Vulnerability Functions Research Articles

Key derivation function: key-hash based computational extractor and stream based pseudorandom expander.

The key derivation function is a specific cryptographic algorithm that transforms private string and public strings into one or more cryptographic keys. The cryptographic keys are essential for protecting electronic data during transmission on the internet. This function is designed based on a computational extractor and pseudorandom expander and is typically constructed using various cryptography ciphers such as stream ciphers, keyed-hash message authentication codes, and block ciphers. Having secure and efficient key derivation function designs is essential in the development of numerous security systems. A vulnerable key derivation function could potentially give attackers the ability to compromise an otherwise secure cryptosystem. This research proposes a different approach by combining two different cryptography ciphers to develop key derivation functions. The findings demonstrate that a computational extractor utilizing keyed-hash message authentication codes and a pseudorandom expander using stream ciphers maintain the highest level of security while also providing efficiency benefits in terms of execution time compared to existing key derivation function schemes.

A Review of Structural Vulnerability Assessment Methods in the Advent of a Tsunami

The interaction between hazard and exposure gives rise to risk. Tsunami risk assessment is derived from both hazard assessment and vulnerability assessment. Exposure can manifest in various aspects, such as social factors (e.g., population), environmental factors (e.g., agricultural areas), or economic factors (e.g., infrastructure). Our focus in this review paper is specifically on economic exposure, with an emphasis on structural vulnerability assessment. The approaches employed in tsunami vulnerability assessment are diverse. In this paper, we categorize them into simplified and in-depth methods, encompassing: (1) Empirical vulnerability functions, (2) Index-based approach, (3) Building tsunami vulnerability model (BTV).

Structure-Function Relationship in Keratoconus: Spatial and Depth Vision.

The purpose of this study was to determine changes in spatial and depth vision with increasing severity of keratoconus and to model the structure-function relationship to identify distinct phases of loss in visual function with disease severity. Best-spectacle corrected, monocular high-contrast visual acuity, contrast sensitivity function (CSF) and stereoacuity of 155 cases (16-31years) with mild to advanced bilateral keratoconus was determined using standard psychophysical tests. Disease severity was quantified using the multimetric D-index. The structure-function relationship was modeled using linear, positive exponential, negative exponential, and logistic nonlinear regression equations. The logistic regression model explained the highest proportion of variance for spatial vision, without bias in the residual plots (R2 ≥ 66%, P < 0.001). Visual acuity showed a distinct ceiling phase and a steeper loss rate with increasing D-index (1.8units/D-index) in this model. The area under the CSF lacked this ceiling phase and had a shallower loss rate (0.28units/D-index). Stereoacuity loss with D-index was poorly explained by all models tested (P ≤ 0.2). Cases with lower and bilaterally symmetric D-index had better stereoacuity (181.6-376 arc seconds) than those with higher D-index (>400 arc second); both were significantly poorer than controls (approximately 30 arc second). Vision loss in keratoconus varies with the visual function parameter tested. Contrast sensitivity may be an earlier indicator of spatial vision loss than visual acuity. Depth perception is significantly deteriorated from very early stages of the disease. The study outcomes may be used to forecast longitudinal vision loss in keratoconus and to apply appropriate interventions for timely preservation/enhancement of vulnerable visual functions.

Absolute zero-contrast percutaneous coronary interventions: An intravascular ultrasound-guided case series and literature review

