Electric power industrial control system malicious software identification and analysis method based on artificial intelligence

Abstract

The invention relates to the technical field of malicious software identification and analysis, and discloses an electric power industrial control system malicious software identification and analysis method based on artificial intelligence, and the method comprises the steps: collecting static operation sample data and dynamic operation sample data of software in an electric power working condition system in a software test environment, and carrying out the feature extraction; performing feature fusion on the static feature sequence and the dynamic feature sequence by using a physical information neural network based on an improved feature dimension reduction strategy; and classifying the fusion features of the software by adopting a local mean neighbor classification model of a fusion heuristic algorithm to obtain software categories corresponding to the fusion features. According to the method, feature adaptive fusion is realized by combining improved feature dimension reduction and a physical information neural network, and higher classification precision and robustness are realized under the support of optimal subset and neighbor number selection by combining a local mean neighbor classification method of a heuristic algorithm, so that the identification performance of the malicious software of the electric power industrial control system is effectively improved.

Description

Technical Field

[0001] This invention relates to the field of malware identification, and more particularly to an artificial intelligence-based method for identifying and analyzing malware in power industrial control systems. Background Technology

[0002] With the rapid development of information technology, the power industry is gradually transforming towards automation, informatization, and digitalization. The core infrastructure of the power industry—the power industrial control system—has also seen significant development in this process. Power industrial control systems are mainly used in power production, transmission, distribution, control, and dispatching to ensure the safe, stable, and efficient operation of the power system. However, the intelligence and networking of power industrial control systems also expose them to various network attacks, especially malware attacks. Traditional power industrial control systems are often composed of specialized hardware and operating systems, with a closed and relatively fixed internal environment, resulting in relatively weak defense capabilities. With the deepening of networking and automation, many power industrial control systems are interconnected with the external Internet or other information systems, making them vulnerable to malware attacks from the network.

[0003] Malware poses a serious threat to power control systems. It can disrupt normal system operation, steal sensitive information, or tamper with control commands, leading to power equipment malfunctions, power outages, and even large-scale power accidents. Similar malware attacks have already caused significant threats to industrial control systems worldwide. Therefore, identifying and defending against malware in power control systems has become a crucial issue in the field of power information security.

[0004] Current research has attempted to incorporate machine learning to improve the accuracy of malware identification. For example, patents...

[0005] CN107742079B proposes a method and system for malware identification. This method involves running the application to be identified in a sandbox; recording the activation status of several pre-selected specific low-level functions during the application's execution to generate a sample vector corresponding to the application's behavioral chain; obtaining a malware identification model; and using machine learning to classify the sample vector based on the malware identification model to obtain the identification result of the application corresponding to the sample vector. This allows for timely and accurate determination of whether an application is malware, achieving efficient malware identification. However, this method primarily relies on running the application in a sandbox and recording the call status of specific low-level functions, resulting in only limited behavioral chain features. This makes it difficult to comprehensively reflect the behavioral characteristics of malware in system calls, protocol interactions, and other aspects, leading to missing feature information. Summary of the Invention

[0006] In view of this, this invention provides an artificial intelligence-based method for identifying and analyzing malware in power industrial control systems. Addressing the challenges of unified modeling of multi-source heterogeneous data, decreased classification accuracy due to feature redundancy, and insufficient adaptability of traditional classification methods to complex industrial control features, this invention achieves comprehensive feature coverage of power industrial control software in both static and dynamic dimensions through software testing environment deployment and multimodal sample collection. This avoids feature loss due to a single perspective. Serialization and numerical modeling of instruction call graphs, control logic features, protocol interaction logs, and memory access behavior significantly improves the expressive power of industrial control features. An improved feature dimensionality reduction strategy is introduced and fused with a physical information neural network. While ensuring the complementarity of multi-source features, it suppresses the interference of redundant and noisy features on classification, improving the discriminative and generalizable nature of feature representation. Furthermore, by combining a local mean nearest neighbor classification method based on a fusion heuristic algorithm, this method solves the problems of blurred boundaries between industrial control software categories and large intra-category differences, achieving high-precision identification of malware categories.

[0007] To achieve the above objectives, this invention provides a method for identifying and analyzing malicious software in power industrial control systems based on artificial intelligence, comprising the following steps:

[0008] S1: Deploy a software testing environment to collect static and dynamic operating sample data of the software in the power operating system.

[0009] S2: Perform static feature extraction on static running sample data to obtain the static feature sequence of the software; perform dynamic feature extraction on dynamic running sample data to obtain the dynamic feature sequence of the software.

[0010] S3: Use a physical information neural network based on an improved feature dimensionality reduction strategy to fuse static and dynamic feature sequences to obtain the fused features of the software.

[0011] S4: The local mean nearest neighbor classification model using a fusion heuristic algorithm is used to classify the fusion features of the software, obtain the software category corresponding to the fusion features, and identify malicious software in the power industrial control system based on the software category.

[0012] As a further improvement of the present invention:

[0013] Furthermore, static and dynamic operational sample data of the software in the power industrial control system are collected in a software testing environment, including:

[0014] The software in the power industrial control system consists of the original PLC firmware, HMI application installation package, and SCADA software.

[0015] The static running sample data acquisition process of the software is as follows:

[0016] The software is unpacked, and the HMI application installation package and SCADA software executable files are extracted. The hash value of the executable file name is calculated, and the executable file is deduplicated based on the hash value to obtain the deduplicated executable file.

[0017] The deduplicated executable file is disassembled to obtain the instruction sequence of the executable file;

[0018] The original PLC firmware in the software is decoded to generate a sequence of PLC control logic nodes, which consists of PLC control logic nodes.

[0019] Extract visible strings from the instruction sequence of the executable file as the software's string text sequence;

[0020] The instruction sequence of the executable file, the sequence of PLC control logic nodes, and the string text sequence are used as static running sample data for the software.

[0021] The dynamic sample data acquisition process of the software is as follows:

[0022] The software testing environment generates software running instances, monitors the software's running process, and captures system call logs during software operation. The system call logs include call type, call parameters, and call timestamps.

[0023] Capture the function call sequence in the HMI application installation package and the executable file of the SCADA software during software operation;

[0024] Capture the memory access logs of registers in the original PLC firmware during software operation;

[0025] Capture protocol interaction logs of industrial protocols and network protocols during software operation;

[0026] System call logs, function call sequences, memory access logs, and protocol interaction logs are used as dynamic runtime sample data for the software.

[0027] Furthermore, static feature extraction is performed on the static running sample data to obtain the static feature sequence of the software, including:

[0028] Extract static runtime sample data of the software;

[0029] The instruction sequence of the executable file is converted into an instruction call graph, which is a directed graph structure.

[0030] The instruction call graph is converted into an instruction call graph adjacency matrix. In the instruction call graph adjacency matrix, if there is a pointing relationship between instructions, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0031] The PLC control logic node sequence is converted into a PLC logic call graph, which is a directed graph structure.

