A method, device, medium and electronic equipment for mining vulnerability in power monitoring system

Abstract

The present disclosure relates to a method for mining vulnerabilities in an electric power monitoring system, comprising the following steps: encoding test cases and eliminating abnormal samples in the test case population; determining whether there are valid test cases in the test case population and determining an individual fitness function; selecting test cases according to the fitness function, performing multi-point cross-mutation on randomly selected positions of the test cases, performing fuzzy testing on the new test cases after the multi-point cross-mutation as test input, and marking valid test cases; setting a termination condition, and when the termination condition is not met, repeating the aforementioned actions of this step, and when the termination condition is met, determining the system vulnerability. The present disclosure can reduce the number of invalid fuzzy test cases in the process of mining vulnerabilities in the electric power monitoring system, improve vulnerability mining efficiency, and increase vulnerability mining code coverage, making the mining of vulnerabilities in the electric power monitoring system more efficient.

Description

Technical Field

[0001] The present invention relates to the technical field of power monitoring system vulnerability mining, and in particular to a power monitoring system vulnerability mining method, device, medium and electronic equipment. Background Art

[0002] While the intelligent and networked development of power monitoring systems is driving industrial production, it also presents numerous security risks. Traditional power monitoring systems utilize specialized hardware, software, and communication protocols, with minimal consideration given to the communication security essential for interoperability. Protection between enterprise management networks and industrial control networks is weak, or even nonexistent, in their design. Consequently, the systems face a variety of security threats from both internal and external sources, and an attack at any point in the system could potentially paralyze the entire system. The application of universal communication protocols, hardware, software, and numerous other technologies in industrial control systems has enabled power monitoring systems to be highly integrated with traditional enterprise networks, while also introducing information security issues inherent in traditional domains.

[0003] At present, research on the protection of power monitoring systems has made some progress, but the relevant technologies for power monitoring system vulnerability discovery are relatively lacking. The increasing number of vulnerability attacks against power monitoring systems has exposed serious deficiencies in vulnerability discovery. The main problems are:

[0004] (1) The random mutation strategy of fuzz testing for vulnerability mining in existing power monitoring systems results in a lack of directionality in mutations, which in turn generates a large number of redundant and invalid test cases, consuming test resources and resulting in low vulnerability mining efficiency.

[0005] (2) The existing power monitoring system vulnerability mining fuzz test case mutation method is too simple, and it is difficult to continuously generate test samples with high acceptance rate through mutation to explore more vulnerabilities, resulting in low vulnerability mining code coverage.

[0006] Therefore, how to provide a method, device, medium and electronic equipment for power monitoring system vulnerability mining. Summary of the Invention

[0007] An embodiment of the present invention provides a method for vulnerability mining in a power monitoring system to address the problems of low vulnerability mining efficiency and low vulnerability mining code coverage in the prior art power monitoring systems. To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is provided below. This summary is not intended to be a general review, nor is it intended to identify key / important components or delineate the scope of protection of these embodiments. Its sole purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0008] The first aspect of the present application provides a method for discovering vulnerabilities in a power monitoring system, comprising the following steps:

[0009] Encode test cases and eliminate abnormal samples in test cases;

[0010] Determine whether there are valid cases in the population of test cases and determine the individual fitness function;

[0011] Select test cases based on the fitness function, perform multi-point cross-mutation on randomly selected locations of the test cases, use the new test cases after multi-point cross-mutation as test input for fuzz testing, and mark valid test cases; set termination conditions. When the termination conditions are not met, repeat the above actions in this step. When the termination conditions are met, determine the system vulnerability.

[0012] Optionally, the termination condition is set. When the termination condition is not met, the above-mentioned steps of this step are repeated 400-600 times.

[0013] Optionally, the step of encoding the test case includes: representing the test case with a vector, expressed as:

[0014] G=[g1,g2,...,g m ] (1)

[0015] Among them, G represents the test case, g i represents the i-th attribute value of the test case, i = 1, 2, ···, m, m represents the dimension of the test case attribute, and the population is represented by a set of test cases of a set of m-dimensional vectors.

[0016] Optionally, the step of eliminating abnormal samples in the test case population includes performing zero-mean normalization processing on the test cases to eliminate abnormal samples.

[0017] Optionally, the step of performing zero-mean normalization on the test case is calculated as follows:

[0018]

[0019]

[0020]

[0021] Among them, g i * Represents the normalized value of the i-th attribute of the test case, represents the average value of the i-th attribute of all test cases in the population, g n,i represents the i-th attribute value of the n-th test case in the population, s represents the number of test cases in the population, and σ represents the standard deviation of the test cases.