PurposeContrast media (CM)-associated adverse effects including mainly acute kidney injury and hypersensitivity reactions still remain a significant treatment burden to vulnerable patients requiring percutaneous coronary intervention (PCI). The complete omission of CM administration accompanied by intravascular ultrasound (IVUS) guidance may offer an appropriate revascularization treatment. MethodsWe hereby present a case series of four patients with challenging coronary lesions and relative/absolute contraindications to CM use [(hypersensitivity reaction owning to CM, history of contrast-induced acute kidney injury, solitary kidney, or advanced chronic kidney disease (CKD)] who underwent absolute zero-contrast IVUS-guided PCI following a predetermined protocol. ResultsThe initial diagnostic angiography was reviewed for landmark identification, and multiple guidewires created a metallic road map providing additional landmarks and protected side branches. IVUS imaging was performed to determine lesion length, reference segments and landing zones, assess stent expansion/apposition and identify major complications. All procedures were successfully completed without any CM administration, renal function deterioration, pericardial effusion, or stent edge dissection. ConclusionsWe demonstrated the feasibility of absolute zero-contrast IVUS-guided PCI in patients with complex coronary lesions susceptible to CM-associated adverse effects. Since the safety of this strategy is well-documented in patients with CKD and challenging lesions morphology even in acute settings, evidence-based validation of this approach is capable of changing the otherwise conservative treatment of vulnerable patients where even minimum doses of CM may have detrimental effects. Summary for the annotated table of contentsPatients with vulnerable renal function as well as former hypersensitivity reaction to contrast media encounter a significant treatment burden regarding coronary artery disease. Zero-contrast IVUS-guided strategy based on a predetermined protocol provides a feasible alternative approach in patients susceptible to contrast media-associated adverse effects even in the presence of complex coronary lesions.

Ketahanan Lingkungan Dan Adaptasi Sosial Dalam Konteks Perubahan Iklim Di Kabupaten Provinsi Sumatera Selatan

Climate change affects agriculture through its impact on plant growth, development and yield. Research on indications of climate change and its impact on rice production in Indonesia in South Sumatra This research aims to examine climate change and its impacts on rice production in Indonesia. This study uses data from temperature, bulk rain, agroclimate, and rice production as well as socio-economic data. Methodology This research is an explanatory descriptive study using the concept of risk assessment where risk (risk) is a function of danger (hazard) and vulnerability (vulnerability). Study results shows that in Indonesia there has been climate change with indications of increasing temperature, changes in rainfall patterns, changes in hitergraphs, and changes in Oldeman classification.

Asteria-Pro: Enhancing Deep Learning-based Binary Code Similarity Detection by Incorporating Domain Knowledge

Widespread code reuse allows vulnerabilities to proliferate among a vast variety of firmware. There is an urgent need to detect these vulnerable codes effectively and efficiently. By measuring code similarities, AI-based binary code similarity detection is applied to detecting vulnerable code at scale. Existing studies have proposed various function features to capture the commonality for similarity detection. Nevertheless, the significant code syntactic variability induced by the diversity of IoT hardware architectures diminishes the accuracy of binary code similarity detection. In our earlier study and the tool Asteria , we adopted a Tree-LSTM network to summarize function semantics as function commonality, and the evaluation result indicates an advanced performance. However, it still has utility concerns due to excessive time costs and inadequate precision while searching for large-scale firmware bugs. To this end, we propose a novel deep learning-enhancement architecture by incorporating domain knowledge-based pre-filtration and re-ranking modules, and we develop a prototype named Asteria-Pro based on Asteria . The pre-filtration module eliminates dissimilar functions, thus reducing the subsequent deep learning-model calculations. The re-ranking module boosts the rankings of vulnerable functions among candidates generated by the deep learning model. Our evaluation indicates that the pre-filtration module cuts the calculation time by 96.9%, and the re-ranking module improves MRR and Recall by 23.71% and 36.4%, respectively. By incorporating these modules, Asteria-Pro outperforms existing state-of-the-art approaches in the bug search task by a significant margin. Furthermore, our evaluation shows that embedding baseline methods with pre-filtration and re-ranking modules significantly improves their precision. We conduct a large-scale real-world firmware bug search, and Asteria-Pro manages to detect 1,482 vulnerable functions with a high precision 91.65%.