[0032] The PLC logic call diagram is converted into a PLC logic call diagram adjacency matrix. In the PLC logic call diagram adjacency matrix, if there is a pointing relationship between PLC control logic nodes, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0033] The visible strings in the string text sequence are converted into binary form to obtain binary bit strings, and then the binary bit strings are converted into bytecode sequences, where the bytecode sequence consists of multiple bytecodes, each storing 8 bits of binary code;

[0034] Each bytecode is mapped to a range of 0-255 as a pixel value to obtain the bytecode image of the string text sequence;

[0035] The software instruction call graph adjacency matrix, PLC logic call graph adjacency matrix, and bytecode image are used as static features to form a static feature sequence.

[0036] Furthermore, dynamic feature extraction is performed on the dynamically running sample data to obtain the dynamic feature sequence of the software, including:

[0037] Extract dynamic runtime sample data of the software and convert the function call sequence into a function call graph, where the function call graph is in the form of a directed graph.

[0038] The function call graph is converted into a function call graph adjacency matrix. In the function call graph adjacency matrix, if there is a pointing relationship between functions, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0039] Extract memory access logs and calculate the software's memory characteristics, including the frequency distribution of memory addresses, the read-write ratio, and the average access size. The frequency distribution of memory addresses is the access frequency of different memory addresses, the read-write ratio is the ratio between the number of read operations and the number of write operations in the memory access log, and the average access size is the average number of bytes accessed in memory.

[0040] Extract the protocol interaction logs and calculate the protocol characteristics of the software, including the frequency distribution of register addresses, register read / write ratio, and average response latency.

[0041] Extract system call logs and calculate the system characteristics of the software, including the frequency distribution of different call types, the mean of system call time intervals, the variance of system call time intervals, and the transition matrix of call types;

[0042] The function call graph adjacency matrix, memory features, protocol features, and system features are used as dynamic features of the software, forming a sequence of dynamic features of the software.

[0043] Furthermore, the physical information neural network based on the improved feature dimensionality reduction strategy includes an input layer, a graph dimensionality reduction layer, a feature dimensionality reduction layer with entropy attention, a convolutional layer, a hidden layer, a physical information probability classification layer, and a fusion layer, comprising:

[0044] Obtain the training dataset, which consists of training data subsets for M software categories. Each training data subset includes multiple sets of training data, and each set of training data includes static feature sequences, dynamic feature sequences, and real software categories.

[0045] The input layer is used to receive static feature sequences and dynamic feature sequences and perform standardization processing;

[0046] The graph dimensionality reduction layer, the feature dimensionality reduction layer with entropy attention, and the convolutional layer sequentially perform dimensionality reduction processing on the standardized matrix, non-matrix, and bytecode images to obtain the corresponding dimensionality-reduced features.

[0047] The graph dimensionality reduction layer is used to perform graph convolution and dimensionality reduction on the normalized matrix to obtain a graph dimensionality reduction vector. The normalized matrix includes the normalized instruction call graph adjacency matrix, the PLC logic call graph adjacency matrix, and the call type transition matrix.

[0048] The feature dimensionality reduction layer with fusion entropy attention is used to calculate the entropy attention weights of the non-matrix features after standardization, and to weight the non-matrix features after standardization to reduce the proportion of unimportant features.

[0049] Convolutional layers are used to perform convolutional processing on bytecode images to obtain dimensionality-reduced feature maps of the bytecode images;

[0050] Hidden layers are used to perform nonlinear mapping on the dimensionality-reduced features to obtain nonlinear features. Hidden layers include fully connected layers, activation functions, and batch normalization layers, and nonlinear mapping is performed based on fully connected layers, activation functions, and batch normalization layers.

[0051] The physical information probabilistic classification layer uses the Parzen window function and Bayesian probability to generate the probability distribution of nonlinear features in different software categories;

[0052] The fusion layer is used to stitch together nonlinear features and probability distributions as the fusion feature F of the software.

[0053] Furthermore, a physical information neural network based on an improved feature dimensionality reduction strategy is used to perform feature fusion on static and dynamic feature sequences, including:

[0054] The process of graph convolution and dimensionality reduction of the standardized matrix by the graph dimensionality reduction layer is as follows:

[0055] The standardized matrix is ​​then normalized to obtain the normalized result. The normalization operation is as follows: ,in Let C denote the identity matrix, and let C denote the standardized matrix. This represents the result of normalization of C;

[0056] Generate normalized results The degree matrix D;

[0057] Based on the normalization results And perform graph convolution on the degree matrix D to obtain the graph convolution feature map H:

[0058] ;

[0059] ;

[0060] Where A represents an intermediate parameter. Represents the ReLU function. express function, All are trainable graph convolution weight matrices;

[0061] The average of all rows of the graph convolution feature map H is used to obtain the graph dimension reduction vector corresponding to the standardized matrix.

[0062] The feature entropy attention weight calculation process for the feature dimensionality reduction layer with fusion entropy attention is as follows:

[0063] Obtain the non-matrix after standardization Calculate the non-matrix after standardization Related standard features Deviation between and the deviation Mapped to adaptive weighting coefficients :

[0064] ;

[0065] ;

[0066] in, This represents an exponential function with the natural constant as its base. Indicates the scaling parameter. For transpose parameter, Represents the power parameter

[0067] Based on adaptive weighting coefficients The calculation yields the non-matrix after standardization. Feature entropy attention weights:

[0068] ;

[0069] ;

[0070] in, Represents the non-matrix after standardization. Feature entropy attention weights Represents the non-matrix after standardization. The feature entropy, This represents a non-matrix set after standardization. Represents a non-matrix set after standardization. Any non-matrix after standardization in the matrix, This represents the adaptive weighting coefficient of j. Indicates the attention control coefficient. Indicates attention smoothing terms;

[0071] The fusion layer is used to stitch together nonlinear features and probability distributions as the fusion feature F of the software.

[0072] Furthermore, a local mean nearest neighbor classification model based on a fusion heuristic algorithm is used to classify the fusion features of the software, obtaining the software categories corresponding to the fusion features, including:

[0073] The local mean nearest neighbor classification model includes a subset determination module based on a heuristic algorithm, a nearest neighbor estimation module, and a software category prediction module.

[0074] The subset determination module based on heuristic algorithms uses heuristic algorithms to determine the optimal training data subset set where the fusion feature F of the software is located and the number of nearest neighbors K. The optimal training data subset set consists of S optimal training data subsets determined by heuristic algorithms.

[0075] The nearest neighbor estimation module is used to calculate the distance between the fusion feature F of the software and the fusion feature of any training data in the optimal training data subset, and extract the fusion features of the K nearest training data from the optimal training data subset to calculate the local centroid mean vector of the optimal training data subset.

[0076] The software category prediction module calculates the distance between the fusion feature F of the software and the local centroid mean vector of each optimal training data subset, and selects the software category corresponding to the local centroid mean vector with the smallest distance as the software category corresponding to the fusion feature F.

