Abstract
Emerging technologies like smart contracts (SCs) and blockchain promise enhanced data security, yet Ethereum-based SCs remain vulnerable to malicious attacks. Machine learning (ML) methods offer a viable alternative to traditional vulnerability detection techniques, though current approaches often rely heavily on expert knowledge and focus narrowly on known vulnerabilities. This systematic literature review (SLR) examines 55 papers (2019–2024) to classify ML-driven solutions into three categories: classical models, deep learning, and ensemble models. Key contributions include:
- Highlighting state-of-the-art ML frameworks addressing class imbalance and unknown vulnerabilities.
- Advocating for algorithmic-level solutions to mitigate bias in imbalanced datasets.
- Identifying gaps in detecting unknown vulnerabilities due to ambiguous definitions.
1. Introduction
Smart contracts automate agreements via blockchain, reducing risks and costs while improving efficiency. However, their immutability and lack of assessment standards make them prime targets for hackers. Traditional detection tools (static/dynamic analysis, symbolic execution, formal verification, fuzzy testing) suffer from manual rule dependency and inefficiency in identifying novel vulnerabilities. ML models enhance detection speed and accuracy, yet systematic reviews focusing on ML-driven SC vulnerability detection are scarce.
Key Contributions:
- Taxonomy of ML-based vulnerability detection methods.
- Evaluation of frameworks tackling class imbalance and unknown vulnerabilities.
- Open challenges for future research.
2. Preliminaries
2.1 Key Terminology
- Blockchain: Decentralized ledger technology supporting SCs.
- Ethereum: Platform enabling SC execution via Ethereum Virtual Machine (EVM).
- Smart Contracts: Self-executing agreements with deterministic/non-deterministic variants.
2.2 Vulnerability Types
| Vulnerability | Description |
|---|---|
| Reentrancy | Allows repeated function calls during execution, enabling fund theft. |
| Timestamp Dependency | Relies on block variables for critical operations or randomness. |
| Arithmetic Overflow | Mathematical results exceed storage capacity, causing unexpected behavior. |
2.3 Machine Learning Techniques
- Classical Models: SVM, Random Forest, K-NN.
- Deep Learning: CNNs, RNNs, GNNs for semantic and structural analysis.
- Ensemble Methods: Boosting, bagging, stacking for improved robustness.
2.4 Class Imbalance Solutions
- Data-Level: SMOTE, random under/over-sampling.
- Algorithm-Level: Focal loss, threshold adjustment.
- Hybrid: Combines data sampling and cost-sensitive learning.
3. Related Work
Comparative Analysis of Existing Surveys:
| Study | Focus Area | Year | Key Limitations |
|-------|-----------|------|----------------|
| [28] | SC Security | 2019 | Limited search domain clarity. |
| [35] | ML for SC Vulnerabilities | 2022 | Neglects class imbalance. |
| [38] | SC Platforms | 2023 | Lacks coverage of unknown vulnerabilities. |
Gaps Addressed by This SLR:
- Comprehensive ML-driven solution taxonomy.
- Focus on class imbalance and unknown vulnerabilities.
4. Methodology
4.1 Research Questions
- RQ1: Which ML techniques are used in vulnerability detection tools?
- RQ2: How do ML tools address class imbalance?
- RQ3: Which frameworks detect unknown vulnerabilities?
4.2 PRISMA-Based Selection
- Databases: IEEE, ScienceDirect, Springer, ACM.
- Inclusion Criteria: English articles (2019–2024), peer-reviewed.
- Final Papers: 55 studies after deduplication and screening.
5. Taxonomy of ML-Driven Solutions
5.1 Machine Learning Models
Classical Models
- RFBOOF [21]: Uses opcode features with Random Forest.
- Eth2Vec [41]: Learns EVM bytecode representations via neural networks.
Deep Learning
- MODNN [52]: CNN-based detection of 12 vulnerability types, including unknowns.
- GNNs [60–71]: Leverage syntactic/semantic graphs (AST, CFG) for holistic analysis.
Ensemble Learning
- ContractWard [24]: Combines SMOTE and ensemble classifiers for 6 vulnerability types.
5.2 Class Imbalance Solutions
- SMOTE [24, 46]: Oversamples minority classes.
- Focal Loss [52]: Prioritizes hard-to-classify samples.
5.3 Unknown Vulnerability Detection
- Similarity-Based [40]: Matches unknown vulnerabilities to known patterns.
- Novelty Detection [65]: Uses GNNs to identify unseen vulnerabilities.
6. Comparative Analysis
RQ1: ML Techniques in Vulnerability Detection
- Deep Learning Dominance: 65% of studies (CNNs, GNNs).
- Classical Models: 21% (Random Forest, SVM).
- Ensemble Methods: 14% (XGBoost, AdaBoost).
RQ2/RQ3: Class Imbalance & Unknown Vulnerabilities
| Framework | Class Imbalance Solution | Unknown Vulnerabilities Addressed |
|-----------------|---------------------------|-----------------------------------|
| MODNN [52] | Focal Loss | Yes |
| ContractWard [24] | SMOTE | No |
👉 Explore advanced ML frameworks for SC security
7. Discussion
Challenges:
- Generalizability: Most tools target Solidity/Ethereum.
- False Positives: Single-representation models (e.g., AST-only) lack semantic depth.
- Novelty Detection: Anomaly detection methods needed for truly unknown vulnerabilities.
8. Conclusions & Future Work
Key Takeaways:
- GNNs and ensemble methods show superior performance.
- Algorithmic-level solutions (e.g., focal loss) outperform data-level methods for imbalance.
- Unknown vulnerability detection requires standardized definitions and anomaly detection.
Future Directions:
- Curriculum Learning: To reduce expert dependency in feature extraction.
- Cross-Platform Tools: Enhance compatibility with diverse SC languages.
FAQs
Q1: Which ML model is best for detecting Reentrancy vulnerabilities?
A1: GNNs (e.g., DA-GNN [64]) excel by modeling control flow and data dependencies.
Q2: How can class imbalance impact vulnerability detection?
A2: Biases models toward majority classes, increasing false negatives for rare vulnerabilities.
Q3: Are unknown vulnerabilities detectable without predefined rules?
A3: Yes, via novelty detection (e.g., SAGP [71]) and anomaly-based approaches.