Construction method of iec61850 goose protocol dictionary and protocol feature library

Abstract

The application provides a construction method of an IEC61850 GOOSE protocol dictionary and a protocol feature library, and the dictionary construction comprises the following steps: step A1, using an XML label to represent a protocol field; step A2, taking the label representing the protocol field as element content of a Protocol label, and taking the formed XML file as a protocol dictionary; the feature library construction comprises the following steps: step B1, generating a protocol field table according to the protocol dictionary; step B2, defining multiple function functions according to the characteristics of the protocol field, and constructing a function function table; step B3, constructing protocol features from multiple angles in combination with the field table and the function function table, and using feature rules to represent the protocol features, and then storing the feature rules corresponding to the protocol features into different protocol feature rule tables; and step B4, constructing the protocol feature library based on the protocol field table, the function function table and the protocol feature rule table; the application provides a protocol feature extraction scheme of the IEC61850 GOOSE, and provides a unified protocol feature representation method.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security technology, in particular to a construction method of an IEC61850 GOOSE protocol dictionary and a protocol feature library. BACKGROUND

[0002] At present, the power monitoring system lacks detection of network security related content, which leads to many security risks after being put online. The power monitoring system uses the IEC61850 GOOSE protocol to realize the reliable transmission of real-time signals of the system, and does not perform encryption processing on the transmitted network message, so that the data is completely exposed to the attacker when the message is transmitted, and the attacker can construct malicious messages according to the protocol message features to attack. Therefore, it is of great significance to carry out security research on the IEC61850 GOOSE protocol for improving the security of the power monitoring system.

[0003] At present, the IEC61850 GOOSE protocol message format is complex, the message field is closely related to the business, and the extraction research on the protocol features is relatively lacking, and there is no unified protocol feature representation method. In addition, the random generation of test cases used for protocol security testing also has the problems of blindness and low test efficiency. Therefore, there is an urgent need for a method to describe the protocol field features and a method to describe different protocol features, and a suitable feature library needs to be constructed to be introduced into the security testing of the protocol to improve the efficiency and accuracy of the test. SUMMARY

[0004] The present application proposes a construction method of an IEC61850 GOOSE protocol dictionary and a protocol feature library, provides a protocol feature extraction scheme of IEC61850 GOOSE, and provides a unified protocol feature representation method.

[0005] The present application adopts the following technical solutions.

[0006] The construction method of the IEC61850 GOOSE protocol dictionary adopts an XML representation method to construct the protocol dictionary of the IEC61850 GOOSE protocol used in the power monitoring system, including the following steps:

[0007] Step A1: representing the protocol field with an XML tag;

[0008] Step A2: taking the tag representing the protocol field as the element content of the Protocol tag, and taking the formed XML file as the protocol dictionary.

[0009] The specific implementation of step A1 includes the following sub-steps:

[0010] Step A1.1: According to the different field encoding methods of IEC61850 GOOSE protocol, the fields contained in the protocol are divided into the following three categories,

[0011] The first category is the directly encoded field, including the appid, length, reserved1, reserved2 four fields;

[0012] The second category is the TLV encoded normal field, including gocbref, timeallowedtolive, dataset fields;

[0013] The third category is the TLV encoded data field, including the data field;

[0014] Step A1.2: Use XML tags to represent the protocol fields, and use the attributes of the Block tag for directly encoded fields; wherein the field name is represented by the name attribute, and the field value type is represented by the valueType attribute;

[0015] Step A1.3: For TLV encoded normal fields, use the attributes of the Itemgroup, Item tags. Among them, the field name is represented by the name attribute, the field tag is represented by the tag attribute, and the value type of the field value is represented by the valueType attribute;

[0016] Step A1.4: For TLV encoded data fields, use the attributes of the Data tag. Among them, the field name is represented by the name attribute, and the field tag is represented by the tag attribute.