[0077] Furthermore, a heuristic algorithm is used to determine the optimal subset of training data containing the fusion feature F of the software and the number of nearest neighbors K, including:

[0078] The heuristic algorithm is an improved sparrow search algorithm;

[0079] Initialize and generate B groups of sparrow positions, each group of sparrow positions including the numbers of S training data subsets and the number of nearest neighbors;

[0080] Construct a fitness function that takes the sparrow's location as input:

[0081] ;

[0082] Where loc represents the sparrow's position. For the fitness function, The fitness function value representing the sparrow's position. The position of a sparrow is any position in the z-th training data subset of loc. The mean of the fusion features of the training data, F represents the fusion features of the software. Represents the mean of fusion features The distance between F, This represents the number of nearest neighbors in the sparrow's position loc;

[0083] The sparrow positions are sorted in ascending order of fitness function values. The top 20% of sparrow positions are selected as discovery positions, the bottom 20% as alert positions, and the remaining sparrow positions as follower positions. Based on the improved adaptive mutation factor, the sparrow positions are iterated until the number of iterations reaches the preset maximum number of iterations (e.g., 50). The iteration is then terminated, and the sparrow position with the smallest fitness function is output. Based on the output sparrow position, the optimal training data subset set containing the fusion feature F and the number of nearest neighbors K are selected.

[0084] The improved adaptive mutation factor is:

[0085] ;

[0086] in, This represents the adaptive mutation factor at the q-th iteration of the sparrow's position. Represents the t-distribution, Indicates the scaling factor. This represents the critical iteration value.

[0087] Compared with existing technologies, this invention proposes a method for identifying and analyzing malicious software in power industrial control systems based on artificial intelligence. This technology has the following beneficial effects:

[0088] First, this application uses the instruction sequence of the executable file, the PLC control logic node sequence, and the string text sequence as static runtime sample data. This comprehensively reflects the structural and logical characteristics of the power industrial control system software at the code level, facilitating the identification of maliciously injected instructions, abnormal logic, or forged identification information. Simultaneously, this application uses system call logs, function call sequences, memory access logs, and protocol interaction logs as dynamic runtime sample data. This allows for the characterization of the software's behavior patterns during execution, capturing abnormal system calls, illegal memory operations, and abnormal communication behaviors. By combining static and dynamic runtime sample data, comprehensive feature extraction from code to behavior can be achieved, improving the accuracy and robustness of malicious software identification and ensuring the security of the power industrial control system.

[0089] Meanwhile, this application combines an improved feature dimensionality reduction strategy with a physical information neural network to adaptively fuse features processed by graph convolution and degree matrix, significantly enhancing the discriminative power of feature representation. The introduction of an adaptive weighting mechanism and bias mapping function makes features more sensitive to key patterns while suppressing noise or irrelevant information, thus improving the accuracy of identifying abnormal behavior or malware. Furthermore, this method fully preserves the structural and semantic information of features during standardization and convolutional feature extraction, improving the synergistic effect of the feature dimensionality reduction layer and nonlinear mapping, achieving efficient, robust, and interpretable anomaly feature recognition. Attached Figure Description

[0090] Figure 1 A flowchart illustrating a method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence, as provided in an embodiment of the present invention;

[0091] Figure 2 This is a graph showing the change in classification accuracy with training rounds according to an embodiment of the present invention. Figure 3 This is a graph showing the change in Recall with training rounds according to an embodiment of the present invention. Figure 4 This is a graph showing the change of F1-score with training rounds, provided in an embodiment of the present invention.

[0092] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0093] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0094] This application provides an AI-based method for identifying and analyzing malware in power control systems. The executing entity of this AI-based method for identifying and analyzing malware in power control systems includes, but is not limited to, at least one electronic device that can be configured to execute the method provided in this application, such as a server or a terminal. In other words, this AI-based method for identifying and analyzing malware in power control systems can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0095] Reference Figure 1 Embodiment 1 of the present invention is as follows:

[0096] S1: Deploy a software testing environment to collect static and dynamic operating sample data of the software in the power operating system.

[0097] Static and dynamic operational sample data of the software in the power industrial control system were collected in a software testing environment, including:

[0098] The software testing environment includes an isolated network, virtual machines, and industrial control equipment simulators. The isolated network is isolated from the actual power grid and production system. It includes industrial protocol simulation software (used to simulate industrial protocols such as Modbus / TCP, DNP3, and IEC60870-5-104) and a dedicated testing network.

[0099] The virtual machine includes an operating system, monitoring tools, and analysis tools. The operating system is configured according to the requirements of the software under test (Windows or Linux embedded system). The monitoring tools are used to collect static and dynamic runtime sample data of the software. The monitoring tools include static runtime data monitoring tools (such as binwalk, Ghidra, plcscan, etc.), system call software (such as Procmon, auditd, etc.), API / function call software (such as Frida, DynamoRIO, etc.), memory monitoring software (such as Volatility, LiME, etc.), and network monitoring software (such as Wireshark, etc.). The analysis tools are used to extract features from the static runtime sample data and dynamic runtime features to obtain the static feature sequence and dynamic feature sequence of the software under test.

[0100] An industrial control equipment simulator is used to simulate the behavior of real industrial control equipment in a power industrial control system. The industrial control equipment simulator includes a PLC simulator and a sensor simulation device. The PLC simulator is used to simulate PLC hardware and operating environment, so that the target PLC program of the software to be tested can be executed in a virtual machine. The sensor simulation device is used to simulate the acquisition and transmission of sensor data, switching, and capture of behavioral events and fault events.

[0101] Specifically, isolating networks and virtual machines ensures that malware execution will not affect the actual power grid and production equipment, guaranteeing experimental safety. Virtual machines and industrial control equipment simulators can accurately reproduce the operating behavior of the software under test, making dynamic features such as system calls, API calls, memory access, and protocol interactions fully collectable. Furthermore, monitoring and analysis tools can be used to transform raw test sample data into feature sequences, supporting AI model training and detection. This makes malicious behavior analysis repeatable and verifiable, providing a reliable foundation for high-precision malware identification and behavior modeling.

[0102] The software in the power industrial control system consists of the original PLC firmware, HMI application installation package, and SCADA software. The original PLC firmware includes control logic, register operation, and I / O processing programs to implement low-level industrial control functions. The HMI application installation package includes interface layout, data binding, and operation instructions, and communicates with the original PLC firmware through a network or bus. The SCADA software implements monitoring strategies, alarm handling, data recording, and control command distribution.

[0103] The static running sample data acquisition process of the software is as follows:

[0104] The software is unpacked to extract the HMI application installation package and the executable file of the SCADA software. The hash value of the executable file's filename is calculated, and the executable file is deduplicated based on the hash value to obtain the deduplicated executable file. Optionally, the unpacking tool is binwalk.

[0105] The deduplicated executable file is disassembled to obtain the instruction sequence of the executable file; optionally, the disassembly tool is Ghidra;

[0106] The original PLC firmware in the software is decoded to generate a sequence of PLC control logic nodes, wherein the sequence of PLC control logic nodes is composed of PLC control logic nodes; optionally, the PLC logic program decoding tool is plcscan.

