Power system software security risk assessment method based on software bill of materials

Abstract

The invention relates to the field of power system security risk assessment, and discloses a power system software security risk assessment method based on a software bill of material (SBOM), comprising a core component identification module, the core component identification module extracts component metadata from an SBOM, judges whether a component belongs to a key function module in combination with a power system business logic, and sends the component metadata to the SBOM; the core component identification module is connected with the risk weight calculation module, and the risk weight calculation module dynamically adjusts the risk weight coefficient of the core component according to the identification result of the core component identification module and whether the component is a power core component. And the risk judgment index is more accurate. According to the method, the TF-I DF algorithm of the function keyword matching module is utilized, the graph traversal algorithm of the control flow risk module is combined, SBOM component metadata is deeply mined, key components are accurately judged according to power business logic, software security risks are comprehensively captured, and the identification problem in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of power system security risk assessment, and in particular to a power system software security risk assessment method based on a software bill of materials. Background Art

[0002] In today's rapidly developing digital age, the safe and stable operation of power systems plays a vital role in the normal functioning of society. As a core component for controlling and managing power equipment and ensuring power supply, the security of power system software is directly related to the reliability of the entire power system. Accurate security risk assessments of power system software play a vital role in the power industry, enabling the timely identification of potential safety hazards and the implementation of effective preventative measures to prevent severe consequences such as widespread power outages caused by software failures.

[0003] Currently, traditional technologies for assessing power system software security risks focus on monitoring and analyzing power system operational data. By collecting real-time data such as equipment operating status and power parameters, statistical analysis methods and pre-set threshold judgment rules are used to provide early warnings of potential anomalies in power system software. For example, by monitoring current and voltage fluctuations in power equipment, if data falls outside normal ranges, it is inferred that the software may be at risk of control anomalies. Some technologies also focus on software vulnerability information. Using publicly available software vulnerability databases, these technologies compare software versions used in power systems to identify known vulnerabilities and attempt to assess their potential risk impact.

[0004] However, the existing technology has many obvious limitations. First, it is difficult to accurately identify the core components in the power system software. Traditional methods lack in-depth mining of component metadata in the software bill of materials (SBOM), and cannot accurately determine whether the component belongs to the key functional module in combination with the business logic of the power system. For example, it is impossible to accurately locate the core components through effective algorithms, such as the TF-IDF algorithm in the present invention to match functional keywords, and use graph traversal algorithms to identify key paths in software control paths, resulting in an inability to highlight key points when assessing risks and difficulty in fully capturing the complex security risks within the software. Second, the risk weight calculation is not accurate enough. The existing technology cannot dynamically adjust the risk weight coefficient according to whether the component is a core power component. It only relies on the basic scoring of the public vulnerability library, and does not take into account the difficulty of vulnerability exploitation in the power scenario and the criticality of the component in the power system. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the present invention provides a power system software security risk assessment method based on the software bill of materials, which solves the limitations of the existing technology that it is difficult to accurately identify the core components of the power system software and the risk weight calculation is not accurate enough.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a power system software security risk assessment method based on a software bill of materials, including a core component identification module, the core component identification module extracts component metadata from the SBOM, combines the power system business logic, determines whether the component belongs to a key function module, and sends the judgment result to the risk weight calculation module, the core component identification module is connected to a risk weight calculation module, the risk weight calculation module dynamically adjusts its risk weight coefficient according to the result of the core component identification module and whether the component is a power core component, so that the risk judgment index is more accurate, the risk weight calculation module is connected to a verification and dynamic update module, the verification and dynamic update module verifies in real time whether the actual operating status of the component in the SBOM is a key component, and dynamically updates the risk weight, the risk weight calculation module is connected to a feedback evaluation module, the feedback evaluation module provides different security risk solutions to the staff based on the results of the final risk weight calculation module and the verification and dynamic update module.