[0017] The construction method of the IEC61850 GOOSE protocol feature library, combined with the above-mentioned protocol dictionary, constructs the IEC61850 GOOSE protocol feature library for the power monitoring system, including the following steps;

[0018] Step B1: Generate a protocol field table according to the protocol dictionary;

[0019] Step B2: According to the characteristics of the protocol field, define a plurality of function functions, and construct a function function table;

[0020] Step B3: Combine the field table and the function function table to construct the protocol features from multiple angles, and use the feature rules to represent, and then store the corresponding feature rules of each protocol feature to different protocol feature rule tables;

[0021] Step B4: Based on the protocol field table, the function function table and the protocol feature rule table, the IEC61850 GOOSE protocol feature library is constructed.

[0022] The specific implementation of step B1 includes the following sub-steps:

[0023] Step B1.1: Create a protocol field table, which contains five attributes of field number, field name, field value type, field identification and field type;

[0024] Step B1.2: Read the tags in the protocol dictionary XML file in sequence;

[0025] Step B1.3: Determine whether the current tag is Block, if yes, jump to step B1.4, if not, jump to B1.5;

[0026] Step B1.4: Take the values of all attributes of the tag as a record and insert it into the field table, and set the field type as common, wherein the name value corresponds to the field name value, and the valueType value corresponds to the field value type value;

[0027] Step B1.5: Take the values of all attributes of the tag as a record and insert it into the field table, and set the field type as tlv, wherein the name value corresponds to the field name value, the tag value corresponds to the field identification value, and the valueType value corresponds to the field value type value;

[0028] Step B1.6: Determine whether the XML file has been read, if yes, the protocol field table construction is completed, if not, jump to step B1.2 to continue execution.

[0029] The specific implementation of step B2 includes the following sub-steps:

[0030] Step B2.1: According to the difference of operation field type, define the following two types of function functions,

[0031] The first type of function function can be used for assignment operation on directly encoded fields, i.e. the fields with field type common in the protocol field table;

[0032] The second type of function function is for TLV encoded field assignment operation, i.e. the field with field type tlv in the protocol field table;

[0033] Step B2.2: Construct a function function table, which contains three attributes, function number, function function name and field type, and then store the above function function name and the field type that the function function can operate into the function function table.

[0034] The first type of function function has 1, the function function name is randomChange, and the function is to modify the target field value to a random number in the range of 32-bit unsigned integer.

[0035] The second type of function function has 10 function functions, and the function function names are changeTag, changeLength, changeValue, increase, decrease, randomString, boolFlip, append, drop, and exchange.

[0036] The changeTag function randomly replaces the tag value of the target field with the tag value of another field defined in the protocol.

[0037] The changeLength function randomly modifies the length value of the target field so that it is inconsistent with the length of the actual value.

[0038] The changeValue function modifies the value of the target field to a random number in the range of 32-bit unsigned integer.

[0039] The increase function modifies the value of the target field to increase by a random number in the range of 32-bit unsigned integer.

[0040] The decrease function modifies the value of the target field to decrease by a random number in the range of 32-bit unsigned integer.

[0041] The randomString function modifies the value of the target field to a mutated random string.

[0042] The boolFlip function modifies the value of the target field to implement Boolean flip.

[0043] The append function adds a member field at the end of the target field.

[0044] The drop function deletes a member field at the end of the target field.

[0045] The exchange function randomly exchanges the order of two member fields in the target field.

[0046] The specific implementation of step B3 includes the following contents:

[0047] Construct a feature rule table containing two attributes, rule number and feature type number, and the form of the feature rule is as follows:

[0048] The first form is (function function, field), which means performing the operation defined by the function function on the field.

[0049] The second form is: (function function 1, field 1) && (function function 2, field 2), which means performing the operation defined by function function 1 on field 1, and performing the operation defined by function function 2 on field 2 at the same time;

[0050] In step B3, when constructing protocol features, if summarized from the perspective of protocol encoding features, there are three abnormal features. The first abnormal feature is that the tag of the TLV encoded field does not match the field, which is represented by the rule in the format of (changeTag, field). The second abnormal feature is that the length of the TLV encoded field does not match the data length, which is represented by the rule in the format of (changeLength, field). The third abnormal feature is that the TLV encoded field is out of order in the message, which is represented by the rule (exchange, field). The fields involved in the above rules are ordinary fields of TLV encoding;

[0051] In step B3, when constructing protocol features, if summarized from the perspective of protocol state machine features, there is one abnormal feature, which is the abnormal state of the message sequence number, represented by the rule (increase, field) && (decrease, field). The fields involved in the above rules are sqnum field and stnum field;

