%.
Keywords:
Hyperledger fabric
chaincode
vulnerability detection
knowledge graph
Journal
IF:
5.6
Papers:
2.8K
Citations:
1.1W