[0107] Extract visible strings from the instruction sequence of the executable file as the software's string text sequence;

[0108] The instruction sequence of the executable file, the sequence of PLC control logic nodes, and the string text sequence are used as static running sample data for the software.

[0109] The dynamic sample data acquisition process of the software is as follows:

[0110] The software testing environment generates software runtime instances, monitors the software's running process, and captures system call logs during software runtime. The system call logs include call type, call parameters, and call timestamps. The tool for capturing the system call logs is system call software.

[0111] The function call sequence in the HMI application installation package and the executable file of the SCADA software is captured during the software's operation; the tool for capturing the function call sequence is API / function call software.

[0112] During software operation, the memory access logs of registers in the original PLC firmware are captured; the tool for capturing the memory access logs is memory monitoring software.

[0113] The software captures protocol interaction logs of industrial and network protocols during operation; the tool for capturing these protocol interaction logs is network monitoring software.

[0114] System call logs, function call sequences, memory access logs, and protocol interaction logs are used as dynamic runtime sample data for the software.

[0115] S2: Perform static feature extraction on static running sample data to obtain the static feature sequence of the software, and perform dynamic feature extraction on dynamic running sample data to obtain the dynamic feature sequence of the software.

[0116] Static feature extraction is performed on the static running sample data to obtain the software's static feature sequence, including:

[0117] Extract static runtime sample data of the software;

[0118] The instruction sequence of the executable file is converted into an instruction call graph, which is a directed graph structure. Specifically, if instruction 1 is the predecessor instruction of instruction 2, then there is an arrow in the instruction call graph pointing from instruction 1 to instruction 2.

[0119] The instruction call graph is converted into an instruction call graph adjacency matrix. In the instruction call graph adjacency matrix, if there is a pointing relationship between instructions, the corresponding position element is 1; otherwise, the corresponding position element is 0. Specifically, if instruction 1 is the predecessor or successor instruction of instruction 2, the position elements of instruction 1 and instruction 2 in the instruction call graph adjacency matrix are 1; otherwise, the position elements of instruction 1 and instruction 2 in the instruction call graph adjacency matrix are 0.

[0120] The PLC control logic node sequence is converted into a PLC logic call graph, which is a directed graph structure.

[0121] The PLC logic call diagram is converted into a PLC logic call diagram adjacency matrix. In the PLC logic call diagram adjacency matrix, if there is a pointing relationship between PLC control logic nodes, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0122] The visible strings in the string text sequence are converted into binary form to obtain binary bit strings, and then the binary bit strings are converted into bytecode sequences, where the bytecode sequence consists of multiple bytecodes, each storing 8 bits of binary code;

[0123] Each bytecode is mapped to a range of 0-255 as a pixel value to obtain the bytecode image of the string text sequence; specifically, the 8-bit binary code is converted to a decimal range of -128 to 127, and -128 to 127 is mapped to 0 to 255;

[0124] The software instruction call graph adjacency matrix, PLC logic call graph adjacency matrix, and bytecode image are used as static features to form a static feature sequence.

[0125] Dynamic feature extraction is performed on dynamically running sample data to obtain the software's dynamic feature sequence, including:

[0126] Extract dynamic runtime sample data of the software and convert the function call sequence into a function call graph, where the function call graph is in the form of a directed graph.

[0127] The function call graph is converted into a function call graph adjacency matrix. In the function call graph adjacency matrix, if there is a pointing relationship between functions, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0128] Extract memory access logs and calculate the software's memory characteristics, including the frequency distribution of memory addresses, the read-write ratio, and the average access size. The frequency distribution of memory addresses is the access frequency of different memory addresses, the read-write ratio is the ratio between the number of read operations and the number of write operations in the memory access log, and the average access size is the average number of bytes accessed in memory.

[0129] Specifically, the frequency distribution of memory addresses is used to detect abnormal memory addresses. Power control system software is generally read-oriented, so the read-write ratio is used to identify whether there is malicious tampering with memory, and the average access size is used to identify memory dumping and data theft.

[0130] Extract the protocol interaction logs and calculate the protocol characteristics of the software, including the frequency distribution of register addresses, register read / write ratio, and average response latency.

[0131] Specifically, the frequency distribution of register addresses is used to identify abnormal access, the register read / write ratio is used to identify malicious tampering of control logic, and an increase in the average response latency indicates possible malicious load, network attack, or system anomaly.

[0132] Extract system call logs and calculate the software's system characteristics, including the frequency distribution of different call types, the mean of system call time intervals, the variance of system call time intervals, and the transition matrix of each call type. The transition matrix of each call type is calculated as follows:

[0133] ;

[0134] ;

[0135] Where G represents the transition matrix of the call type, This represents the transfer value from the e-th call type to the r-th call type, where R represents the total number of call types. This indicates the number of times the system call log shows that the e-th call type is called first, followed by the r-th call type. This indicates the number of times the system call log shows that the e-th call type is called first, followed by the i-th call type.

[0136] The function call graph adjacency matrix, memory features, protocol features, and system features are used as dynamic features of the software, forming a sequence of dynamic features of the software.

[0137] S3: Use a physical information neural network based on an improved feature dimensionality reduction strategy to fuse static and dynamic feature sequences to obtain the fused features of the software.

[0138] The physical information neural network based on the improved feature dimensionality reduction strategy includes an input layer, a graph dimensionality reduction layer, a feature dimensionality reduction layer with entropy attention, a convolutional layer, a hidden layer, a physical information probability classification layer, and a fusion layer, including:

[0139] Obtain a training dataset, which consists of M subsets of training data for each software category. Each subset includes multiple sets of training data, and each set includes static feature sequences, dynamic feature sequences, and real software categories. Optionally, the software categories include PLC control logic software, HMI human-machine interaction applications, SCADA monitoring software, communication software, normal business application software, logic-tampering Trojan software, data-stealing Trojan software, denial-of-service attack programs, and backdoor tool software. Logic-tampering Trojan software, data-stealing Trojan software, denial-of-service attack programs, and backdoor tool software are marked as malicious software for power industrial control systems.

[0140] The input layer receives static and dynamic feature sequences and performs standardization processing; specifically, the standardization processing is z-score standardization.

[0141] The graph dimensionality reduction layer, the feature dimensionality reduction layer with entropy attention, and the convolutional layer sequentially perform dimensionality reduction processing on the standardized matrix, non-matrix, and bytecode images to obtain the corresponding dimensionality-reduced features.

[0142] The graph dimensionality reduction layer is used to perform graph convolution and dimensionality reduction on the normalized matrix to obtain a graph dimensionality reduction vector. The normalized matrix includes the normalized instruction call graph adjacency matrix, the PLC logic call graph adjacency matrix, and the call type transition matrix.

