Power grid vulnerability micropatch generation method, system and device based on call chain backtracking and medium

Abstract

The invention discloses a power grid vulnerability micropatch generation method, system and device based on call chain backtracking and a medium, and belongs to the technical field of network security, and the method comprises the following steps: based on a dynamic probe, realizing kernel layer protocol analysis, lock-free acquisition of system call and user state call chain reconstruction; key path marking is realized through LLVM-IR semantic analysis and power business feature matching; generating a security micropatch based on the metadata and realizing isolated hot loading; and the patch compatibility is ensured by adopting digital simulation verification and a layered release mechanism. The method has the advantages that a five-dimensional cooperative power grid active defense system of observation-modeling-reasoning-evaluation-arrangement is constructed, millisecond observation is achieved through eBPF collection synchronized with PTP, a multi-domain ontology atlas supports cross-domain reasoning, a GNN-RL model predicts an attack path, protection logic is verified through double-target-range simulation, and the method is high in reliability and high in reliability. The intention-driven mechanism realizes second-level response, and a complete closed loop from threat perception to adaptive protection is formed.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, system, device, and medium for generating micro-patches for power grid vulnerabilities based on call chain backtracking. Background Technology

[0002] The original product involved in this invention is a core real-time monitoring and control platform in the power grid dispatch automation system, namely, an integrated SCADA / EMS system running in the central control center. This system is based on a distributed real-time database and continuously receives telemetry, telesignaling, and status data from the front-end processor, remote terminal units, smart substation fusion units, and relay protection IEDs through a multi-threaded real-time acquisition engine. It then uses event-driven logic and a high-precision timestamp mechanism to denoise, time-correct, and verify the consistency of all arriving data streams before writing them into a shared memory pool for concurrent reading and processing by the visualization monitoring subsystem, alarm linkage subsystem, and energy management optimization module. The SCADA section is responsible for building a real-time topology map of the primary equipment across the entire network and maintaining the second-level updates of basic operating parameters such as substation switching quantities, line power, and bus voltage. The EMS section runs scheduling optimization algorithms such as power flow calculation, generation plan verification, spinning reserve assessment, short-term load forecasting, and transient stability analysis on this basis. It pushes scheduling instructions to the provincial, national, and even cross-regional control centers through the northbound interface, and accurately sends active / reactive power regulation and switching operation instructions to the field primary equipment actuators through the southbound interface via dedicated protocols such as IEC60870-5-104, IEC61850-GOOSE, and DNP3.

[0003] The most fundamental function of this system is to provide a real-time closed-loop control environment for power grid production that can operate sustainably under millisecond-level latency constraints. This ensures continuous monitoring, timely alarming, and safe control of the entire network's voltage, frequency, power flow, and equipment status, thereby supporting a stable, economical, and high-quality power supply. It ensures that scheduling commands are parsed, verified, conflict-resolved, and issued within a fixed time window through a soft real-time thread scheduling framework; maintains high availability through dual-machine hot standby and fault transfer modules; strictly separates control commands from information monitoring flows through a redundant network and isolated protection zone system to prevent mutual interference; and provides real-time linkage information such as setting issuance, remote control interlocking, and logic interlocking to relay protection devices through online interfaces. This enables the fastest possible coordination of generator sets, FACTS devices, and switching equipment to implement orderly segmentation or load shedding when power grid anomalies occur. Simultaneously, it serves as a real-time data source and control entry point for upper-level intelligent scheduling, energy market clearing, and data mining platforms, undertaking the mission of unified coordination and control of distributed power sources, high-proportion renewable energy, high-voltage DC, and flexible transmission equipment.

[0004] In terms of functionality, the system ensures clock consistency among all monitoring and control devices, server nodes, and network switches through a high-precision timing unit and a PTP-IEEE1588 Boundary Clock; it ensures that the massive southbound telemetry stream and the northbound optimized command stream do not block each other through a dual-channel message bus and shared memory; it performs real-time redundancy correction on the raw measurement data through a pre-set state estimation model and topology comparison logic to improve monitoring accuracy; it achieves defense-in-depth through multi-level security domain isolation, deep packet inspection, and a whitelist firewall to ensure that the control command link is protected from illegal tampering; and it continuously outputs a scheduling scheme that meets constraints during network load fluctuations, communication anomalies, or equipment failures through a hierarchical scheduling strategy and a priority arbitration mechanism. The entire system uses industrial PCs, real-time operating systems, distributed memory databases, fieldbus adapters, and protocol stack libraries as basic hardware and software units, forming the "nerve center" of the power grid operation, directly related to the safety of transmission and distribution equipment, the power supply quality for end users, and the efficiency of the power market operation. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problems solved by this invention are: real-time control and security protection are difficult to balance, traditional repair solutions may interrupt services or introduce performance jitter; the exploit chain of power-specific protocol vulnerabilities is deeply coupled with the business critical path, making it difficult to accurately locate; patches may affect the timing determinism of core functions such as relay protection; and compatibility verification and rollback mechanisms for patches are lacking in distributed deployment environments.

[0007] To address the aforementioned technical problems, this invention provides the following technical solution: a method for generating micro-patches for power grid vulnerabilities based on call chain backtracking, comprising,

[0008] Based on dynamic probes, execution context data of protocol parsing and system calls are collected at the kernel layer. Data collection is achieved through lock-free buffers, and time-stamped call chain graphs are generated asynchronously in user space. The call chain is decompiled into an LLVM-IR intermediate representation and SSA-form semantic triples are extracted. Subgraph isomorphic matching is performed with the power business feature library through multi-dimensional weight calculation. Key semantic paths are marked according to relevance scores, and the annotation process is completed based on a distributed consistency mechanism. Micro-patch code segments containing security protection logic are automatically generated based on vulnerability description metadata. Runtime function replacement is achieved through isolated loading and hot-plugging technology, and memory injection protection mechanisms and real-time monitoring are integrated to complete vulnerability repair. The execution sequence of the production environment is reproduced through a digital real-time simulator and the deviation vector is calculated. A layered rolling release strategy combined with the CAP-KP-Δ protocol is used to control patch deployment, and automatic rollback and long-term drift assessment are achieved based on multi-dimensional monitoring indicators.

[0009] As a preferred embodiment of the power grid vulnerability micro-patch generation method based on call chain backtracking described in this invention, the dynamic probe technology is implemented using the eBPF framework and includes a probe program that hooks protocol parsing functions, thread scheduling points, and system call interfaces.

[0010] The lock-free buffer is a per-CPU circular buffer that adopts the RCU priority inheritance strategy.

