The dissertation substantiates the relevance of ensuring smart contract security in blockchain ecosystems, particularly in decentralized finance (DeFi), which operates with significant financial assets and remains vulnerable to coding errors. The objective of the research is to improve the effectiveness of vulnerability detection, classification, and localization in smart contracts according to relevant evaluation metrics by developing machine learning models and methods that form an integrated technological stack for intelligent analysis of smart contract source code.
The object of the research is the processes of detecting, classifying, and localizing vulnerabilities in smart contracts, while the subject is machine learning methods and models for multi-label detection, classification, and localization of vulnerabilities in smart contracts. The following tasks were formulated: creation of a balanced dataset with vulnerability annotations; development of multi-label classification models; improvement of reliability through probability calibration and robustness analysis under code modifications; development of weakly supervised localization methods without token-level annotation; and validation of the proposed solutions through their implementation in a software tool.
The first chapter presents a systematic analysis of formal methods, static and dynamic analysis, as well as machine learning approaches. Transformer-based models for code (CodeBERT, GraphCodeBERT), graph neural networks, and hybrid architectures are examined. Key challenges are identified, including the lack of fragment-level annotations, limited robustness to refactoring, and model overconfidence.
The second chapter proposes a combined method for constructing a balanced training dataset, integrating deterministic injection of typical vulnerabilities into secure code and context-consistent example generation using a large language model with subsequent verification. A corpus of five categories with 1,000 samples each was created. The method ensures reproducibility, realistic syntactic diversity, and class balance.
The third chapter introduces a comprehensive approach to multi-label detection and weakly supervised localization. The CodeBERT-GDLA (Graph-aware Dual-Level Attention) model is proposed. The attention mechanism is enhanced through integration of graph components and learnable structural influence coefficients. CAM-aligned attention and causality-oriented regularization are introduced to enable interpretable localization without token-level annotation.
Experimental results demonstrate that CodeBERT-GDLA outperforms baseline models in terms of macro-F1, macro-AUC, and Hamming loss. For localization tasks, high mAP and Hit@K values were achieved (for reentrancy vulnerability: mAP ≈ 82%, Hit@5 ≈ 77%, Hit@7-10 ≈ 100%) with stable performance. Ablation studies and robustness evaluations under refactoring, renaming, formatting, and partial obfuscation were conducted. To mitigate overconfidence, a regularization method optimizing Expected Calibration Error (ECE) was integrated, reducing ECE and improving the reliability of probabilistic predictions.
The fourth chapter presents a practical smart contract auditing tool based on the CodeBERT-GDLA model, featuring a REST interface and integration capability with CI/CD pipelines.
The scientific novelty of the results lies in the following: for the first time, a combined dataset construction method was proposed by integrating automatic injection of anomalous constructs into correct smart contract code with large language model-based example generation and verification, ensuring dataset balance; for the first time, the CodeBERT-GDLA model was developed by enhancing BiGRU-ATT and CodeBERT-BiGRU architectures through graph bias mechanisms and dual-level graph-aware attention, improving vulnerability detection and classification performance; the regularization method for multi-label probability calibration was improved by integrating Expected Calibration Error optimization, temperature scaling, and focal suppression of overconfidence during training, reducing model overconfidence and increasing reliability; the method of weakly supervised vulnerable code fragment localization was further developed by integrating CAM-aligned attention with causality-oriented regularization, improving localization effectiveness.
The practical significance of the results lies in the development of software and algorithmic tools for automated smart contract auditing with multi-label detection, explainable localization, and reliable probabilistic estimates. The results have been implemented in the activities of LLC RPA “Diskret” and RPC “KARE”, and in the educational process of Odesa Polytechnic National University.