[0143] The feature dimensionality reduction layer with fusion entropy attention is used to calculate the entropy attention weights of the non-matrix features after standardization, and to weight the non-matrix features after standardization to reduce the proportion of unimportant features.

[0144] Specifically, the standardized non-matrix includes the frequency distribution, read-write ratio, and average access size of memory addresses after standardization; the frequency distribution, register read-write ratio, and average response latency of register addresses after preprocessing; and the frequency distribution of different call types, the average system call time interval, and the variance of system call time interval in the preprocessed system features.

[0145] The convolutional layer is used to perform convolutional processing on the bytecode image to obtain a dimensionality-reduced feature map of the bytecode image; the convolutional layer is an EfficientNet convolutional neural network structure;

[0146] Hidden layers are used to perform nonlinear mapping on the dimensionality-reduced features to obtain nonlinear features. Hidden layers include fully connected layers, activation functions, and batch normalization layers, and nonlinear mapping is performed based on fully connected layers, activation functions, and batch normalization layers.

[0147] The physical information probabilistic classification layer uses the Parzen window function and Bayesian probability to generate the probability distribution of nonlinear features in different software categories;

[0148] The fusion layer is used to stitch together nonlinear features and probability distributions as fusion features for the software.

[0149] As an embodiment of the present invention, with the goal of maximizing the probability of each set of training data output by the physical information neural network in the real software category, a training loss function for the physical information neural network is constructed, and the trainable parameters in the physical information neural network are trained. The training method adopts the Adam optimizer or gradient descent algorithm. Optionally, the data source of the training dataset is the CICmalDroid 2020 dataset. The CICmalDroid 2020 dataset is a new Android malware dataset released by the Canadian Institute for Cybersecurity. It contains 17,341 Android samples, including the latest and most complex Android samples up to 2018. The samples in the dataset span five different categories, including adware, banking malware, SMS malware, risky software, and benign software.

[0150] It should be noted that the physical information neural network based on the improved feature dimensionality reduction strategy described in this invention has significant advantages in structure and function compared to traditional feedforward neural networks: The physical information neural network based on the improved feature dimensionality reduction strategy adopts a multimodal feature dimensionality reduction strategy, which independently reduces and fuses static and dynamic feature sequences, effectively preserving the high-order information and structural correlation of different types of features. In contrast, traditional feedforward neural networks usually directly concatenate all features as input, making it difficult to fully capture the potential relationships between multi-source heterogeneous features, which easily leads to feature redundancy and noise accumulation. The physical information neural network introduces an entropy attention mechanism in the non-matrix feature processing stage. By calculating the feature information content and assigning weights, it can dynamically suppress the influence of low-information features, enhancing the physical information neural network's response capability to key features. Traditional feedforward neural networks struggle to distinguish the importance of feature levels. The physical information neural network introduces a physical information probabilistic classification layer, using a probabilistic neural network to perform nonparametric probability density estimation of nonlinear features and combining the output results with Bayesian decision rules. Compared to the deterministic output of traditional feedforward neural networks, it can provide class probability distribution information, improving the robustness and interpretability of classification, especially showing greater stability in cases of uneven sample distribution or noise. Furthermore, the physical information neural network enhances the ability to learn complex structural relationships and local patterns by processing static matrix features through graph convolution and extracting bytecode image features through EfficientNet convolution, thereby improving the overall classification accuracy and generalization ability of software running states.

[0151] A physical information neural network based on an improved feature reduction strategy is used to fuse static and dynamic feature sequences, including:

[0152] The process of graph convolution and dimensionality reduction of the standardized matrix by the graph dimensionality reduction layer is as follows:

[0153] The standardized matrix is ​​then normalized to obtain the normalized result. The normalization operation is as follows: ,in Let C denote the identity matrix, and let C denote the standardized matrix. This represents the result of normalization of C;

[0154] Generate normalized results The degree matrix D;

[0155] Based on the normalization results And perform graph convolution on the degree matrix D to obtain the graph convolution feature map H:

[0156] ;

[0157] ;

[0158] Where A represents an intermediate parameter. Represents the ReLU function. express function, All are trainable graph convolution weight matrices;

[0159] The average of all rows of the graph convolution feature map H is used to obtain the graph dimension reduction vector corresponding to the standardized matrix.

[0160] The feature entropy attention weight calculation process for the feature dimensionality reduction layer with fusion entropy attention is as follows:

[0161] Obtain the non-matrix after standardization Calculate the non-matrix after standardization Related standard features Deviation between and the deviation Mapped to adaptive weighting coefficients :

[0162] ;

[0163] ;

[0164] in, This represents an exponential function with the natural constant as its base. This indicates the scaling parameter, which is set. It is 0.2. Set as transpose parameter It is 0.4. Indicates the power parameter, setting It is 1.2;

[0165] It should be noted that the nonlinear mapping function incorporating power transformation can adaptively adjust the response curve to the degree of feature deviation, amplifying the weight of important deviating features while suppressing the contribution of noise or irrelevant features, thus improving the ability of the entropy attention mechanism to identify key features. Compared with traditional nonlinear functions, this function can dynamically adjust the scaling parameter, transpose parameter, and power parameter with nonlinear steepness to achieve fine-grained capture of abnormal or key behavioral features, enhance the discriminative ability of feature fusion across software or complex systems, improve the effectiveness and robustness of feature dimensionality reduction, and maintain trainability and interpretability.

[0166] Based on adaptive weighting coefficients The calculation yields the non-matrix after standardization. Feature entropy attention weights:

[0167] ;

[0168] ;

[0169] in, Represents the non-matrix after standardization. Feature entropy attention weights Represents the non-matrix after standardization. The feature entropy, This represents a non-matrix set after standardization. Represents a non-matrix set after standardization. Any non-matrix after standardization in the matrix, This represents the adaptive weighting coefficient of j. This represents the attention control coefficient, set to... It is 0.2. Indicates attention smoothing terms;

[0170] The nonlinear feature The probability calculation process for different software categories is as follows:

[0171] Using the Parzen window function for nonlinear features Kernel density estimation is performed on a subset of the training data for each software category to obtain nonlinear features. Kernel density for each software category:

[0172]

[0173] in, Representing nonlinear characteristics The kernel density for the m-th software category, , The dimension representing the nonlinear characteristic. This represents the m-th software category in the training data subset. Nonlinear characteristics of the training data Describing the L1 norm, This represents an exponential function with the natural constant as its base. Indicates the kernel density width, This represents the number of training data sets in the training data subset for the m-th software category;

[0174] Using Bayesian probabilistic methods to calculate nonlinear features Probabilities in different software categories:

[0175] ;

[0176] in, Let represent the prior probability of the m-th software category. Representing nonlinear characteristics The nonlinear feature represents the probability of the m-th software category. The probability distribution is as follows: ;

[0177] The fusion layer is used to stitch together nonlinear features and probability distributions as the fusion feature F of the software.

[0178] Specifically, attention smoothing terms are used to avoid weight jitter caused by minima, thereby enhancing training stability.

