Vulnsense: efficient vulnerability detection in ethereum smart contracts by multimodal learning with graph neural network and language model

With the proliferation of Ethereum smart contracts comes an increasing concern for security vulnerabilities that could lead to significant financial losses. Current methods for detecting vulnerabilities in smart contracts often rely on single-feature analysis or single-model deep learning techniques. These approaches have shown limitations in terms of accuracy and effectiveness, struggling to fully capture the complex nature of smart contract vulnerabilities due to the lack of comprehensive analysis combining different features and models. Hence, this paper presents VulnSense framework, a comprehensive approach to efficiently detect vulnerabilities in Ethereum smart contracts using a multimodal learning approach on graph-based and natural language processing (NLP) models. Our proposed framework combines three types of features from smart contracts comprising source code, opcode sequences, and control flow graph (CFG) extracted from bytecode. We employ bidirectional encoder representations from transformers (BERT), bidirectional long short-term memory (BiLSTM), and graph neural network (GNN) models to extract and analyze these features. The final layer of our multimodal approach consists of a fully connected layer used to predict vulnerabilities in Ethereum smart contracts. Addressing the limitations of existing vulnerability detection methods relying on single-feature or single-model deep learning techniques, our method surpasses accuracy and effectiveness constraints. We assess VulnSense using a collection of 1769 smart contracts derived from the combination of three datasets, including Smartbugs Curated, SolidiFI-Benchmark, and Smartbugs Wild. We then make a comparison with various unimodal and multimodal learning techniques contributed by GNN, BiLSTM, and BERT architectures, along with two existing approaches like Escort and Smarter. The experimental outcomes demonstrate the superior performance of our proposed approach, achieving an average accuracy of 77.96% across all three categories of vulnerable smart contracts.