[0052] In step B3, when constructing protocol features, if summarized from the perspective of protocol vulnerability field features, there are three abnormal features. The first abnormal feature is the abnormality of the time allowed to live field, represented by the rule in the format of (changevalue, field). The second abnormal feature is the abnormality of the key field value, represented by the rule in the format of (randomchange, field). The third abnormal feature is the abnormality of the key string field value, represented by the rule in the format of (randomstring, field). The fields involved in the above rules are gocbref field, goid field and dataset field;

[0053] In step B3, when constructing protocol features, if summarized from the perspective of business message sequence features, there is one abnormal feature, which is the Boolean flip of the field value, represented by the rule in the format of (boolFlip, field). The field involved in the above rule is data field;

[0054] In step B3, if summarized from the perspective of protocol data set features, there are two abnormal features when constructing protocol features, the first abnormal feature is that the number of data subfields in the alldata field is inconsistent with the value of the numdatsetentries field, which is expressed by rules in the format of (increase, field), (decrease, field) and (append, field), (drop, field), wherein the field involved in the rules in the format of (increase, field), (decrease, field) is numdatsetentries, and the field involved in the rules in the format of (append, field), (drop, field) is alldata field; the second abnormal feature is that the data subfields in the alldata field are out of order, which is expressed by a rule in the format of (exchange, field), wherein the field involved is alldata field;

[0055] In step B3, the rule constructed according to the five feature perspectives is set with a feature type number according to the specific abnormal feature to which the rule belongs, different protocol features are expressed by different rules, and then the feature rules corresponding to the protocol features are stored in different protocol feature rule tables.

[0056] The present application has the following advantages:

[0057] 1. The IEC61850 GOOSE protocol dictionary is constructed by using an XML expression method, so that the protocol dictionary structure is rigorous and has self-description capability, and the protocol expression is separated from the business, so that the key features of the protocol field can be accurately described without the business.

[0058] 2. The different features of the protocol are expressed in a unified form, which solves the problem of unified expression of protocol features and reduces the complexity of constructing a message by using protocol features, facilitating the extraction of protocol features.

[0059] 3. The method of constructing a feature library combined with a protocol dictionary is proposed, which fills the gap in the construction of the IEC61850 GOOSE protocol feature library in the existing research, and reduces the difficulty of introducing the feature library into the protocol security test.

[0060] The present application adopts the XML format to construct the IEC61850 GOOSE protocol dictionary, which is beneficial to data interaction with third-party databases through the XML format database features. BRIEF DESCRIPTION OF DRAWINGS

[0061] The present application will be further described in detail in combination with the drawings and specific embodiments:

[0062] APPENDIX Figure 1A flow chart of an IEC61850 GOOSE protocol dictionary construction method provided by the embodiment of the present application is shown in the figure.

[0063] The present application provides an IEC61850 GOOSE protocol dictionary construction method. Figure 2 A flow chart of an IEC61850 GOOSE protocol feature library construction method provided by the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0064] As shown in the figure, the IEC61850 GOOSE protocol dictionary construction method adopts XML expression method to construct the protocol dictionary of the IEC61850 GOOSE protocol used in the power monitoring system, which includes the following steps.

[0065] Step A1: express the protocol field with XML tags.

[0066] Step A2: take the tags representing the protocol field as the element content of the Protocol tag, and take the formed XML file as the protocol dictionary.

[0067] The specific implementation of step A1 includes the following sub-steps.

[0068] Step A1.1: according to the different field coding modes of the IEC61850 GOOSE protocol, divide the fields contained in the protocol into the following three categories.

[0069] The first category is the directly coded field, including the appid, length, reserved1 and reserved2 fields.

[0070] The second category is the TLV coded normal field, including the gocbref, timeallowedtolive and dataset fields.

[0071] The third category is the TLV coded data field, including the data field.

[0072] Step A1.2: express the protocol field with XML tags, and for the directly coded field, express it with the attributes of the Block tag; wherein the field name is expressed with the name attribute, and the field value type is expressed with the valueType attribute.