Quick Estimation Model for Mapping Earthquake Impacts in Bogotá, Colombia

Early disaster responses in damaged areas after a large earthquake are indispensable for stakeholders to assess and grasp the impacts such as building and infrastructure damage and disrupted community functionality as soon as possible. This study introduces a quick estimation model for mapping seismic intensities and building losses in Bogotá, the capital city of Colombia. The model uses ground motion records in the seismic network, soil maps of average shear-wave velocity in the upper 30 m (Vs30) with site amplifications, building inventory, and vulnerability functions for all building types. The spatial distribution of ground motion intensities, including spectral accelerations, was estimated by interpolating the observed seismic intensities with the Vs30-based site amplifications. The losses (repair cost) for all the buildings were evaluated by integrating the estimated spectral accelerations, the building inventory, and the vulnerability functions. The spatial distributions of seismic intensities and building losses can be computed within a few minutes immediately after triggering earthquake motions in the seismic network. The proposed model demonstrates evaluations of the impacts for the Mw6.0 earthquake that occurred on December 2019 and an earthquake scenario with Mw7.0 from an active fault near the Bogotá region.

Graph neural network based approach to automatically assigning common weakness enumeration identifiers for vulnerabilities

Vulnerability reports are essential for improving software security since they record key information on vulnerabilities. In a report, CWE denotes the weakness of the vulnerability and thus helps quickly understand the cause of the vulnerability. Therefore, CWE assignment is useful for categorizing newly discovered vulnerabilities. In this paper, we propose an automatic CWE assignment method with graph neural networks. First, we prepare a dataset that contains 3394 real world vulnerabilities from Linux, OpenSSL, Wireshark and many other software programs. Then, we extract statements with vulnerability syntax features from these vulnerabilities and use program slicing to slice them according to the categories of syntax features. On top of slices, we represent these slices with graphs that characterize the data dependency and control dependency between statements. Finally, we employ the graph neural networks to learn the hidden information from these graphs and leverage the Siamese network to compute the similarity between vulnerability functions, thereby assigning CWE IDs for these vulnerabilities. The experimental results show that the proposed method is effective compared to existing methods.

19 Processing Speed and Academic Fluency in Childhood Survivors of Acute Lymphoblastic Leukemia Treated with Chemotherapy Only

Objective:The purpose of this study using archival data was to examine processing speed (PS) and its relation with academic fluencies in children who were diagnosed with, and treated with chemotherapy for, acute lymphoblastic leukemia (ALL) before vs. after five years of age. Chemotherapy is the first-line treatment for childhood leukemias, and the impact of cancer treatment on academic and global functioning may include a steady decline in functions over time (Baron &amp; Rey-Casserly, 2013). Specifically, this research initiative examined age and gender factors in PS and academic fluencies in this population.Participants and Methods:Sixty-eight participants (39 M, 29 F; mean age 10.6 years) diagnosed with ALL and who were previously treated with chemotherapy were included. Thirty-seven participants (23 M, 14 F) were &lt;5 years of age at the time of diagnosis and onset of chemotherapy, while 31 participants (16M, 15 F) were &gt;5 years of age at diagnosis and treatment. Participants ranged in age from 6 to 17 years at the time of their neuropsychological evaluation. Participants were given the WISC-V (PS subtests) and WJ-IV academic fluencies (math and reading). To evaluate research questions and hypotheses, correlational tests, independent samples t-tests, and analyses of variance (ANOVA) were used. Results at the p&lt; .05 level are reported.Results:There were significant correlations between PS and WJ math fluency (r=.510) and reading fluency (r=.392). Independent samples t-test analyses revealed that children who scored below 85 (standard score) on PS composite score demonstrated poorer performance on WJ math fluency (t(60)=-3.971, p=.000, d=1.065) and reading fluency (t(56)=-3.041, p=.004, d=0.896) compared to children whose PS scores were &gt; 85. For children whose PS scores were &lt;85, mean scores were in the low average range for WJ-IV math fluency (M=81.05) and reading fluency (M=84.50). No significant differences were found for age or gender in relation to PS and academic fluencies.Conclusions:Findings are important in highlighting the need for school accommodations in pediatric survivors of ALL. Processing speed is one of the most vulnerable functions impacted by cancer therapies and was positively correlated with reading and math fluencies in this study. Mean scores for math and reading fluencies were low average for age. In terms of academic accommodations, due to the slow processing speed of these boys and girls, regardless of their age at diagnosis and onset of chemotherapy, the provision for extra time for ALL survivors is recommended to ensure they are given the opportunity to maximize their learning potential and demonstrate their true academic abilities. Parents are encouraged to practice basic fluencies at home as early as possible. Inhospital and home-bound schooling supports are recommended to maintain educational progress. For children at higher risk for late effects and neurocognitive decline, rehabilitation similar to that which TBI survivors receive can be effective, as well. Future prospective research, including longitudinal tracking, with more homogeneous samples of pediatric survivors of ALL is expected to extend and refine findings of the present study.