[0007] Preferably, the security risk scheme in the feedback assessment module includes:

[0008] High risk: Major vulnerabilities in core components: These are high-risk vulnerabilities that directly threaten the core functions of the power system and require immediate shutdown and repair.

[0009] Medium risk: Controllable vulnerabilities in non-core components: These vulnerabilities are high-risk and have limited exploitability. They must be fixed within the planned maintenance window and monitored in real time.

[0010] Low risk: Low-risk vulnerabilities or configuration drift: Non-critical components have slight risks and are included in quarterly maintenance or hot updates.

[0011] Preferably, the core component identification module includes: a function keyword matching module, which inputs the component name, description, and code comments, and calculates the similarity between the component description and the keyword library based on the TF-IDF algorithm:

[0012]

[0013] The threshold is set, and when the similarity is ≥ 0.7, it is determined to be a key component.

[0014] Preferably, the function keyword matching module is connected to a control flow risk module, which inputs software control path information and uses a graph traversal algorithm to identify whether the current path is a critical path;

[0015] Critical path = {n∈node|the shortest path from the system entrance to the protection exit contains n}

[0016] Among them: n represents a single node in the software control flow, the system entry represents the initial trigger point of the power system software, the protection exit represents the key safety action execution point, the shortest path represents the core functional link, and if the component is in the critical control path, it is marked as a core component.

[0017] Preferably, the risk weight calculation module includes: a basic vulnerability risk scoring module, which is based on the basic funnel scoring standard and is adjusted in combination with the conditions required for the vulnerability to be exploited:

[0018]

[0019] Among them: CVSS Base Score represents the basic CVSS score of the vulnerability, reflecting its inherent severity; Exploitability represents the weight of the difficulty of exploiting the vulnerability in the power scenario; Max Exploitability represents the maximum difficulty of exploitation and is used to standardize weight distribution.

[0020] Preferably, the basic vulnerability risk scoring module is connected to a power criticality coefficient module, and the power criticality coefficient module assigns differentiated weights according to whether the component is a core function.

[0021] Preferably, the power criticality coefficient module is connected to a component comprehensive risk scoring module, and the component comprehensive risk scoring module calculates the current component comprehensive risk score according to the weight:

[0022] CRS = VSS × K × (1 + log (number of historical vulnerabilities + 1))

[0023] The historical vulnerability count represents the number of times similar vulnerabilities of this component have occurred in the past. Log represents the natural logarithm, which is used to perform nonlinear compression on the historical count.

[0024] Preferably, the verification and dynamic update module includes a runtime behavior monitoring module, which verifies in real time whether the actual operating status of the component in the SBOM is a critical component and dynamically updates the risk weight by inputting: system calls, network traffic, memory usage, and using rules: Hook technology to capture the operating characteristics of core functional components; the final judgment is: when an unmarked component triggers core behavior, it is dynamically marked as a critical component and the K value is updated.

[0025] The present invention provides a power system software security risk assessment method based on software bill of materials. It has the following beneficial effects:

[0026] 1. This paper uses the TF-IDF algorithm of the function keyword matching module, combined with the graph traversal algorithm of the control flow risk module, to deeply mine the SBOM component metadata, accurately identify key components based on power business logic, comprehensively capture software security risks, and solve the identification problems of existing technologies.

[0027] 2. This invention uses a basic vulnerability risk scoring module to adjust the score, combines it with the power criticality coefficient module to assign differentiated weights, and then calculates it through the component comprehensive risk scoring module. Compared to traditional scoring methods that rely on public vulnerability databases, this invention can dynamically adjust weights, making the assessment more accurate.