[0073] Step A1.3: for the TLV coded normal field, express it with the attributes of the Itemgroup and Item tags; wherein the field name is expressed with the name attribute, the field tag is expressed with the tag attribute, and the field value type is expressed with the valueType attribute.

[0074] Step A1.4: For the data field of TLV encoding, each attribute of the Data tag is represented. The field name is represented by the name attribute, and the field tag is represented by the tag attribute.

[0075] The method for constructing the IEC61850 GOOSE protocol feature library comprises the following steps in combination with the protocol dictionary for constructing the IEC61850 GOOSE protocol feature library for the power monitoring system.

[0076] Step B1: generating a protocol field table according to the protocol dictionary;

[0077] Step B2: defining multiple function functions according to the characteristics of the protocol field, and constructing a function function table;

[0078] Step B3: constructing protocol features from multiple angles in combination with the field table and the function function table, and representing the protocol features by feature rules, and then storing the feature rules corresponding to the protocol features into different protocol feature rule tables;

[0079] Step B4: constructing the IEC61850 GOOSE protocol feature library based on the protocol field table, the function function table, and the protocol feature rule table.

[0080] The specific implementation of step B1 comprises the following sub-steps:

[0081] Step B1.1: creating a protocol field table, which contains five attributes of field number, field name, field value type, field identification, and field type;

[0082] Step B1.2: sequentially reading the tags in the protocol dictionary XML file;

[0083] Step B1.3: judging whether the current tag is a Block, if yes, jumping to step B1.4, if not, jumping to B1.5;

[0084] Step B1.4: taking the values of all attributes of the tag as a record and inserting the record into the field table, and setting the field type as common, wherein the name value corresponds to the field name value, and the valueType value corresponds to the field value type value;

[0085] Step B1.5: taking the values of all attributes of the tag as a record and inserting the record into the field table, and setting the field type as tlv, wherein the name value corresponds to the field name value, the tag value corresponds to the field identification value, and the valueType value corresponds to the field value type value;

[0086] Step B1.6: judging whether the XML file is read completely, if yes, the protocol field table construction is completed, if not, jumping to step B1.2 to continue execution.

[0087] The specific implementation of step B2 includes the following sub-steps:

[0088] Step B2.1: According to the difference of operation field type, define the following two types of function functions,

[0089] The first type of function function can perform assignment operation on directly encoded fields, i.e. the fields whose field type in the protocol field table is common;

[0090] The second type of function function is that it can perform assignment operation on TLV encoded fields, i.e. the fields whose field type in the protocol field table is tlv;

[0091] Step B2.2: Construct a function function table containing three attributes, function number, function function name and field type, and then store the above function function name and the field type that the corresponding function function can operate into the function function table.

[0092] The first type of function function has 1, the function function name is randomChange, and the function is to modify the target field value to a random number in the range of 32-bit unsigned integer.

[0093] The second type of function function has 10, the function function name is changeTag, changeLength, changeValue, increase, decrease, randomString, boolFlip, append, drop, exchange respectively;

[0094] Among them, the function of changeTag function is to randomly replace the tag value of the target field with the tag value of other fields defined in the protocol;

[0095] The function of changeLength function is to randomly modify the length value of the target field so that it is inconsistent with the length of the actual value;

[0096] The function of changeValue function is to modify the value of the target field to a random number in the range of 32-bit unsigned integer;

[0097] The function of increase function is to modify the value of the target field so that it increases a random number in the range of 32-bit unsigned integer;

[0098] The function of decrease function is to modify the value of the target field so that it decreases a random number in the range of 32-bit unsigned integer;

[0099] The function of the randomString function is to modify the value of the target field to a mutated random string;

[0100] The function of the boolFlip function is to modify the value of the target field to achieve Boolean flip;

[0101] The function of the append function is to add a member field at the end of the target field;

[0102] The function of the drop function is to delete a member field at the end of the target field;

[0103] The function of the exchange function is to randomly exchange the order of two member fields in the target field.