[0011] The asynchronous reconstructed call chain topology includes generating nodes based on process / thread identifiers, CPU and instruction pointers, and calculating call path fingerprints using an anti-collision hash algorithm.

[0012] The anti-collision hashing algorithm uses SipHash-2-4 to generate a 256-bit path fingerprint and uses Bloom Filter for duplicate detection.

[0013] As a preferred embodiment of the power grid vulnerability micro-patch generation method based on call chain backtracking described in this invention, the semantic triple extraction includes:

[0014] Based on libLLVM, the call chain function is decompiled into SSA form, constructing a structure containing opcodes, operand sets, and protocol field attributes.<Opcode,OperandSet,AttributeMask> The triple, in which AttributeMask extends the ProtoFieldID and ProtoFieldOffset members to enable bit-level protocol traceability.

[0015] As a preferred embodiment of the power grid vulnerability micro-patch generation method based on call chain backtracking described in this invention, the multi-dimensional weight calculation includes:

[0016] The structural weight Wstruct is based on matching depth and continuity score, the data domain weight Wdata is based on protocol field correspondence and register active interval overlap, and the timing weight Wtime is based on operation phase difference. The overall relevance is obtained by weighted summation S = α·Wstruct + β·Wdata + γ·Wstruct.

[0017] The weight coefficients α, β, and γ are obtained by training on the historical scheduling replay set through Bayesian optimization and are dynamically adjusted every 24 hours by the online A / B threshold drift monitoring service.

[0018] The hierarchical marking includes: when the overall relevance is higher than the threshold τcrit, it is marked as a business-critical semantic path; when it is lower than τwarn, it is archived to the cold index; and when it is higher than τwarn but lower than τcrit, it enters the gray area to wait for supplementary records.

[0019] As a preferred embodiment of the power grid vulnerability micro-patch generation method based on call chain backtracking described in this invention, the vulnerability description metadata includes: entry function address, buffer boundary information, dangerous parameter offset and register active range, and is associated with the source code location through the DWARF symbol table.

[0020] The generation of micro-patch code segments containing security protection logic includes,

[0021] Within an independent namespace, the vulnerable function is compiled into LLVM-IR, InlineGuardPass is injected for return address verification, and BoundaryCheckPass is injected for buffer boundary checks, ultimately generating an ELF shadow segment protected by RELRO and BIND_NOW.

[0022] As a preferred embodiment of the power grid vulnerability micro-patch generation method based on call chain backtracking described in this invention, wherein: the InlineGuardPass inserts cmp%rip, %gs:0x0 instruction to verify NX protection status, and BoundaryCheckPass synthesizes parameter purification logic and triggers ud2 abnormal termination of execution when a violation occurs.

[0023] The hot-plugging technology includes: loading patches into isolated threads via memfd_create, limiting the patch scope using dlmopen, and selecting either endbr64 jump or PatchedImportAddressTable method to implement function replacement based on CPU characteristics.

[0024] As a preferred embodiment of the power grid vulnerability micro-patch generation method based on call chain backtracking described in this invention, the digital real-time simulator includes: reproducing the scheduling process memory snapshot through IEC61850-9-2LE sampling value stream and IEC60870-5-104 telemetry stream, achieving time base accuracy using PTP-BC clock synchronization, and calculating the instruction-level deviation vectors Δt, Δd, and Δc using ftrace-perf-intel-pt dual-channel sampling.

[0025] The automatic rollback mechanism includes: when Δt≥5ms or Δcpu≥5%, restoring the snapshot via btrfssubvolsnapshot and triggering dlclose+CETShadow-Stack to clean up patch remnants.

[0026] This invention provides a system for generating micro-patches for power grid vulnerabilities based on call chain backtracking.

[0027] To address the aforementioned technical problems, this invention provides the following technical solution: a system for generating micro-patches for power grid vulnerabilities based on call chain backtracking, comprising: a non-intrusive call chain tracing and backtracking engine, a semantic tag generation and business logic alignment engine, a micro-patch generation and memory malware protection module, and a relay protection compatibility verification and layered release module.

[0028] The non-intrusive call chain tracing and backtracking engine dynamically captures SCADA / EMS kernel layer system calls and protocol parsing logic without interfering with real-time scheduling, and constructs a complete call chain topology.

[0029] The semantic tag generation and business logic alignment engine maps the call chain to the power business logic and identifies vulnerability paths associated with key scheduling instructions.

[0030] The micro-patch generation and memory malware protection module dynamically generates micro-patches for vulnerability paths and binds an anti-memory malware injection mechanism.

[0031] The relay protection compatibility verification and layered release module verifies the compatibility of the patch with the relay protection logic and releases it through layered grayscale release.

[0032] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of the above-described method for generating micro-patches for power grid vulnerabilities based on call chain backtracking.

[0033] The present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of the above-described method for generating micro-patches for power grid vulnerabilities based on call chain backtracking.

[0034] The beneficial effects of this invention are as follows: By constructing a five-dimensional collaborative closed-loop defense system of "observation-modeling-reasoning-evaluation-orchestration," a paradigm shift in power grid security defense from passive response to proactive prediction and adaptive control is achieved. At the observation layer, a semantically aware bus based on PTP clock synchronization and a zero-copy eBPF ring buffer enables millisecond-level lossless acquisition of power protocol data. At the knowledge layer, a heterogeneous graph database integrating multi-domain ontology supports joint reasoning across physical, control, and information domains. At the reasoning layer, a GNN-RL combined model can proactively generate probability-weighted attack evolution paths. At the evaluation layer, electromagnetic-information dual-target field coupling simulation and sub-millisecond drift detection ensure accurate verification of protection logic. At the orchestration layer, an intent-driven adaptive defense mechanism achieves second-level closed-loop response. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a flowchart illustrating the overall process of a method for generating micro-patches for power grid vulnerabilities based on call chain backtracking, as provided in one embodiment of the present invention.

[0037] Figure 2 This is an overall framework diagram of a power grid vulnerability micro-patch generation system based on call chain backtracking, provided as an embodiment of the present invention. Detailed Implementation

[0038] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0039] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides a method for generating micro-patches for power grid vulnerabilities based on call chain backtracking, including:

[0040] S1. Based on dynamic probes, the kernel layer collects execution context data of protocol parsing and system calls. Data collection is achieved through lock-free buffers, and a call chain graph with time stamps is generated asynchronously in user space.

[0041] The dynamic probe technology is implemented using the eBPF framework, including probe programs that hook protocol parsing functions, thread scheduling points, and system call interfaces.