Comparison of earthquake risk for masonry and RC buildings in Barcelona using existing sets of vulnerability functions

Barcelona is in an area of low- to medium-seismicity and its earthquake vulnerability and risk has been assessed in different studies over the last 20 years. Most of these works have developed vulnerability models for the representative building classes of the city, trying to capture their main characteristics, and have been mostly represented through fragility curves. However, due to the lack of data for historical earthquake losses in the city, it has not been possible to validate, nor calibrate, any of these vulnerability models. In the absence of earthquake loss data, the objective of this paper is to compare the earthquake risk results of Barcelona, using common hazard and exposure datasets and different sets of vulnerability functions from previous studies to see how they rank compared with other locations with similar studies but more complete historical loss data. The results show large differences between the analysed vulnerability datasets, with some results that in our view tend to overestimate earthquake risk in Barcelona, and also allow identifying critical aspects that require future research.

Seismic loss assessment for regional building portfolios considering empirical seismic vulnerability functions

Seismic loss assessment for regional building portfolios considering empirical seismic vulnerability functions

Uncertainties and sensitivities in the quantification of future tropical cyclone risk

Tropical cyclone risks are expected to increase with climate change and socio-economic development and are subject to substantial uncertainties. We thus assess future global tropical cyclone risk drivers and perform a systematic uncertainty and sensitivity analysis. We combine synthetic tropical cyclones downscaled from CMIP6 global climate models for several emission scenarios with economic growth factors derived from the Shared Socioeconomic Pathways and a wide range of vulnerability functions. We highlight non-trivial effects between climate change and socio-economic development that drive future tropical cyclone risk. Furthermore, we show that the choice of climate model affects the output uncertainty most among all varied model input factors. Finally, we discover a positive correlation between climate sensitivity and tropical cyclone risk increase. We assert that quantitative estimates of uncertainty and sensitivity to model parameters greatly enhance the value of climate risk assessments, enabling more robust decision-making and offering a richer context for model improvement.

Semantic-Enriched Code Knowledge Graph to Reveal Unknowns in Smart Contract Code Reuse

Programmers who work with smart contract development often encounter challenges in reusing code from repositories. This is due to the presence of two unknowns that can lead to non-functional and functional failures. These unknowns are implicit collaborations between functions and subtle differences among similar functions. Current code mining methods can extract syntax and semantic knowledge (known knowledge), but they cannot uncover these unknowns due to a significant gap between the known and the unknown. To address this issue, we formulate knowledge acquisition as a knowledge deduction task and propose an analytic flow that uses the function clone as a bridge to gradually deduce the known knowledge into the problem-solving knowledge that can reveal the unknowns. This flow comprises five methods: clone detection, co-occurrence probability calculation, function usage frequency accumulation, description propagation, and control flow graph annotation. This provides a systematic and coherent approach to knowledge deduction. We then structure all of the knowledge into a semantic-enriched code Knowledge Graph (KG) and integrate this KG into two software engineering tasks: code recommendation and crowd-scaled coding practice checking. As a proof of concept, we apply our approach to 5,140 smart contract files available on Etherscan.io and confirm high accuracy of our KG construction steps. In our experiments, our code KG effectively improved code recommendation accuracy by 6% to 45%, increased diversity by 61% to 102%, and enhanced NDCG by 1% to 21%. Furthermore, compared to traditional analysis tools and the debugging-with-the-crowd method, our KG improved time efficiency by 30 to 380 seconds, vulnerability determination accuracy by 20% to 33%, and vulnerability fixing accuracy by 24% to 40% for novice developers who identified and fixed vulnerable smart contract functions.

Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis

Vulnerability is a major threat to software security. It has been proven that binary code similarity detection approaches are efficient to search for recurring vulnerabilities introduced by code sharing in binary software. However, these approaches suffer from high false-positive rates (FPRs) since they usually take the patched functions as vulnerable, and they usually do not work well when binaries are compiled with different compilation settings. To this end, we propose an approach, named Robin , to confirm recurring vulnerabilities by filtering out patched functions. Robin is powered by a lightweight symbolic execution to solve the set of function inputs that can lead to the vulnerability-related code. It then executes the target functions with the same inputs to capture the vulnerable or patched behaviors for patched function filtration. Experimental results show that Robin achieves high accuracy for patch detection across different compilers and compiler optimization levels respectively on 287 real-world vulnerabilities of 10 different software. Based on accurate patch detection, Robin significantly reduces the false-positive rate of state-of-the-art vulnerability detection tools (by 94.3% on average), making them more practical. Robin additionally detects 12 new potentially vulnerable functions.

Development of Fragility and Vulnerability Functions for Reinforced Masonry Structures in Mexico: A Case Study

The north of the state of Baja California (BC) is located in one of the regions of Mexico with a high seismic risk. The predominant infrastructure in the city of Tijuana consists of reinforced masonry housing structures, making it crucial to understand the dynamic behavior of this type of structure. Using the “Vulnerability Modeller’sToolKit” (VMTK), fragility functions were obtained for low, medium, and high levels of seismic design. It was found that the probability of achieving or surpassing the different damage states (light, moderate, extensive, and complete) is high in low-height housing (1–3 floors) for an expected value of 0.50 g of PGA and in medium-height housing (4–7 floors) for an expected value of 0.5 g of SA (T = 0.5 s).Vulnerability functions were derived, and it was determined that, for a low seismic design level, low-height and medium-height structures, respectively presented loss probability rates of 30% and 44% for an expected value of 0.50 g of PGA and SA (T = 0.5 s). These fragility and vulnerability functions can be used to estimate damage and losses in future risk scenarios, thereby reducing uncertainty in the risk analysis calculations for the city of Tijuana.

Detecting functional rarity in a hyperdiverse Amazonian dung beetle assemblage

The functional space of an ecological community is not evenly filled by its species. Instead, it is usually divided into areas of high species density, where species with common combinations of functional traits are grouped into species rich clusters, while lower density areas are filled with species poor clusters or isolated species with uncommon or unique combinations of traits. Species whose functional traits differ from those of the rest of the community are expected to play distinct ecological roles and over-contribute to ecosystem functionality. Sampling methods used to characterize arthropod assemblages usually target subsets of the community and filter species based on their functional traits, reducing the probability of detecting species with uncommon combinations of functional traits. Consideration of these species is particularly important for characterizing the functional structure and resilience of ecological communities inhabiting threatened ecosystems such as lowland Amazonian rainforests, in which dung beetles play multiple ecological roles and are commonly used as ecological indicators. In this study, we characterize the functional structure of a diverse Amazonian dung beetle assemblage using five different sampling methods (dung- and carrion-baited pitfalls, dung-baited aerial traps, flight interception traps, and visual transects) and 18 different functional traits. Our main objective is to assess the suitability of these methods for the detection of the functional volume of the assemblage and of species with uncommon or unique combinations of functional traits that are expected to support vulnerable ecosystem functions. We found that, although dung-baited pitfalls (DPF) detected the highest species richness and proportion of the functional volume, they did not detect 30 species out of 103 and over 20% of the functional volume of the assemblage. The additional sampling methods captured more species with uncommon combinations of functional traits than expected by chance, some of which were trophic specialists not attracted to DPFs. The use of complementary sampling methods resulted in a better characterization of the functional structure of dung beetle communities inhabiting both terra firme and floodplain Amazonian rainforests and revealed functional resilience and rare species playing ecological roles overlooked by DPFs. The consideration of these species is of great importance given the threats that tropical rainforests face worldwide.