[0028] 3. When the system is running, the behavior monitoring module of the present invention uses Hook technology to monitor system calls and other information in real time, promptly discover and mark components that trigger core behaviors, dynamically update risk weights, enhance risk warning capabilities, and ensure the safe and stable operation of power software. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Flowchart of the evaluation method of the present invention. DETAILED DESCRIPTION

[0030] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the present specification. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0031] Example:

[0032] Please see the attached Figure 1 , an embodiment of the present invention provides a power system software security risk assessment method based on a software bill of materials, including a core component identification module, the core component identification module extracts component metadata from the SBOM, combines the power system business logic, determines whether the component belongs to a key function module, and sends the judgment result to the risk weight calculation module, the core component identification module is connected to a risk weight calculation module, the risk weight calculation module dynamically adjusts its risk weight coefficient according to the result of the core component identification module and whether the component is a power core component, so that the risk index is more accurate, the risk weight calculation module is connected to a verification and dynamic update module, the verification and dynamic update module verifies in real time whether the actual operating status of the component in the SBOM is a key component, and dynamically updates the risk weight, the risk weight calculation module is connected to a feedback evaluation module, the feedback evaluation module provides different security risk solutions to the staff based on the results of the final risk weight calculation module and the verification and dynamic update module. The security risk solution includes:

[0033] High risk: Major vulnerabilities in core components: These are high-risk vulnerabilities that directly threaten core power functions (such as protection logic) and require immediate shutdown and repair.

[0034] Medium risk: Controllable vulnerabilities in non-core components: These vulnerabilities are high-risk and have limited exploitability. They must be fixed within the planned maintenance window and monitored in real time.

[0035] Low risk: Low-risk vulnerabilities or configuration drift: Non-critical components have slight risks and are included in quarterly maintenance or hot updates.

[0036] The core component identification module includes a function keyword matching module, which inputs the component name, description, and code comments and calculates the similarity between the component description and the keyword library based on the TF-IDF algorithm:

[0037]

[0038] in:

[0039] TF(w,C): Term Frequency, which indicates the frequency of keyword w appearing in component description document C;

[0040]

[0041] IDF(w): Inverse document frequency, which measures the global importance of keyword w in the entire keyword library;

[0042]

[0043] The threshold is set, and when the similarity is ≥ 0.7, it is determined to be a key component;

[0044] The function keyword matching module is connected to a control flow risk module, which inputs software control path information and uses a graph traversal algorithm to identify whether the current path is a critical path;

[0045] Critical path = {n∈node|the shortest path from the system entrance to the protection exit contains n}

[0046] Where n represents a single node in the software control flow, the system entry represents the initial trigger point of the power system software, the protection exit represents the key safety action execution point, the shortest path represents the core functional link, and if the component is in the critical control path, it is marked as a core component;

[0047] The risk weight calculation module includes: a basic vulnerability risk scoring module, which is based on the basic funnel scoring standard and is adjusted in combination with the conditions required for the vulnerability to be exploited:

[0048]

[0049] Among them: CVSS Base Score represents the basic CVSS score of the vulnerability, reflecting its inherent severity; Exploitability represents the weight of the vulnerability's difficulty of exploitation in the power scenario; Max Exploitability represents the maximum difficulty of exploitation and is used to standardize weight distribution;

[0050] The basic vulnerability risk scoring module is connected to a power criticality coefficient module, which assigns differentiated weights based on whether the component is a core function;

[0051]

[0052] The power criticality coefficient module is connected to a component comprehensive risk scoring module, which then calculates the current component comprehensive risk score based on the weight:

[0053] CRS = VSS × K × (1 + log (number of historical vulnerabilities + 1))

[0054] The vulnerability history count represents the number of times similar vulnerabilities of this component have occurred in the past. Log represents the natural logarithm, which is used to perform nonlinear compression on the history count.

[0055] The verification and dynamic update module includes a runtime behavior monitoring module, which verifies in real time whether the actual operating status of the components in the SBOM is a critical component and dynamically updates the risk weight. It uses inputs such as system calls, network traffic, and memory usage, and uses rules such as Hook technology to capture the operating characteristics of core functional components. The final judgment is: when an unmarked component triggers core behavior, it is dynamically marked as a critical component and the K value is updated.