[0042] The lock-free buffer is a per-CPU circular buffer that uses an RCU priority inheritance strategy.

[0043] The asynchronous refactoring call chain topology graph includes generating nodes based on process / thread identifiers, CPU and instruction pointers, and calculating call path fingerprints using an anti-collision hash algorithm.

[0044] The collision-resistant hashing algorithm uses SipHash-2-4 to generate a 256-bit path fingerprint and uses Bloom Filter for duplicate detection.

[0045] Isolated deployment involves loading the probe program into a separate kernel namespace to ensure isolation from the production environment.

[0046] Dynamic regulation includes bandwidth monitoring based on cgroupv2, which automatically reduces the tracking granularity when resource usage is too high.

[0047] In this implementation, the core objective of S1 is to construct a hot-swappable, non-intrusive system call tracing and call chain backtracking engine at the SCADA and EMS host kernel layers. This ensures the full observability of the parsing logic for power-specific protocols such as Modbus / TCP and IEC60870-5-104, while maintaining the deterministic scheduling characteristics of the real-time control system. During implementation, three types of programs based on eBPF—BPF_PROG_TYPE_KPROBE, BPF_PROG_TYPE_UPROBE, and BPF_PROG_TYPE_TRACEPOINT—are loaded into the Linux 5.x kernel. These programs hook the protocol parsing entry function, the SCADA scheduling thread context switching point, and the system call return gate, respectively. The kernel registers the corresponding pointer with the `bpf_attach_kprobe` / `bpf_attach_uprobe` interfaces to ensure that BPF bytecode execution is triggered immediately when the target symbol is loaded into the ready state by the scheduler. Internally, the bytecode calls `bpf_get_stackid` and `bpf_get_regsAPIs` to collect the user-mode function call stack, register mappings, and thread-local pointers, adding the timestamp, CPUID, and process identifier to the metadata header. To avoid introducing additional latency from system calls, all trace records are written to a per-CPU lock-free circular buffer driven by `bpf_ringbuf_output`, and an RCU priority inheritance strategy ensures that no lock contention or priority inversion occurs during write paths.

[0048] Subsequently, the user-space daemon reads the event stream from the circular buffer using epoll edge-triggered mode and immediately moves the buffer in batches to the NUMA local shared memory area using the non-blocking io_uring mechanism, achieving zero-copy reclamation. During this process, the kernel PMU cycle count is obtained through perf_event_open, and a hardware sequence identifier accurate to the CPU cycle level is injected into each system call record for subsequent sorting and restoration. The daemon writes the raw events into the IMMUTABLE mapping file in slices of block_size=4MiB, creates anonymous handles using memfd_create and maps them to a high-address read-only segment, and uses M-protect to force read-only access to isolate the tracing data from the business process address space, preventing kernel-space buffer data corruption.

[0049] During the data reconstruction phase, the backtracking engine loads the LLVM-IR version of the incremental topology builder: first, it creates a preceding node based on a quadruple of system call number, PID, TID, and CPUID; then, it determines the sub-call edges based on the instruction pointer and return address in the register context and inserts them into the edge table in topological order; finally, it uses a hierarchical time window to merge the call chains distributed across CPUs into a directed acyclic graph and calculates a 256-bit path fingerprint through recursive hash linking. To ensure the verifiability of the collision probability during fingerprint calculation, the system uses SipHash-2-4 as the compression function and writes it into a Bloom filter in real time to eliminate duplicate paths in O(1) complexity, thereby improving the efficiency of subsequent template matching.

[0050] The security hardening of the tracing engine is implemented through a two-level capability domain: the kernel domain uses BPFLSM with additional extensions to inspect every uprobes triggering behavior, blocking tracing event writes from non-whitelisted threads; the user-space domain uses seccomp-bpf to limit the daemon process system call set, retaining only io_uring_enter, read, write, mmap, mprotect, clock_gettime, and exit, to avoid the risk of privilege escalation due to exploitation of tracing logic. Simultaneously, in the NUMA domain, cgroupv2's eBPF counters track the write rate of each service thread to the circular buffer, and automatically reduce the tracing granularity when the rate reaches 80% of the bandwidth limit, preventing circular buffer overwriting caused by flooded call bursts and ensuring the robustness of the real-time system.

[0051] Finally, to maintain a purely non-intrusive nature towards the target process, all probes and uprobes segments are loaded into a separate BPFFS namespace using the ` / sbin / bpftoolprogloadall` command in the form of `MAP_TYPE_ARRAY-of-MAPS`, and then mounted under an isolated PID namespace using `mount-tbpffs-onscreate,mode=0700`. This ensures that the tracing code and the production process do not share page table entries, and any probe address drift caused by dynamic relocation is automatically destroyed and redeployed, preventing the scheduling thread from triggering invalid pointer jumps after address randomization updates. This step completes a high-performance, verifiable, and securely isolated system call tracing and call chain backtracking infrastructure, laying a solid foundation for subsequent business semantic alignment, micro-patch generation, and relay protection compatibility verification.

[0052] S2. Decompile the call chain into an LLVM-IR intermediate representation and extract SSA-form semantic triples. Perform subgraph isomorphic matching with the power business feature library through multi-dimensional weight calculation. Mark key semantic paths according to relevance scores and complete the annotation process based on a distributed consistency mechanism.

[0053] Semantic triple extraction includes: decompiling the call chain function into SSA form based on libLLVM, and constructing a triple containing opcode, operand set, and protocol field attributes.<Opcode,OperandSet,AttributeMask> The triple, in which AttributeMask extends the ProtoFieldID and ProtoFieldOffset members to enable bit-level protocol traceability.

[0054] The structural weight Wstruct is based on matching depth and continuity score, the data domain weight Wdata is based on protocol field correspondence and register active interval overlap, and the timing weight Wtime is based on operation phase difference. The overall relevance is obtained by weighted summation S = α·Wstruct + β·Wdata + γ·Wstruct.

[0055] The weight coefficients α, β, and γ are obtained by training on the historical scheduling replay set through Bayesian optimization and are dynamically adjusted every 24 hours by the online A / B threshold drift monitoring service.

[0056] The subgraph isomorphic matching adopts the improved VF2 algorithm, which adds double pruning of OpcodeCluster and ProtoFieldID to the depth-first mapping strategy, and executes it in parallel on 8-way NUMA-bound CPU cores in a lock-free work-stealing manner.