Flood risk and household losses: Empirical findings from a rural community in Khyber Pakhtunkhwa, Pakistan

This study evaluates the effects of household-level flood risk on post-flood losses in Pakistan. Pakistan experienced devastating flooding, leading to numerous fatalities, extensive destruction of homes, and millions of displaced or otherwise affected individuals. Using survey data from households in Chitral District, we apply indicators from the literature on exposure, sensitivity, and adaptive capacity to generate actual vulnerability scores for households. We then determine household-level risk as a function of vulnerability and hazard. Finally, we employ Kruskal–Wallis one-way variance analysis to measure the association between household risk and flood impact in terms of both agricultural and non-agricultural losses. The findings indicate that loss due to floods is not a random function of nature's impact; instead, households with higher levels of risk also face higher agricultural and non-agricultural losses. These results emphasize the importance of addressing underlying risk factors to reduce household vulnerability rather than simply responding to post-crisis emergencies.

Harmonizing Seismic Vulnerability Data for Effective Seismic Risk Assessment: Expert Judgment Method and Findings from a Multi-Stakeholder Study in Indonesia

Seismic Risk Management (SRM) is crucial for mitigating the impact of earthquakes, encompassing earthquake preparedness, response planning, building design, and emergency management systems. The 2006 Yogyakarta earthquake in Indonesia resulted in significant loss of life, infrastructure damage, and economic impact, underscoring the importance of Seismic Risk Assessment (SRA) for effective risk reduction. Seismic vulnerability functions are commonly used for SRA, but data collection can be expensive and challenging, and results may be biased due to expert judgment. In Indonesia, variability in house damage state definitions among agencies poses challenges in harmonizing data. This study used expert judgment to harmonize differences in damage state variables resulting from variable references. Data on damage states from five (5) agencies were collected and harmonized through input from earthquake engineering experts via online questionnaires. The resulting data identified five (5) types of damage and reduced variables to nine through harmonization. Twenty (20) experts with diverse backgrounds, including academics, researchers, contractors, consultants, volunteers, and government stakeholders, participated in the study through online questionnaires, and the results were processed and analyzed. The expert judgment method successfully harmonized the differences in damage state variables, ensuring a consistent, reliable, and accurate assessment of building damage, particularly housing damage. The findings of this study underscore the crucial role of expert judgment in harmonizing data for seismic risk assessment. The survey gathered input from experts with diverse backgrounds, including government stakeholders and academics, enriched the study's findings and contributed to a comprehensive understanding of earthquake disaster management. Through expert judgment, the study successfully consolidated variables from different agencies into nine (9) harmonized variables for assessing building damage. Furthermore, experts proposed an additional fourteen (14) factors that need to be considered in residential house damage inspection forms, providing critical information for estimating the extent of damage and informing decisions about repairs or demolition. These variables can be categorized into Rapid Visual Screening (RVS) and observation in more detail, aiding in effective earthquake risk management. However, further validation through comparative literature and field analysis is needed to enhance accuracy and adaptability and explore the potential of incorporating soft computational algorithms in seismic vulnerability assessments as a promising approach.