[0179] S4: The local mean nearest neighbor classification model using a fusion heuristic algorithm is used to classify the fusion features of the software, obtain the software category corresponding to the fusion features, and identify malicious software in the power industrial control system based on the software category.

[0180] A local mean nearest neighbor classification model based on a fusion heuristic algorithm is used to classify the fusion features of software, resulting in software categories corresponding to the fusion features, including:

[0181] The local mean nearest neighbor classification model includes a subset determination module based on a heuristic algorithm, a nearest neighbor estimation module, and a software category prediction module.

[0182] The subset determination module based on heuristic algorithms uses heuristic algorithms to determine the optimal training data subset set where the fusion feature F of the software is located and the number of nearest neighbors K. The optimal training data subset set consists of S optimal training data subsets determined by heuristic algorithms, and S is set to 3.

[0183] The nearest neighbor estimation module is used to calculate the distance between the fusion feature F of the software and the fusion feature of any training data in the optimal training data subset, and extract the fusion features of the K nearest training data from the optimal training data subset to calculate the local centroid mean vector of the optimal training data subset.

[0184] As an embodiment of the present invention, the formula for calculating the mean vector of the local centroid in the Sth optimal training data subset is as follows:

[0185] ;

[0186] in, This represents the mean vector of the local centroids in the S-th optimal training data subset. This represents the v-th fusion feature that is closest to the fusion feature F in the S-th optimal training data subset extracted by the nearest neighbor estimation module. ;

[0187] The software category prediction module calculates the distance between the fusion feature F of the software and the local centroid mean vector of each optimal training data subset, and selects the software category corresponding to the local centroid mean vector with the smallest distance as the software category corresponding to the fusion feature F.

[0188] As an embodiment of this application, the distance between the fused features is calculated as the reciprocal of the cosine similarity.

[0189] It should be noted that this invention introduces a subset determination module based on a heuristic algorithm, which can adaptively select the optimal training data subset set and the number of nearest neighbors K. This effectively avoids computational redundancy and noise interference caused by an excessively large global training set, thereby improving the computational efficiency and classification accuracy of the model. In the nearest neighbor estimation process, it does not rely on a single sample, but uses the fusion features of the K nearest neighbor samples in the optimal subset to calculate the local centroid mean vector, reducing the impact of outliers and isolated points on the classification results and enhancing the robustness of the model to complex boundary conditions. The software category prediction module determines the category based on the distance between the fusion features and the local centroid mean. Compared with the traditional KNN method that directly relies on the distance of a single point, it can obtain a more stable and interpretable classification basis.

[0190] A heuristic algorithm is used to determine the optimal subset of training data containing the fusion feature F of the software and the number of its nearest neighbors K, including:

[0191] The heuristic algorithm is an improved sparrow search algorithm;

[0192] Initialize and generate B groups of sparrow positions, each group of sparrow positions including the numbers of S training data subsets and the number of nearest neighbors;

[0193] Construct a fitness function that takes the sparrow's location as input:

[0194] ;

[0195] Where loc represents the sparrow's position. For the fitness function, The fitness function value representing the sparrow's position. The position of a sparrow is any position in the z-th training data subset of loc. The mean of the fusion features of the training data, F represents the fusion features of the software. Represents the mean of fusion features The distance between F, Let be the number of nearest neighbors in the sparrow's position loc; specifically, Represents the mean of fusion features The reciprocal of the cosine similarity with F;

[0196] The sparrow positions are sorted in ascending order of fitness function values. The top 20% of sparrow positions are selected as discovery positions, the bottom 20% as alert positions, and the remaining sparrow positions as follower positions. Based on the improved adaptive mutation factor, the sparrow positions are iterated until the number of iterations reaches the preset maximum number of iterations (e.g., 50). The iteration is then terminated, and the sparrow position with the smallest fitness function is output. Based on the output sparrow position, the optimal training data subset set containing the fusion feature F and the number of nearest neighbors K are selected.

[0197] The improved adaptive mutation factor is:

[0198] ;

[0199] in, This represents the adaptive mutation factor at the q-th iteration of the sparrow's position. Represents the t-distribution, Represents the scaling factor, set It is 5. Represents the critical iteration value, set It is 10.

[0200] Specifically, in traditional sparrow search algorithms, the update of individual positions mainly relies on the guidance of the global optimum and local information. However, in complex search spaces, this can easily lead to early stagnation in local optima or slow convergence in later stages. Introducing an adaptive mutation factor into the algorithm can significantly enhance its search capabilities at different stages. When the adaptive mutation factor is close to zero, its effect is more inclined to perturb the current position of the individual, thereby promoting the local development of the population in the neighborhood of the optimal solution. This characteristic ensures that in the later stages of iteration, the algorithm can explore the solution space meticulously, avoiding missing better solutions due to insufficient search precision. Conversely, when the adaptive mutation factor is far from zero, it means that a larger perturbation is applied during the individual position update process, enabling the searched individuals to traverse a larger range of the solution space, thereby enhancing global exploration capabilities. This characteristic ensures that in the early stages of iteration, the population can escape local optima with a high probability and quickly expand the search range. By dynamically adjusting the adaptive mutation factor, the algorithm can maintain diversity in the early stages, preventing premature convergence; in the middle and later stages, it gradually reduces global perturbation, focusing on fine-grained searches near high-quality solutions. Overall, the adaptive mutation factor achieves a balance between global exploration and local exploitation, which not only improves the algorithm's ability to escape local optima in complex spaces, but also enhances the convergence accuracy and speed in the later stages, thereby improving the overall stability and solution performance of the algorithm.

[0201] As an embodiment of this application, the iterative formula for the discovery location is:

[0202] ;

[0203] in, This represents the discovery location obtained in the q-th iteration.

[0204] Indicates the location of discovery The iterative results, Describing the L2 norm, Let f(x) represent the sparrow position with the smallest fitness function value among the sparrow positions in group B obtained in the q-th iteration. Indicates the location of discovery The iteration direction vector;

[0205] The iterative formula for the following position is:

[0206]

[0207] ;

[0208] in, This represents the following position obtained in the q-th iteration. Indicates following position The result of the (q+1)th iteration. Represents a random number between 0 and 1. This represents the sparrow position with the largest fitness function value among the sparrow positions in group B obtained in the q-th iteration. This indicates the preset maximum number of iterations (e.g., 50). This represents the iteration step size for the q-th iteration, determined based on the simulated annealing algorithm. This indicates the initial step size set (e.g., 0.5). Indicates the annealing rate, set It is 3;

[0209] The iterative formula for the alert position is:

[0210] ;

[0211] in, This represents the alert position obtained in the q-th iteration. Indicates alert position The result of the qth iteration;

[0212] Specifically, after each iteration, the sparrow positions are reordered in ascending order of fitness function values, and the top 20% of sparrow positions are selected as discovery positions, the bottom 20% as alert positions, and the remaining sparrow positions as follower positions.