[0057] The hierarchical marking includes: when the relevance is higher than the threshold τcrit, it is marked as a "business-critical semantic path"; when it is lower than τwarn, it is archived to the cold index; and when it is in between, it enters the gray area to wait for supplementary records.

[0058] Distributed consistency mechanisms include: Redis-Cluster enabling the WAIT30 synchronous replication strategy to ensure semantic tuples are persisted to disk, and Neo4j graph database configuring a three-hour snapshot retention strategy to achieve error mapping backtracking.

[0059] The marker results are broadcast to the patch generation scheduler via the ZeroMQ PUB-SUB channel, along with the structure weight matrix and timing offset vector to guide the patch generation priority.

[0060] The power business feature library is stored in the Neo4j graph database. Vertex types include economic dispatch, frequency regulation, and relay protection, while edge types describe sequential dependencies and resource competition relationships.

[0061] Before being stored, semantic triples are compressed using SHA-3-384 hashing and then written into the `semantic_queueList` structure of Redis-Cluster, supporting high-throughput queue operations.

[0062] In this embodiment, the second step involves generating semantic tags for each call chain reconstructed in the previous stage, using the LLVM-IR intermediate representation as a medium, and mapping them one-to-one with the power business logic feature library, thereby identifying vulnerability exploitation paths tightly coupled with key scheduling instructions. This process first loads an IR parser based on libLLVM17.0 in user space, immediately decompiling the binary segment corresponding to each user-space function in the call chain into SSA form, and preserving CFG edge information, register data stream dependencies, and the symbol-level scheduling field parsing order through a pass pipe. The parser then constructs semantic fragments using static single-assignment nodes as basic units, and sequentially writes them using the PatternContext structure.<Opcode,OperandSet,AttributeMask> Triples; to cover the control bytes bound to protocol fields in the instruction sequence, the ProtoFieldID and ProtoFieldOffset members are also extended in AttributeMask to ensure bit-level traceability for Modbus / TCP, IEC60870-5-104 and DNP3 encoded fields.

[0063] After semantic extraction, the system enters the label reduction stage: First, the self-developed SemanticFold algorithm is used to constrain the dimensions of the triples, removing addressing modes and compiler instrumentation noise irrelevant to business decisions; then, a routing table-based instruction channel partitioning technique is used to split all triples into three logical channels—"real-time control," "non-real-time control," and "auxiliary management"—according to control flow priority. Within each channel, data dependencies are then appended according to the topological order.<ChannelID,TimeSlice,ΔT> The tuples are used to form the final semantic tuple sequence. This sequence is SHA-3-384 hashed and compressed before being stored and written into the `semantic_queueList` structure in Redis Cluster to support high-throughput enqueueing and sequential dequeueing.

[0064] The system then activates the business logic feature alignment engine. The feature library pre-stores the power grid business process model in the Neo4j graph database, where vertex types include "economic dispatch," "frequency regulation," "relay protection," and "fault load shedding," and edge types describe sequential dependencies and resource contention relationships. The engine first calls the MATCH(n)-[r:ORDER]->(m) statement to extract subgraphs closely related to the current scheduling cycle and serializes them into memory in JSON-Graph format. Then, based on the improved VF2 subgraph isomorphism algorithm—adding OpcodeCluster and ProtoFieldID dual pruning to the traditional depth-first mapping strategy—parallel matching of semantic tuple sequences and feature subgraphs is performed. The algorithm runs on an 8-way NUMA-bound CPU core, employing a lock-freework-stealing task scheduling method to ensure the completion of millions of node mapping searches within millisecond-level time slices.

[0065] During the matching phase, for successfully mapped node pairs, the system calculates three types of weights: structural weight Wstruct based on matching depth and continuity score; data domain weight Wdata based on protocol field correspondence and register active interval overlap; and time-series weight Wtime based on the phase difference of operations in the periodic load curve. After linear normalization, the weights are weighted and summed to generate the overall relevance S = α·Wstruct + β·Wdata + γ·Wtime. The coefficients α, β, and γ are obtained during system deployment through Bayesian optimization trained on historical scheduling replay sets and dynamically fine-tuned every 24 hours during runtime by the online A / B threshold drift monitoring service.

[0066] When the relevance score is higher than the threshold τcrit, the call chain is marked as a "business-critical semantic path." Simultaneously, all related semantic tuples are assigned a "non-pruning" flag and placed in a read-only queue for direct reference in the third-step patch synthesis. If the score is lower than τwarn, the call chain is archived to the Elasticsearch cold index for offline security analysis. Call chains between the two thresholds enter a "gray zone," where the system waits for supplementary records from the same source thread within the next 30 seconds to determine whether to upgrade the marking. The entire hierarchical process is implemented using a monotonic priority FSM to ensure replayability of state transitions.

[0067] To ensure reliable semantic annotation and avoid introducing race conditions, the system deploys two layers of consistency protection around the alignment engine: First, a WAIT30 synchronous replication strategy is enabled for Redis-Cluster, ensuring that all semantic tuples are persisted to disk before entering the matching process; second, the db.tx_log.rotation.retention_policy strategy is enabled on the Neo4j side, retaining a complete version of the business feature library at three-hour snapshot intervals, facilitating point-in-time backtracking in case of erroneous mappings. This allows the alignment engine to recover a consistent view based on the last successful snapshot even in the event of distributed node failure.

[0068] After calculation, the alignment engine broadcasts all call chain numbers marked as business-critical to the patch generation scheduler via the ZeroMQPUB-SUB channel, along with a structure weight matrix and a timing offset vector. The scheduler then determines the generation order and priority of patch templates based on this information, ensuring that the most potentially damaging vulnerabilities are addressed first. This completes the second step of precise semantic annotation and business relevance classification of the call chains, providing an indispensable knowledge graph-level context for subsequent precise micro-patch instrumentation and runtime compatibility verification.

[0069] S3. Based on the vulnerability description metadata, it automatically generates micro-patch code segments containing security protection logic, realizes runtime function replacement through isolated loading and hot-plugging technology, and integrates memory injection protection mechanism and real-time monitoring to complete vulnerability repair.

[0070] The vulnerability description metadata includes: entry function address, buffer boundary information, dangerous parameter offset and register active range, and is associated with the source code location through the DWARF symbol table.

[0071] Micro-patch generation includes: compiling the vulnerable function into LLVM-IR in an independent namespace, injecting InlineGuardPass for return address verification, and BoundaryCheckPass for buffer boundary checks, ultimately generating an ELF shadow segment protected by RELRO and BIND_NOW.