[0104] The specific implementation of step B3 includes the following contents:

[0105] A feature rule table is constructed, which contains two attributes, rule number and feature type number, and the form of the feature rule is as follows,

[0106] The first form is: (function function, field), which indicates that the function function defined operation is performed on the field;

[0107] The second form is: (function function1, field1) && (function function2, field2), which indicates that the function function1 defined operation is performed on the field1, and the function function2 defined operation is performed on the field2 at the same time;

[0108] When constructing protocol features, step B3 has three kinds of abnormal features from the perspective of protocol encoding features, the first kind of abnormal feature is that the tag of the TLV encoded field does not match the field, which is represented by the rule in the format of (changeTag, field), the second kind of abnormal feature is that the length of the TLV encoded field does not match the data length, which is represented by the rule in the format of (changeLength, field), and the third kind of abnormal feature is that the TLV encoded field is out of order in the message, which is represented by the rule (exchange, field), the fields involved in the above rules are ordinary fields of TLV encoding;

[0109] When constructing protocol features, step B3 has one kind of abnormal feature from the perspective of protocol state machine features, which is the abnormal state of the message sequence number, represented by the rule (increase, field) && (decrease, field), the fields involved in the above rule are sqnum field and stnum field;

[0110] Step B3, in constructing protocol features, if summarized from the perspective of protocol vulnerability field features, there are three abnormal features, the first abnormal feature is the abnormality of the timeallowedtolive field, which is represented by the rule in the format of (changevalue, field), where the involved field is the timeallowedtolive field; the second abnormal feature is the abnormality of key field values, which is represented by the rule in the format of (randomchange, field), where the involved fields are the appid field and the length field; the third abnormal feature is the abnormality of key string field values, which is represented by the rule in the format of (randomstring, field), where the involved fields are the gocbref field, the goid field and the dataset field;

[0111] Step B3, in constructing protocol features, if summarized from the perspective of business message sequence features, there is one abnormal feature, which is the Boolean flip of field values, represented by the rule in the format of (boolFlip, field), where the involved field is the data field;

[0112] Step B3, in constructing protocol features, if summarized from the perspective of protocol data set features, there are two abnormal features, the first abnormal feature is that the number of data subfields in the alldata field is inconsistent with the numdatsetentries field value, represented by the rules in the formats of (increase, field), (decrease, field) and (append, field), (drop, field), where the rule in the format of (increase, field), (decrease, field) involves the numdatsetentries field, and the rule in the format of (append, field), (drop, field) involves the alldata field; the second abnormal feature is the disorder of data subfields in the alldata field, represented by the rule in the format of (exchange, field), where the involved field is the alldata field;

[0113] In step B3, the rules constructed according to the five feature angles are set to have feature type numbers according to the specific abnormal features to which the rules belong, different protocol features are represented by different rules, and then the feature rules corresponding to each protocol feature are stored in different protocol feature rule tables.

[0114] In this example, a method for constructing an IEC61850 GOOSE protocol dictionary and a method for constructing a protocol feature library are disclosed. The method for constructing an IEC61850 GOOSE protocol dictionary is proposed, and XML is used to describe the key features of the IEC61850 GOOSE protocol fields. The method for constructing an IEC61850 GOOSE protocol feature library is proposed, and a protocol field table is constructed according to the protocol dictionary, and a variety of function functions for protocol field operations are defined to construct a function function table; then the protocol features are extracted from the perspectives of protocol encoding features, protocol state machine features, and protocol vulnerability field features, different protocol features are represented using feature rules, and they are stored in the corresponding feature rule table; finally, the protocol feature library is constructed based on the protocol field table, the function function table, and the feature rule table. The XML representation method for constructing the protocol dictionary can make its structure rigorous and have the ability of self-description, and this representation method separates the protocol representation from the business, which can accurately describe the key features of the protocol fields without the business; the different features of the protocol are represented in a unified form, which solves the problem of unified representation of protocol features, reduces the complexity of constructing messages using protocol features, and facilitates the extraction of protocol features; the method for constructing the feature library combined with the protocol dictionary is proposed, which fills the gap in the construction of the IEC61850 GOOSE protocol feature library in the existing research, and reduces the difficulty of introducing the feature library into the protocol security test.

[0115] It should be understood that the above description of the preferred embodiments is more detailed and is not considered as limiting the scope of patent protection of the present application. Those skilled in the art can make substitutions or modifications without departing from the scope of the present application, which falls within the scope of protection of the present application. The scope of protection of the present application should be subject to the appended claims.