[0213] Reference Figure 2 , Figure 3 as well as Figure 4 As shown, this is Embodiment 2 of the present invention:

[0214] As a comparative experiment of the malware identification and analysis method for power industrial control systems provided in one embodiment of the present invention, a power industrial control system simulation platform was used as the experimental environment. A software testing environment was deployed, and static and dynamic operating sample data from the power operating system were collected. The total number of samples was 2000, including 1200 normal software samples and 800 malware samples. The power industrial control system simulation platform can simulate the industrial control logic interaction, network communication process, and multi-dimensional operating conditions of the power operating system in actual operation. Based on this simulation platform, a software testing environment was deployed to monitor and collect software operating behavior under real power operating load conditions, thereby ensuring that the experimental results have high consistency and reference value with real power industrial control scenarios.

[0215] The sample data used in the experiment came from the publicly available FalDroid dataset. The FalDroid dataset is a malware detection dataset specifically built for industrial control systems and power system application scenarios. It covers running samples of various industrial control system application software. Specifically, the FalDroid dataset includes normal software samples of power dispatching, PLC control logic, and common industrial control protocol parsing applications, while also covering multiple types of malware samples such as viruses, Trojans, worms, and backdoors. It provides static features (bytecode, call relationships, decompiled structure) and dynamic features (system calls, memory access, register operations), and can support comprehensive analysis of multimodal features.

[0216] In the comparative experiment, the following three methods were compared respectively:

[0217] Method 1 (Traditional KNN classification method): The static feature sequence and the dynamic feature sequence are directly concatenated and input into the KNN model, and the number of nearest neighbors is set to K=5 for software category recognition;

[0218] Method 2 (Traditional Feedforward Neural Network Classification Method): The static feature sequence and the dynamic feature sequence are directly input into the FNN for training and classification, using the cross-entropy loss function, and iterating for 500 rounds;

[0219] Method 3 (the method of this invention);

[0220] The experiment used accuracy, recall, and F1 score as evaluation metrics, as shown in the figure below. Figure 2 The graph shown illustrates the change in classification accuracy over training epochs. Figure 3 The graph showing the change in Recall with training epochs and Figure 4 The graph shows the change in F1-score with the number of training rounds.

[0221] The comparative results show that: Method 1 (traditional KNN classification method) converges slowly, with the accuracy eventually stabilizing at about 79%. The recall and F1-score remain around 72%~73% in the later stages of training, and the false negative rate is relatively high when identifying malware. Method 2 (traditional feedforward neural network classification method) shows a significant improvement under the same number of rounds, with the accuracy eventually reaching about 85.6%. The recall and F1-score are improved by 5%~7% compared to Method 1, and eventually stabilize at about 81%. Method 3 (the method of this invention) utilizes a heuristically improved local mean nearest neighbor classifier, which has advantages in both convergence speed and final accuracy. The final accuracy reaches close to 90%, and the final recall reaches about 87%, and the F1-score reaches 86.8%, which is significantly better than the comparative methods.

[0222] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0223] It should be noted that the sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0224] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0225] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for identifying and analyzing malicious software in power industrial control systems based on artificial intelligence, characterized in that, The method includes: S1: Deploy a software testing environment to collect static and dynamic operating sample data of the software in the power operating system. S2: Perform static feature extraction on static running sample data to obtain the static feature sequence of the software, and perform dynamic feature extraction on dynamic running sample data to obtain the dynamic feature sequence of the software. The static feature sequence includes the instruction sequence of the executable file, the PLC control logic node sequence, and the string text sequence. The dynamic feature sequence includes the function call graph adjacency matrix, memory features, protocol features, and system features. S3: Use a physical information neural network based on an improved feature dimensionality reduction strategy to fuse static and dynamic feature sequences to obtain the fused features of the software. S4: The local mean nearest neighbor classification model using a fusion heuristic algorithm is used to classify the fusion features of the software, obtain the software category corresponding to the fusion features, and identify malicious software in the power industrial control system based on the software category.

2. The method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence as described in claim 1, characterized in that, Static and dynamic operational sample data of the software in the power industrial control system were collected in a software testing environment, including: The software in the power industrial control system consists of the original PLC firmware, HMI application installation package, and SCADA software. The static running sample data acquisition process of the software is as follows: The software is unpacked, and the HMI application installation package and SCADA software executable files are extracted. The hash value of the executable file name is calculated, and the executable file is deduplicated based on the hash value to obtain the deduplicated executable file. The deduplicated executable file is disassembled to obtain the instruction sequence of the executable file; The original PLC firmware in the software is decoded to generate a sequence of PLC control logic nodes, which consists of PLC control logic nodes. Extract visible strings from the instruction sequence of the executable file as the software's string text sequence; The instruction sequence of the executable file, the sequence of PLC control logic nodes, and the string text sequence are used as static running sample data for the software. The dynamic sample data acquisition process of the software is as follows: The software testing environment generates software running instances, monitors the software's running process, and captures system call logs during software operation. The system call logs include call type, call parameters, and call timestamps. Capture the function call sequence in the HMI application installation package and the executable file of the SCADA software during software operation; Capture the memory access logs of registers in the original PLC firmware during software operation; Capture protocol interaction logs of industrial protocols and network protocols during software operation; System call logs, function call sequences, memory access logs, and protocol interaction logs are used as dynamic runtime sample data for the software.

3. The method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence as described in claim 2, characterized in that, Static feature extraction is performed on the static running sample data to obtain the software's static feature sequence, including: Extract static runtime sample data of the software; The instruction sequence of the executable file is converted into an instruction call graph, which is a directed graph structure. The instruction call graph is converted into an instruction call graph adjacency matrix. In the instruction call graph adjacency matrix, if there is a pointing relationship between instructions, the corresponding position element is 1; otherwise, the corresponding position element is 0. The PLC control logic node sequence is converted into a PLC logic call graph, which is a directed graph structure. The PLC logic call diagram is converted into a PLC logic call diagram adjacency matrix. In the PLC logic call diagram adjacency matrix, if there is a pointing relationship between PLC control logic nodes, the corresponding position element is 1; otherwise, the corresponding position element is 0. The visible strings in the string text sequence are converted into binary form to obtain binary bit strings, and then the binary bit strings are converted into bytecode sequences, where the bytecode sequence consists of multiple bytecodes, each storing 8 bits of binary code; Each bytecode is mapped to a range of 0-255 as a pixel value to obtain the bytecode image of the string text sequence; The software instruction call graph adjacency matrix, PLC logic call graph adjacency matrix, and bytecode image are used as static features to form a static feature sequence.