[0072] InlineGuardPass inserts the command cmp%rip,%gs:0x0 to verify the NX protection status. BoundaryCheckPass synthesizes parameter cleanup logic and triggers ud2 exception to terminate execution when a violation occurs.

[0073] Hot-plugging technology includes: loading patches into isolated threads via memfd_create, limiting the patch scope using dlmopen, and selecting either endbr64 jump or PatchedImportAddressTable to implement function replacement based on CPU characteristics.

[0074] The function replacement process monitors the perf_event_open core event to ensure that the text page modification time window does not exceed 50μs to avoid scheduling jitter.

[0075] Memory injection protection includes: intercepting dynamic linking calls through LD_AUDIT, recursively verifying stack frame write protection flags, and using CETShadowStack to achieve dual defense.

[0076] When a writable executable page or ShadowStack exception is detected, seccomp is immediately triggered to terminate the current thread.

[0077] Real-time monitoring includes comparing patch execution latency with a preset threshold, and triggering a compatibility downgrade rollback mechanism when it exceeds 1.5ms.

[0078] The entire repair process runs under cgroupv2 CPU quota limits and uses the SCHED_DEADLINE policy to ensure critical phase avoidance.

[0079] In this implementation, specifically, S3 focuses on automatically synthesizing micro-patches on call chains that have been identified as business-critical and have hit the exploit chain template. The patches are deeply integrated with anti-memory malware injection mechanisms to achieve dynamic vulnerability repair without interrupting the real-time scheduling thread. The process consists of four interconnected sub-modules: a vulnerability descriptor, a patch generator, a hot-plug loader, and an injection protection barrier. First, after receiving the call chain number broadcast in the second step, the vulnerability descriptor constructs a JSON-formatted "vulnerability description metadata" based on the entry function address, cross-domain buffer boundaries, dangerous parameter offsets, and register active ranges recorded in the call chain. Simultaneously, the descriptor queries the DWARF symbol table to locate the source-level line number and parses relocatable segments using libbfd to obtain a 64-byte snapshot of the machine code before and after the function, providing context for the AST rewriting stage. After description, the metadata is written to the / patch / queue directory in tmpfs for the patch generator to poll.

[0080] The patch generator initiates a "shadow compilation" process based on ClangLibTooling 17.0. This process calls clang-emit-llvm within an independent PID namespace to generate the LLVM-IR for the vulnerability entry function, and then injects two optimized passes, InlineGuardPass and BoundaryCheckPass. InlineGuardPass instrumentes a cmp%rip,%gs:0x0 instruction at the function entry point to verify whether the page to which the return address belongs has failed NX protection. BoundaryCheckPass automatically synthesizes equivalent length checking and parameter cleanup logic based on the buffer size and dangerous parameter offset in the metadata, and triggers a ud2 hard exception to immediately terminate the call chain if the conditions are not met. Subsequently, the generator calls llc-filetype=obj-march=x86-64 to downgrade the IR to an object file, and links it into an independent ELF shadow segment via ld-shared-Bsymbolic-znoexecstack. The linker script explicitly marks the executable segment as PROGBITS|SHF_WRITE|SHF_ALLOC, and enables RELRO and BIND_NOW to constrain the runtime relocation window, preventing the patch itself from being exploited by instrumentation attacks.

[0081] The hot-swap loader takes over the deployment process after the patch is generated. The loader first calls `memfd_create` to create an anonymous file handle, writes the ELF file, and loads it in an isolated user-space thread using `fexecve`. After loading, it places the shadow segment in a new LMid namespace using `dlmopen` to ensure it doesn't interfere with the original application's GOT / PLT entries. The loader then parses the patch ELF's `.symtab`, locates the exported symbols of the patch function and the address of the original binary entry function, and selects the jump method according to the following priority: if the CPU supports CET and the kernel has IBT / SHSTK enabled, it first inserts a 5-byte `endbr64+jmp` short jump before the original function; otherwise, it degenerates to the `PatchedImportAddressTable` (PIAT) technique, sets the original text page to `PROT_READ|PROT_WRITE|PROT_EXEC` using `mprotect`, writes a one-time jump instruction, and immediately restores `PROT_READ|PROT_EXEC`. The entire write process revolves around the perf_event_open monitoring core PMC to ensure that the text page modification time does not exceed 50μs, thus avoiding real-time thread scheduling jitter.

[0082] The injection protection barrier uses the LD_AUDIT mechanism to globally intercept dlopen and PLT parsing, and dynamically injects stack back integrity verification for each function call in the audit callback la_pltenter. Specifically, the barrier uses __builtin_frame_address(0) to recursively traverse the chained stack frames, performs pkey_mprotect flag verification on each level's return address, and immediately triggers seccompSIGSYS to block the current thread if a writable + executable page or XOM bit failure is detected. For inline calls that may bypass the PLT, the patch code also inserts CET-based ShadowStack write protection instructions to compare and verify the stack back register %ssp, forming a double line of defense. At the same time, the barrier compares the function execution result with the timing offset vector generated in the second step. If it finds that the patch intervention causes a delay of more than 1.5ms, it reports a "compatibility degradation" event to the grayscale control center so that the patch can be dynamically rolled back.

[0083] To ensure that patch generation and deployment do not cause side-channel interference to the SCADA / EMS real-time scheduling engine, the entire third step runs at a 15% CPU limit under the cgroupv2 cpu.max quota and is bound to the background I / O level via ionice-c3 to avoid competing with the log collection thread for NVMe bandwidth. During page writes, the loader enables the sched_setattr SCHED_DEADLINE policy to ensure that the write atomic window avoids the scheduling critical phase. Once the patch officially jumps to effect, the loader broadcasts a PatchLoaded signal to the D-Bus bus, along with the patch SHA-256 checksum and entry pointer, to connect to the playback input of the next relay protection compatibility verification pipeline. In this way, the third step completes the immediate replacement of the vulnerable entry function, double-layer protection against illegal memory malware injection, and fine-grained control over real-time scheduling latency, laying the foundation for a rapid, reversible, and verifiable dynamic repair capability for the entire security hardening system.

[0084] S4. The execution timing of the production environment is reproduced by a digital real-time simulator and the deviation vector is calculated. A layered rolling release strategy combined with the CAP-KP-Δ protocol is used to control patch deployment. Automatic rollback and long-term drift assessment are achieved based on multi-dimensional monitoring indicators.

