A Hybrid Ensemble Machine Learning Model for Smart Contract Vulnerability Detection

Abstract

On Ethereum, a smart contract that has been deployed cannot be patched after it is live. It is therefore essential to identify vulnerabilities prior to deployment and not just as an afterthought. The recent literature focuses largely on complex neural architectures based on raw code or a code-to-graph conversion of a contract's code. These techniques are frequently correct. They also cost a lot of money to train and are not so practical when used routinely or frequently to screen newly deployed contracts. This research is an alternative that is lighter. Random Forest, XGBoost and Gradient Boosting are fused using a hard voting classifier, without using code or graphs directly. Before training, Principal Component Analysis (PCA) reduces a dataset with 10,475 smart contracts and 21 numeric features down to 12 components. Proposed ensemble is evaluated against the four standalone classifiers namely KNN, Random Forest, XGBoost and Gradient Boosting on the same train test split of 70:30. It outperforms all tested individual classifiers with an accuracy of 92.58%, precision of 89.2%, recall of 85.24% and an F1 score of 87.04%.