Claims

1. A method for constructing an IEC61850 GOOSE protocol dictionary, which adopts an XML expression method to construct a protocol dictionary of an IEC61850 GOOSE protocol for a power monitoring system, characterized in that: Comprise the following steps; Step A1: protocol field is expressed with XML label; Step A2: the label expressing protocol field is taken as the element content of Protocol label, and the formed XML file is taken as protocol dictionary; The method for constructing the IEC61850 GOOSE protocol feature library, in combination with the protocol dictionary described above, constructs the IEC61850 GOOSE protocol feature library for the power monitoring system, comprising the following steps; Step B1: generating a protocol field table according to the protocol dictionary; Step B2: defining multiple function functions according to the characteristics of the protocol fields, and constructing a function function table; Step B3: constructing protocol features from multiple angles in combination with the field table and the function function table, and expressing the protocol features with feature rules, and then storing the feature rules corresponding to the protocol features into different protocol feature rule tables; Step B4: constructing the IEC61850 GOOSE protocol feature library based on the protocol field table, the function function table and the protocol feature rule table; The specific implementation of step B1 comprises the following sub-steps: Step B1.1: creating a protocol field table, which contains five attributes of field number, field name, field value type, field identifier and field type; Step B1.2: sequentially reading the labels in the protocol dictionary XML file; Step B1.3: judging whether the current label is Block, if yes, jumping to step B1.4, if not, jumping to step B1.5; Step B1.4: taking the values of all attributes of the label as a record and inserting the record into the field table, and setting the field type as common, wherein the name value corresponds to the field name value, and the valueType value corresponds to the field value type value; Step B1.5: taking the values of all attributes of the label as a record and inserting the record into the field table, and setting the field type as tlv, wherein the name value corresponds to the field name value, the tag value corresponds to the field identifier value, and the valueType value corresponds to the field value type value; Step B1.6: judging whether the XML file is read completely, if yes, the protocol field table construction is ended, if not, jumping to step B1.2 to continue executing; The specific implementation of step B2 comprises the following sub-steps: Step B2.1: defining the following two types of function functions according to the different operation field types, The first type of function function is for assigning values to directly encoded fields, i.e. the fields with the field type of common in the protocol field table; The second type of function function is for assigning values to TLV encoded fields, i.e. the fields with the field type of tlv in the protocol field table; Step B2.2: constructing a function function table, which contains three attributes of function number, function function name and field type, and then storing the function function names and the field types that can be operated by the function functions into the function function table; The method comprises the following steps: constructing a protocol field table according to a protocol dictionary, defining a plurality of function functions for operating the protocol field to construct a function function table; then extracting protocol features from the aspects of protocol coding features, protocol state machine features and protocol vulnerability field features, using feature rules to represent different protocol features, and storing the features into a corresponding feature rule table; and finally constructing a protocol feature library based on the protocol field table, the function function table and the feature rule table.

2. The method for constructing the IEC61850 GOOSE protocol dictionary according to claim 1, characterized in that: The specific implementation of step A1 comprises the following sub-steps: Step A1.1: according to the different field coding modes of the IEC61850 GOOSE protocol, the fields contained in the protocol are divided into the following three categories, The first category is directly coded fields, including the appid, length, reserved1 and reserved2 fields; The second category is TLV coded normal fields, including the gocbref, timeallowedtolive and dataset fields; The third category is TLV coded data fields, including the data field; Step A1.2: use XML tags to represent the protocol fields, and use the attributes of the Block tag to represent the directly coded fields; wherein the field name is represented by the name attribute, and the field value type is represented by the valueType attribute; Step A1.3: use the attributes of the Itemgroup and Item tags to represent the TLV coded normal fields; Wherein, the field name is represented by the name attribute, and the field tag is represented by the tag attribute, and the value type of the field value is represented by the valueType attribute; Step A1.4: use the attributes of the Data tag to represent the TLV coded data fields; Wherein, the field name is represented by the name attribute, and the field tag is represented by the tag attribute.