[0085] The digital real-time simulator includes: reproducing memory snapshots of the scheduling process through IEC61850-9-2LE sampled value stream and IEC60870-5-104 telemetry stream; achieving a time base accuracy of ±300ns using PTP-BC clock synchronization; and calculating instruction-level deviation vectors Δt, Δd, and Δc using dual-channel sampling of ftrace-perf-intel-pt.

[0086] The tiered rolling deployment includes: advancing in a three-level sequence of "main control center → substation front-end machine → station remote I / O unit". Each level of deployment uses Raft-BasedPatchLedger to ensure version consistency, LACP+ECMP to ensure link availability, and Gossip protocol to handle network partitions.

[0087] The parameter Δ of the CAP-KP-Δ protocol is defined as the real-time load differential rate not exceeding ±0.3% within 30 seconds after the patch takes effect. CPU usage and context switching metrics are monitored in real time through eBPFtracepoint.

[0088] The automatic rollback mechanism includes: when Δt≥5ms or Δcpu≥5%, restoring the snapshot via btrfssubvolsnapshot and triggering dlclose+CETShadow-Stack to clean up patch remnants.

[0089] If two consecutive rollbacks occur within 10 minutes, the patch version will be automatically blocked, and the process will be synchronized to the SOC platform via the AMQP message bus to form an audit loop.

[0090] Long-term drift assessment uses HotellingT2+Q-Statistic to perform multivariate residual analysis on power flow statistics, event alarms, and protection action bitmaps over 168 hours. If the drift is below the control limit for 10 consecutive windows, patch compatibility is confirmed.

[0091] During the grayscale verification phase, the flow rate is mirrored to the bypass at a line rate of 40Gbps via the FPGA-NIC. The correlation coefficient ρ of the power flow before and after the patch is calculated using the Newton-Raphson method accelerated by SIMD-AVX-512. The requirement is that ρ≥0.9995 and the protection action bitmap has zero difference.

[0092] All patch metadata and replay hashes are archived in WORM-S3 object storage and retained for 5 years to meet Level 3- audit requirements.

[0093] During the release process, SaltStack-Reactor enables second-level transaction rollback and broadcasts state change signals to the D-Bus bus.

[0094] In this implementation, specifically, S4 focuses on performing relay protection logic compatibility verification, layered grayscale release, and real-time rollback control on dynamically loaded micro-patches to ensure that the repaired SCADA / EMS system maintains sub-millisecond timing consistency and a zero-error tripping safety threshold during network-wide operation. The process first starts a homogeneous sandbox in the digital real-time simulator at the control center. This sandbox uses IEC61850-9-2LE sampled value stream and IEC60870-5-104 telemetry / remote control stream as input sources. It replicates a complete memory snapshot of the production scheduling process using system-level checkpointing / recovery technology, reproducing CPU register state, thread scheduling priority, and NUMA affinity under an isolated namespace. Subsequently, it uses PTP-BC hardware timestamps to synchronize the master clock with the sandbox's high-precision clock, controlling the error within ±300ns, thus establishing a unified time base for subsequent instruction-by-instruction latency comparison. The sandbox replays the real scheduling instruction sequence collected over 48 hours at a sampling frequency of 1kHz. It also records the instruction entry time, total execution time, system call chain depth, and cache line miss count before and after the patch takes effect through kernel-level ftrace and perf-intel-pt dual-channel sampling. The comparison engine calculates the ternary deviation vectors Δt (execution latency), Δd (call chain depth), and Δc (cache miss rate) every 10,000 instruction windows. If all three satisfy Δt≤3ms, Δd≤2 layers, and Δc≤1.8%, it is marked as "timing consistent".

[0095] After passing the consistency threshold, the system enters the canary release phase. The canary control center first distributes patches to the dual-machine hot standby SCADA nodes via Ansible-Runner-Pull, and injects iptablesTEE rules before keepalived state machine switching to mirror southbound packets to the safety bypass. Bypass traffic is written to the Netmap-AF_XDP channel at a line rate of 40Gbps via the FPGA-NIC for parallel parsing by the real-time power flow calculator and protection logic simulator. The power flow calculator uses an improved Newton-Raphson method to iterate the voltage amplitude and phase angle of all network nodes, and the protection logic simulator uses IEC60255-151 curves to perform breakpoint simulations of overcurrent, distance, differential, and zero-sequence protection for each line; both run under the SIMD-AVX-512 instruction set to ensure that a full network iteration is completed within 20ms. The system calculates the Pearson correlation coefficient ρ of the power flow vectors Vpre and Vpost before and after the patch in real time, and simultaneously monitors the difference vector Δp ​​of the relay protection action bitmap. When ρ≥0.9995 and |Δp|=0, the grayscale control center issues a switching command to the master VRRPMaster node to achieve smooth service migration.

[0096] After entering the main network, patches are implemented using a tiered rolling release strategy. The release platform proceeds in a three-tiered sequence: "Main Control Center → Substation Front-End Server → Station Remote I / O Unit." Each layer of release follows the CAP-KP-Δ protocol: Consistency (C) records patch hashes and loading transactions via Raft-BasedPatchLedger to ensure complete consistency of the version view during horizontal cutover; Availability (A) ensures the availability of north-south links through dual-link LACP+ECMP load balancing; Partition-Tolerance (P) automatically splits dirty write replicas and reports the highest priority partition in partitioned scenarios via Patch-LockGossip heartbeat; the parameter Δ is defined as the real-time load differential rate not exceeding ±0.3% within 30 seconds after the patch takes effect. When each node loads a patch, the loader uses eBPFtracepoint-basedKPIExporter to write CPU usage, context switch count, and page fault increment to In-MemoryTSDB; the monitoring agent pushes metrics to the PrometheusRemote-Write stream using HTTPS-mTLS, and the alarm rules trigger automatic rollback when Δt≥5ms or Δcpu≥5%.

[0097] The rollback mechanism relies on a dual-path approach of R-LEB snapshots and LSM protection: Once PrometheusAlertmanager receives a high-priority alarm, SaltStack-Reactor calls btrfssubvolsnapshot-r to immediately restore the snapshot before the patch, and simultaneously publishes a PatchRollback signal to D-Bus, notifying the anti-memory malware injection barrier to unhook. Upon receiving the signal, the barrier executes dlclose+CETShadow-Stack cleanup and writes the failed transaction to the patch Ledger. If two rollbacks are triggered consecutively within 10 minutes, the control center automatically marks the corresponding patch as an invalid version and blocks resending. All successful or failed transactions are synchronized to the SOC platform in real time via the AMQP message bus to support the security operations center in forming an auditable closed loop.