Probabilistic seismic hazard and risk assessment of Mizoram, North East India

This paper presents seismic hazard and risk assessment for the state of Mizoram based on a classical probabilistic seismic hazard analysis and event-based probabilistic seismic risk analysis. For the seismic hazard estimation, analysis has been performed considering the areal source model, fault zone polygon, and smoothed gridded seismicity model. The earthquake activity rates for these source zones and smoothed gridded seismicity sources are estimated from the homogenized and declustered earthquake catalogue. The logic tree framework is applied in the seismic source models and Ground Motion Prediction equations (GMPEs) to account for the epistemic uncertainties. Five Next-generation attenuation (NGA) GMPEs for the active shallow region and three GMPEs for the Indo-Burma subduction zone have been used to evaluate the hazard at the reference rock condition (Vs30 ​= ​760 ​m/s). Peak Ground Acceleration (PGA) and Spectral Acceleration (SA) at 0.2 s and 1s are estimated for each eight districts headquarters of Mizoram for a 2% and 10% probability of exceedance in 50 years. The hazard curves and Uniform Hazard Spectra (UHS) are also presented. For seismic risk analysis, building exposure data are based on digitized building footprint and 2011 Housing Census data of India. All the buildings are classified into three classes, and seismic vulnerability functions are assigned to each building class. The area per building class is assigned from the digitized footprint. Building replacement costs per square meter have been chosen based on expert input and values identified from past study. Lastly, the study conducted a seismic risk analysis using the Open Quake-engine's probabilistic event-based methodology to estimate risk metrics at the district level, such as average annual losses and probability curves for loss exceedance. The study's findings provide valuable insights into the most high-risk areas, the building construction types that are most vulnerable to seismic activity, and the anticipated economic losses in the state of Mizoram. These results can serve as a guide for local government authorities in developing future city plans and implementing earthquake risk mitigation strategies.

Vulnerable smart contract function locating based on Multi-Relational Nested Graph Convolutional Network

The immutable and trustable characteristics of blockchain enable smart contracts to be applied in various fields. Unfortunately, smart contracts are subject to various vulnerabilities, which are frequently exploited by attackers, causing financial damage to users. Therefore, it is extremely important to perform effective vulnerability detection and locating to ensure the security of smart contracts. Deep learning has shown great advantages in smart contract vulnerability detection due to its powerful end-to-end feature learning. The previous deep learning based approaches to smart contract vulnerability detection focus on identifying whether there are vulnerabilities in a smart contract. However, this kind of detection cannot achieve fine-grained vulnerability detection, i.e., locating which function in the smart contract is vulnerable. In this paper, we study the problem of vulnerable smart contract function locating. We construct a novel Multi-Relational Nested contract Graph (MRNG) to better characterize the rich syntactic and semantic information in the smart contract code, including the relationships between data and instructions. An MRNG represents a smart contract, where each node represents a function in the smart contract and each edge describes the calling relationship between the functions. In addition, we create a Multi-Relational Function Graph (MRFG) for each function, which characterizes the corresponding function code. That is, each function is characterized as an MRFG, which corresponds to a node in the MRNG. Each MRFG uses different types of edges to represent the different control and data relationships between nodes within a function. We also propose a Multi-Relational Nested Graph Convolutional Network (MRN-GCN) to process the MRNG. MRN-GCN first extracts and aggregates features from each MRFG, using the edge-enhanced graph convolution network and self-attention mechanism. The extracted feature vector is then assigned to the corresponding node in the MRNG to obtain a new Featured Contract Graph (FCG) for the smart contract. Graph convolution is used to further extract features from the FCG. Finally, a feed forward network with a Sigmoid function is used to locate the vulnerable functions. Experimental results on the real-world smart contract datasets show that model MRN-GCN can effectively improve the accuracy, precision, recall and F1-score performance of vulnerable smart contract function locating.