4. The method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence as described in claim 2, characterized in that, Dynamic feature extraction is performed on dynamically running sample data to obtain the software's dynamic feature sequence, including: Extract dynamic runtime sample data of the software and convert the function call sequence into a function call graph, where the function call graph is in the form of a directed graph. The function call graph is converted into a function call graph adjacency matrix. In the function call graph adjacency matrix, if there is a pointing relationship between functions, the corresponding position element is 1; otherwise, the corresponding position element is 0. Extract memory access logs and calculate the software's memory characteristics, including the frequency distribution of memory addresses, the read-write ratio, and the average access size. The frequency distribution of memory addresses is the access frequency of different memory addresses, the read-write ratio is the ratio between the number of read operations and the number of write operations in the memory access log, and the average access size is the average number of bytes accessed in memory. Extract the protocol interaction logs and calculate the protocol characteristics of the software, including the frequency distribution of register addresses, register read / write ratio, and average response latency. Extract system call logs and calculate the system characteristics of the software, including the frequency distribution of different call types, the mean of system call time intervals, the variance of system call time intervals, and the transition matrix of call types; The function call graph adjacency matrix, memory features, protocol features, and system features are used as dynamic features of the software, forming a sequence of dynamic features of the software.

5. The method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence as described in claim 1, characterized in that, The physical information neural network based on the improved feature dimensionality reduction strategy includes an input layer, a graph dimensionality reduction layer, a feature dimensionality reduction layer with entropy attention, a convolutional layer, a hidden layer, a physical information probability classification layer, and a fusion layer, including: Obtain the training dataset, which consists of training data subsets for M software categories. Each training data subset includes multiple sets of training data, and each set of training data includes static feature sequences, dynamic feature sequences, and real software categories. The input layer is used to receive static feature sequences and dynamic feature sequences and perform standardization processing; The graph dimensionality reduction layer, the feature dimensionality reduction layer with entropy attention, and the convolutional layer sequentially perform dimensionality reduction processing on the standardized matrix, non-matrix, and bytecode images to obtain the corresponding dimensionality-reduced features. The graph dimensionality reduction layer is used to perform graph convolution and dimensionality reduction on the standardized matrix to obtain a graph dimensionality reduction vector. The standardized matrix includes the standardized instruction call graph adjacency matrix, the PLC logic call graph adjacency matrix, and the call type transition matrix. The feature dimensionality reduction layer with fusion entropy attention is used to calculate the entropy attention weights of the non-matrix features after standardization, and to weight the non-matrix features after standardization to reduce the proportion of unimportant features. Convolutional layers are used to perform convolutional processing on bytecode images to obtain dimensionality-reduced feature maps of the bytecode images; Hidden layers are used to perform nonlinear mapping on the dimensionality-reduced features to obtain nonlinear features. Hidden layers include fully connected layers, activation functions, and batch normalization layers, and nonlinear mapping is performed based on fully connected layers, activation functions, and batch normalization layers. The physical information probabilistic classification layer uses the Parzen window function and Bayesian probability to generate the probability distribution of nonlinear features in different software categories; The fusion layer is used to stitch together nonlinear features and probability distributions as the fusion feature F of the software.

6. The method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence as described in claim 5, characterized in that, A physical information neural network based on an improved feature reduction strategy is used to fuse static and dynamic feature sequences, including: The process of graph convolution and dimensionality reduction of the standardized matrix by the graph dimensionality reduction layer is as follows: The standardized matrix is ​​then normalized to obtain the normalized result. The normalization operation is as follows: ,in Let C denote the identity matrix, and let C denote the standardized matrix. This represents the result of normalization of C; Generate normalized results The degree matrix D; Based on the normalization results And perform graph convolution on the degree matrix D to obtain the graph convolution feature map H: ； ； Where A represents an intermediate parameter. Represents the ReLU function. express function, All are trainable graph convolution weight matrices; The average of all rows of the graph convolution feature map H is used to obtain the graph dimension reduction vector corresponding to the standardized matrix. The feature entropy attention weight calculation process for the feature dimensionality reduction layer with fusion entropy attention is as follows: Obtain the non-matrix after standardization Calculate the non-matrix after standardization Related standard features Deviation between and the deviation Mapped to adaptive weighting coefficients : ； ； in, This represents an exponential function with the natural constant as its base. This represents the scaling parameter. For transpose parameter, Indicates an exponential parameter; Based on adaptive weighting coefficients The calculation yields the non-matrix after standardization. Feature entropy attention weights: ； ； in, Represents the non-matrix after standardization. Feature entropy attention weights Represents the non-matrix after standardization. The feature entropy, This represents a non-matrix set after standardization. Represents a non-matrix set after standardization. Any non-matrix after standardization in the matrix, This represents the adaptive weighting coefficient of j. This represents the attention control coefficient. Indicates attention smoothing terms; The fusion layer is used to stitch together nonlinear features and probability distributions as the fusion feature F of the software.

7. The method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence as described in claim 6, characterized in that, A local mean nearest neighbor classification model based on a fusion heuristic algorithm is used to classify the fusion features of software, resulting in software categories corresponding to the fusion features, including: The local mean nearest neighbor classification model includes a subset determination module based on a heuristic algorithm, a nearest neighbor estimation module, and a software category prediction module. The subset determination module based on heuristic algorithms uses heuristic algorithms to determine the optimal training data subset set where the fusion feature F of the software is located and the number of nearest neighbors K. The optimal training data subset set consists of S optimal training data subsets determined by heuristic algorithms. The nearest neighbor estimation module is used to calculate the distance between the fusion feature F of the software and the fusion feature of any training data in the optimal training data subset, and extract the fusion features of the K nearest training data from the optimal training data subset to calculate the local centroid mean vector of the optimal training data subset. The software category prediction module calculates the distance between the fusion feature F of the software and the local centroid mean vector of each optimal training data subset, and selects the software category corresponding to the local centroid mean vector with the smallest distance as the software category corresponding to the fusion feature F.

8. The method for identifying and analyzing malicious software in a power industrial control system based on artificial intelligence as described in claim 7, characterized in that, A heuristic algorithm is used to determine the optimal subset of training data containing the fusion feature F of the software and the number of its nearest neighbors K, including: The heuristic algorithm is an improved sparrow search algorithm; Initialize and generate B groups of sparrow positions, each group of sparrow positions including the numbers of S training data subsets and the number of nearest neighbors; Construct a fitness function that takes the sparrow's location as input: ； Where loc represents the sparrow's position. For the fitness function, The fitness function value representing the sparrow's position. The position of a sparrow is any position in the z-th training data subset of loc. The mean of the fusion features of the training data, F represents the fusion features of the software. Represents the mean of fusion features The distance between F, This represents the number of nearest neighbors in the sparrow's position loc; The sparrow positions are sorted in ascending order of fitness function values. The top 20% of sparrow positions are selected as discovery positions, the bottom 20% as alert positions, and the remaining sparrow positions as follower positions. Based on the improved adaptive mutation factor, the sparrow positions are iterated until the number of iterations reaches the preset maximum number of iterations. The iteration is then terminated, and the sparrow position with the smallest fitness function is output. Based on the output sparrow position, the optimal training data subset containing the fusion feature F and the number of nearest neighbors K are selected. The improved adaptive mutation factor is: ； in, This represents the adaptive mutation factor at the q-th iteration of the sparrow's position. Represents the t-distribution, Indicates the scaling factor. This represents the critical iteration value.

Images