[0098] After the patch has been running stably for 168 hours, a long-term drift assessment is initiated on the verification pipeline: the power flow statistics Sflow, event alarm count Sept, relay protection action bitmap Spcl, and performance index Sperf collected during the period are all entered into the MCR (Multivariate Cumulative Residual) sequence; the MCR uses a Hotelling T2+Q-Statistic dual-threshold reasonableness check. If it is below the control limit for 10 consecutive windows, the platform confirms that the patch has achieved long-term compatibility and fixes it into the baseline image of the next cycle. At the same time, the patch metadata, static symbol table, and scheduling replay hash are archived in WORM-S3 object storage and retained for 5 years without deletion to meet the Level 3- audit requirements of power information security classification protection.

[0099] S4 employs a five-loop closed-loop system of "refined simulation → grayscale verification → layered release → real-time rollback → long-term drift assessment" to meticulously verify the timing impact of micro-patches on relay protection and real-time control loops. It monitors operational indicators in real time and rolls back immediately in case of anomalies, ultimately ensuring that the SCADA / EMS system after vulnerability patching maintains instruction determinism, power flow stability, and zero deviation in protection logic under national power grid dispatching scenarios. This achieves persistent protection and reliable operation and maintenance against protocol parsing vulnerabilities and memory malware injection threats.

[0100] This invention replaces the loosely layered "monitoring-analysis-blocking-release" model of existing products with four collaborative subsystems: "real-time kernel observation, semantic graph inference, shadow segment micro-patching, and gray-scale closed-loop operation and maintenance." The fundamental difference lies first in the observation entry point and data plane: This system establishes a full-stack zero-copy tracing path at the kernel layer through eBPF-ringbuf, kprobe / uprobe, and PMU dual-channel hardware timestamps. It can capture register-level data flow, thread priority switching points, and Modbus / IEC 60870-5-104 field bit vectors, and splices the directed call graph in real time using NUMA local shared memory. In contrast, traditional solutions rely on LD_PRELOAD or ptrace hooking, which only records system call numbers and simple parameters. They cannot maintain link integrity in millisecond-level high-concurrency scenarios, nor can they provide cross-CPU causal ordering and hardware phase difference measurement.

[0101] At the analysis logic layer, this system introduces LLVM-IR intermediate representation and an improved VF2 graph isomorphism algorithm to map the instruction-protocol-business three domains into a measurable graph. It calculates the business correlation degree by comprehensively calculating the structural weight, data domain weight, and temporal weight, and optimizes the adaptive threshold drift with Bayesian optimization. Existing products only rely on static disassembly and YARA / Snort byte sequence comparison to identify CVE templates, which lacks business process context. It cannot quantify the risk priority of vulnerabilities to key links such as economic scheduling and protection setting distribution, nor can it avoid misjudging normal out-of-bounds access as an attack path, resulting in both false positives and false negatives.

[0102] At the patch orchestration layer, this system uses Clang-LibTooling to automatically rewrite and generate "shadow segment" ELF files, which are hot-swapped and loaded into an independent LMid namespace. Zero tolerance for runtime memory malware is achieved through triple checks: CETIBT / Shadow-Stack, NX page executability, and pkey_mprotect. The shadow segment enables reversible byte-level jumps via PLT jumps or short jumps at the function front end, allowing a rollback to the original function within 50μs if latency drift exceeds limits. Traditional solutions, on the other hand, rely on offline recompilation or in-situ binary rewriting to overwrite text sections, lacking shadow segment isolation and hardware-level integrity verification. If a patch is injected with faulty code or hooked by an attacker, rollback can only be achieved through system snapshots or manual unloading, resulting in coarse granularity and high time costs.

[0103] At the operation and deployment layer, this system relies on the DRTS isomorphic sandbox to perform microsecond-level comparisons of power flow, protection actions, and CPU-cache line failure rates after patch intervention. Only after meeting the timing consistency thresholds of Δt≤3ms and Δp=0 can it enter the gray-scale phase. During the gray-scale phase, it is verified in real time through VRRP standby switching, FPGA-NIC traffic bypass, Netmap-AF_XDP line-speed acquisition, and Pearsonρ≥0.9995. Subsequently, it is rolled out according to the three-level CAP-KP-Δ protocol of "center-front-end-station". Throughout the process, the eBPF KPI Exporter pushes CPU, context switching, and page fault increments to the TSDB in real time. Prometheus rules automatically trigger SaltStack-Reactor to perform shadow segment-level rollback when Δcpu≥5% or Δlatency≥5ms occurs. Traditional solutions lack digital simulation, gray-scale indicators, and automatic rollback. They can only push out data in a one-size-fits-all manner during planned power outage windows, and there is a lack of real-time performance observation after deployment, which can easily cause false trips or scheduling jitter during peak load periods.

[0104] Finally, regarding continuous compliance and auditing, this system utilizes Raft-Based Patch Ledger to record each shadow segment loading transaction and SHA-256 hash, combined with WORM-S3 five-year retention to meet Level 3 compliance auditing requirements. Simultaneously, an inline GuardPass is embedded within the patch shadow segment to perform bidirectional comparisons between the execution stack backtracking integrity of each function entry point and the Shadow-Stack registers, forming a closed loop of runtime integrity and source traceability. Traditional solutions limit patch integrity verification to the offline package signing stage, lacking dynamic measurement and auditable traceability of the loading path and runtime links.

[0105] In summary, this invention comprehensively addresses the pain points of existing products, such as insufficient time-series observation depth, high semantic misjudgment rate, poor patch reversibility, and uncontrollable release risks, through four core structural innovations: kernel-level high-precision observation, graph-based semantic reasoning, shadow segment micro-patching, and gray-scale closed-loop operation and maintenance. It achieves the goals of millisecond-level dynamic repair, zero-downtime upgrades, and long-term safe and stable operation in power grid industrial control scenarios. Structurally, it has leaped from the traditional "offline-static-manual" paradigm to the "online-dynamic-automatic" paradigm, possessing irreplaceable advanced features and practical value.

[0106] Example 4, refer to Figure 2 This is an embodiment of the present invention, which provides a system for generating micro-patches for power grid vulnerabilities based on call chain backtracking, including: a non-intrusive call chain tracing and backtracking engine, a semantic tag generation and business logic alignment engine, a micro-patch generation and memory malware protection module, and a relay protection compatibility verification and layered release module.

[0107] A non-intrusive call chain tracing and backtracking engine dynamically captures SCADA / EMS kernel layer system calls and protocol parsing logic without interfering with real-time scheduling, and constructs a complete call chain topology graph.