[0056] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A power system software security risk assessment method based on software bill of materials, characterized by: It includes a core component identification module, which extracts component metadata from the SBOM, combines the power system business logic, determines whether the component belongs to a key function module, and sends the judgment result to the risk weight calculation module. The core component identification module is connected to a risk weight calculation module, and the risk weight calculation module dynamically adjusts its risk weight coefficient according to the result of the core component identification module and whether the component is a power core component, so that the risk judgment index is more accurate. The risk weight calculation module is connected to a verification and dynamic update module, and the verification and dynamic update module verifies in real time whether the actual operating status of the component in the SBOM is a key component, and dynamically updates the risk weight. The risk weight calculation module is connected to a feedback evaluation module, and the feedback evaluation module provides different safety risk solutions to the staff based on the results of the final risk weight calculation module and the verification and dynamic update module.

2. The power system software security risk assessment method based on software bill of materials according to claim 1 is characterized in that: The security risk solutions in the feedback assessment module include: High risk: Major vulnerabilities in core components: These are high-risk vulnerabilities that directly threaten the core functions of the power system and require immediate shutdown and repair. Medium risk: Controllable vulnerabilities in non-core components: These vulnerabilities are high-risk and have limited exploitability. They must be fixed within the planned maintenance window and monitored in real time. Low risk: Low-risk vulnerabilities or configuration drift: Non-critical components have slight risks and are included in quarterly maintenance or hot updates.

3. The power system software security risk assessment method based on software bill of materials according to claim 1 is characterized in that: The core component identification module includes a function keyword matching module, which inputs the component name, description, and code comments and calculates the similarity between the component description and the keyword library based on the TF-IDF algorithm: The threshold is set, and when the similarity is ≥ 0.7, it is determined to be a key component.

4. The power system software security risk assessment method based on software bill of materials according to claim 1 is characterized in that: The function keyword matching module is connected to a control flow risk module, which inputs software control path information and uses a graph traversal algorithm to identify whether the current path is a critical path; Critical path = {n∈node|the shortest path from the system entrance to the protection exit contains n} Among them: n represents a single node in the software control flow, the system entry represents the initial trigger point of the power system software, the protection exit represents the key safety action execution point, the shortest path represents the core functional link, and if the component is in the critical control path, it is marked as a core component.

5. The power system software security risk assessment method based on software bill of materials according to claim 1 is characterized in that: The risk weight calculation module includes: a basic vulnerability risk scoring module, which is based on the basic funnel scoring standard and is adjusted in combination with the conditions required for the vulnerability to be exploited: Among them: CVSS Base Score represents the basic CVSS score of the vulnerability, reflecting its inherent severity; Exploitability represents the weight of the difficulty of exploiting the vulnerability in the power scenario; Max Exploitability represents the maximum difficulty of exploitation and is used to standardize weight distribution.

6. The power system software security risk assessment method based on software bill of materials according to claim 5 is characterized in that: The basic vulnerability risk scoring module is connected to a power criticality coefficient module, which assigns differentiated weights based on whether the component is a core function.

7. The power system software security risk assessment method based on software bill of materials according to claim 1 is characterized in that: The power criticality coefficient module is connected to a component comprehensive risk scoring module, which then calculates the current component comprehensive risk score based on the weight: CRS = VSS × K × (1 + log (number of historical vulnerabilities + 1)) The historical vulnerability count represents the number of times similar vulnerabilities of this component have occurred in the past. Log represents the natural logarithm, which is used to perform nonlinear compression on the historical count.

8. The power system software security risk assessment method based on software bill of materials according to claim 1 is characterized in that: The verification and dynamic update module includes a runtime behavior monitoring module, which verifies in real time whether the actual operating status of the components in the SBOM is a critical component and dynamically updates the risk weight. It uses inputs such as system calls, network traffic, and memory usage, and uses rule-based hook technology to capture the operating characteristics of core functional components. Final judgment: When an unmarked component triggers a core behavior, it is dynamically marked as a key component and the K value is updated.

Images