3. The method of claim 1, wherein the IEC61850 GOOSE protocol dictionary is constructed by: The first category of function functions has one function function named randomChange, which modifies the target field value to a random number in the range of 32-bit unsigned integer.

4. The method of claim 1, wherein the IEC61850 GOOSE protocol dictionary is constructed by: The second category of function functions has 10 function functions, and the function function names are changeTag, changeLength, changeValue, increase, decrease, randomString, boolFlip, append, drop and exchange; The function of the changeTag function is to randomly replace the tag value of the target field with the tag value of another field defined in the protocol; The function of the changeLength function is to randomly modify the length value of the target field so as to make it inconsistent with the length of the actual value; The function of the changeValue function is to modify the value of the target field to a random number in the range of 32-bit unsigned integer; The function of the increase function is to modify the value of the target field to increase a random number in the range of 32-bit unsigned integer; The function of the decrease function is to modify the value of the target field to decrease a random number in the range of 32-bit unsigned integer; The function of the randomString function is to modify the value of the target field to a mutated random string; The function of the boolFlip function is to modify the value of the target field to implement Boolean flip; The function of the append function is to add a member field at the end of the target field; The function of the drop function is to delete a member field at the end of the target field; The function of the exchange function is to randomly exchange the order of two member fields in the target field.

5. The method of claim 1, wherein the IEC61850 GOOSE protocol dictionary is constructed by: The specific implementation of step B3 includes the following contents: A feature rule table is constructed, which contains two attributes, rule number and feature type number, and the forms of feature rules are as follows, The first form is: (function function, field), which indicates that the function function is executed on the field; The second form is: (function function1, field1) && (function function2, field2), which indicates that the function function1 is executed on the field1, and the function function2 is executed on the field2 at the same time; When constructing protocol features, if summarized from the perspective of protocol encoding features, there are three abnormal features, the first abnormal feature is that the tag of the TLV encoded field does not match the field, which is represented by the rule in the format of (changeTag, field), the second abnormal feature is that the length of the TLV encoded field does not match the data length, which is represented by the rule in the format of (changeLength, field), and the third abnormal feature is that the TLV encoded field is out of order in the message, which is represented by the rule (exchange, field), and the fields involved in the above rules are ordinary fields of TLV encoding; When constructing protocol features, if summarized from the perspective of protocol state machine features, there is one abnormal feature, which is the abnormal state of the message sequence number, represented by the rule (increase, field) && (decrease, field), and the fields involved in the above rule are sqnum field and stnum field; Step B3, in constructing protocol features, if summarized from the perspective of protocol vulnerability field features, there are three abnormal features, the first abnormal feature is the abnormality of the timeallowedtolive field, which is represented by the rule in the format of (changevalue, field), wherein the involved field is the timeallowedtolive field; the second abnormal feature is the abnormality of the key field value, which is represented by the rule in the format of (randomchange, field), wherein the involved fields are the appid field and the length field; the third abnormal feature is the abnormality of the key string field value, which is represented by the rule in the format of (randomstring, field), wherein the involved fields are the gocbref field, the goid field and the dataset field; Step B3, in constructing protocol features, if summarized from the perspective of business message sequence features, there is one abnormal feature, which is the Boolean flip of the field value, represented by the rule in the format of (boolFlip, field), wherein the involved field is the data field; Step B3, in constructing protocol features, if summarized from the perspective of protocol data set features, there are two abnormal features, the first abnormal feature is that the number of data subfields in the alldata field is inconsistent with the numdatsetentries field value, represented by the rules in the formats of (increase, field), (decrease, field) and (append, field), (drop, field), wherein the rules in the formats of (increase, field) and (decrease, field) involve the numdatsetentries field, and the rules in the formats of (append, field) and (drop, field) involve the alldata field; the second abnormal feature is the disorder of the data subfields in the alldata field, represented by the rule in the format of (exchange, field), wherein the involved field is the alldata field.

6. The method of claim 5, wherein the IEC61850 GOOSE protocol dictionary is constructed by: In step B3, the rules constructed according to the five feature angles are set with the feature type number of the rule according to the specific abnormal feature to which the rule belongs, different protocol features are represented by different rules, and then the feature rules corresponding to each protocol feature are stored in different protocol feature rule tables.

Images