[0108] The semantic tag generation and business logic alignment engine maps the call chain to the power business logic and identifies vulnerability paths associated with critical scheduling instructions;

[0109] The micro-patch generation and memory malware protection module dynamically generates micro-patches for vulnerability paths and binds an anti-memory malware injection mechanism;

[0110] The relay protection compatibility verification and layered release module verifies the compatibility of patches with relay protection logic and releases them through layered canary releases.

[0111] This embodiment also provides an electronic device applicable to a method for generating micro-patches for power grid vulnerabilities based on call chain backtracking, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as proposed in the above embodiment.

[0112] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements a method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as proposed in the above embodiment.

[0113] The storage medium proposed in this embodiment and the method for generating micro-patches of power grid vulnerabilities based on call chain backtracking proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0114] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0115] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for generating micro-patches for power grid vulnerabilities based on call chain backtracking, characterized in that: include, Based on dynamic probes, the kernel layer collects execution context data of protocol parsing and system calls. Data collection is achieved through lock-free buffers, and a call chain graph with time stamps is generated asynchronously in user space. The call chain is decompiled into an LLVM-IR intermediate representation and SSA-form semantic triples are extracted. Subgraph isomorphic matching is performed with the power business feature library through multi-dimensional weight calculation. Key semantic paths are marked according to relevance scores and the annotation process is completed based on a distributed consistency mechanism. Based on the vulnerability description metadata, micro-patch code segments containing security protection logic are automatically generated. Runtime function replacement is achieved through isolated loading and hot-plugging technology, and memory injection protection mechanism and real-time monitoring are integrated to complete vulnerability repair. The execution timing of the production environment is reproduced by a digital real-time simulator and the deviation vector is calculated. A layered rolling release strategy combined with the CAP-KP-Δ protocol is used to control patch deployment. Automatic rollback and long-term drift assessment are achieved based on multi-dimensional monitoring indicators.

2. The method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as described in claim 1, characterized in that: The dynamic probe technology is implemented using the eBPF framework, including a probe program that hooks protocol parsing functions, thread scheduling points, and system call interfaces. The lock-free buffer is a per-CPU circular buffer, which adopts the RCU priority inheritance strategy; The asynchronous reconstructed call chain topology includes generating nodes based on process / thread identifiers, CPU and instruction pointers, and calculating call path fingerprints using an anti-collision hash algorithm. The anti-collision hashing algorithm uses SipHash-2-4 to generate a 256-bit path fingerprint and uses Bloom Filter for duplicate detection.

3. The method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as described in claim 2, characterized in that: The semantic triple extraction includes, Based on libLLVM, the call chain function is decompiled into SSA form, constructing a structure containing opcodes, operand sets, and protocol field attributes.<Opcode,OperandSet,AttributeMask> The triple, in which AttributeMask extends the ProtoFieldID and ProtoFieldOffset members to enable bit-level protocol traceability.

4. The method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as described in claim 3, characterized in that: The multi-dimensional weight calculation includes, The structural weight Wstruct is based on matching depth and continuity score, the data domain weight Wdata is based on protocol field correspondence and register active interval overlap, and the timing weight Wtime is based on operation phase difference. The overall relevance is obtained by weighted summation S = α·Wstruct + β·Wdata + γ·Wstruct. The weight coefficients α, β, and γ are obtained by training on the historical scheduling replay set through Bayesian optimization and are dynamically adjusted every 24 hours by the online A / B threshold drift monitoring service. The hierarchical marking includes: when the overall relevance is higher than the threshold τcrit, it is marked as a business-critical semantic path; when it is lower than τwarn, it is archived to the cold index; and when it is higher than τwarn but lower than τcrit, it enters the gray area to wait for supplementary records.

5. The method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as described in claim 4, characterized in that: The vulnerability description metadata includes: entry function address, buffer boundary information, dangerous parameter offset and register active range, and is associated with the source code location through the DWARF symbol table; The generation of micro-patch code segments containing security protection logic includes, Within an independent namespace, the vulnerable function is compiled into LLVM-IR, InlineGuardPass is injected for return address verification, and BoundaryCheckPass is injected for buffer boundary checks, ultimately generating an ELF shadow segment protected by RELRO and BIND_NOW.

6. The method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as described in claim 5, characterized in that: The InlineGuardPass inserts cmp%rip,%gs:0x0 instructions to verify the NX protection status, and BoundaryCheckPass synthesizes parameter purification logic and triggers ud2 abnormal termination of execution when a violation occurs. The hot-plugging technology includes: loading patches into isolated threads via memfd_create, limiting the patch scope using dlmopen, and selecting either endbr64 jump or PatchedImportAddressTable method to implement function replacement based on CPU characteristics.

7. The method for generating micro-patches for power grid vulnerabilities based on call chain backtracking as described in claim 6, characterized in that: The digital real-time simulator includes: reproducing memory snapshots of the scheduling process through IEC61850-9-2LE sampled value stream and IEC60870-5-104 telemetry stream, achieving time base accuracy through PTP-BC clock synchronization, and calculating instruction-level deviation vectors Δt, Δd, and Δc using dual-channel sampling of ftrace-perf-intel-pt. The automatic rollback mechanism includes: when Δt≥5ms or Δcpu≥5%, restoring the snapshot via btrfssubvolsnapshot and triggering dlclose+CETShadow-Stack to clean up patch remnants.

8. A system for generating micro-patches for power grid vulnerabilities based on call chain backtracking, comprising applying the power grid vulnerabilities micro-patches generated based on call chain backtracking as described in any one of claims 1 to 7, characterized in that, include: Non-intrusive call chain tracing and backtracking engine, semantic tag generation and business logic alignment engine, micro-patch generation and memory malware protection module, and relay protection compatibility verification and layered release module; The non-intrusive call chain tracing and backtracking engine dynamically captures SCADA / EMS kernel layer system calls and protocol parsing logic without interfering with real-time scheduling, and constructs a complete call chain topology. The semantic tag generation and business logic alignment engine maps the call chain to the power business logic and identifies the vulnerability paths associated with key scheduling instructions. The micro-patch generation and memory malware protection module dynamically generates micro-patches for vulnerability paths and binds an anti-memory malware injection mechanism. The relay protection compatibility verification and layered release module verifies the compatibility of the patch with the relay protection logic and releases it through layered grayscale release.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the power grid vulnerability micro-patch generation method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the power grid vulnerability micro-patch generation method based on call chain backtracking as described in any one of claims 1 to 7.

Images