[0022] Optionally, the step of determining whether there is a valid use case includes: calculating the distance between the central individual of the population and the test case.

[0023] Optionally, the step of calculating the central individual of the population is calculated as follows:

[0024]

[0025] The distance between test cases is calculated as follows:

[0026]

[0027] Among them, c represents the central individual of the population, d a,b Indicates the distance between test case a and test case b in the population, L sum Represents the sum of the lengths of test case a and test case b, N step Indicates the minimum number of steps required to transform one of test case a and test case b into the other test case.

[0028] Optionally, the step of determining whether there is a valid use case in the test case population includes: for an abnormal test case message, when a normal server response occurs, or a subsequent normal request test case message server response times out, does not respond, the server is shut down and / or the server denies service in at least one of the states, marking the test case as a valid use case.

[0029] Optionally, when it is determined that there are no valid use cases in the population, the individual fitness of the population is calculated as follows:

[0030]

[0031] Among them, f N (x) represents the central fitness value of test case x, d x,c Indicates the distance between the test case x and the central individual c in the population, d max Indicates the maximum distance between all test cases and the central individual c in the population, d avg represents the average distance between all test cases and the population center individual c; and,

[0032] When it is determined that there are valid test cases in the population, all test cases in the population are clustered to find the cluster center individual. At this time, the individual fitness of the population is calculated as follows:

[0033]

[0034] Among them, f Y (x) represents the clustering fitness value of test case x, dx,k Denotes the distance between the test case x and its nearest cluster center individual k, d max,k Indicates the maximum distance between all test cases in the cluster where test case x is located and the cluster center individual k, d avg,k It represents the average distance between all test cases in the cluster where the test case x is located and the cluster center individual k.

[0035] Optionally, the step of determining the selected test case according to the fitness function includes calculating the individual fitness values ​​of all test cases in the population and calculating the individual genetic probability of the population, and the calculation method is as follows:

[0036]

[0037] Among them, P n represents the individual genetic probability of the nth test case in the population, n=1,2,...,s,f n Represents the individual fitness value of the nth test case in the population, generates a random value r in the interval [0,1], if r<P n , then the test case is selected and a new population is generated through the individual selection operation of the test case.

[0038] Optionally, the step of selecting test cases according to the fitness function further includes: setting an N-generation survival period for all test case individuals in the new population generated by the individual selection operation, and abandoning the individual if it has not been selected when the N-generation survival period is reached.

[0039] Optionally, the N-generation survival cycle is 20-40 generations.

[0040] Optionally, the step of performing multi-point crossover mutation on randomly selected positions of the test case includes:

[0041] Calculate the crossover probability and mutation probability of the selected test case in the population. The calculation formulas are as follows:

[0042]

[0043]

[0044] Among them, P cro is the crossover probability, P mut is the mutation probability, f max Represents the maximum individual fitness value of all test cases in the population, f cro represents the larger value of the individual fitness values ​​of the two test cases to be crossed, f avg represents the average individual fitness value of all test cases in the population, f mutIndicates the individual fitness value of the test case to be mutated, k1 and k2 are constants in the interval [0,1].

[0045] A second aspect of the present application provides a device for discovering vulnerabilities in a power monitoring system.

[0046] The power monitoring system vulnerability mining device includes: a preprocessing unit, a calculation unit and an execution unit; wherein,

[0047] The preprocessing unit is used to encode the test case and eliminate abnormal samples in the test case;

[0048] The computing unit is configured to determine whether there are valid test cases in the population of test cases and determine an individual fitness function;

[0049] The execution unit is used to select test cases according to the fitness function, perform multi-point cross mutation on randomly selected positions of the test cases, perform fuzz testing on the new test cases after the multi-point cross mutation as test input, and mark valid test cases; set a termination condition, and when the termination condition is not met, repeat the above-mentioned actions of this step, and when the termination condition is met, determine the system vulnerability.

[0050] The third aspect of the present application provides a medium on which a program is stored. When the program is executed by a processor, the steps in the power monitoring system vulnerability mining method described in the first aspect of the present application are implemented.

[0051] The fourth aspect of the present application provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the steps in the power monitoring system vulnerability mining method as described in the first aspect of the present application.

[0052] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0053] (1) By eliminating abnormal samples in the test cases, invalid fuzzy test cases are streamlined, making vulnerability mining more efficient;

[0054] (2) By utilizing multi-point crossover and mutation processing, the code coverage of vulnerability mining is improved, making the efficiency of vulnerability mining better.

[0055] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0057] Figure 1 This is a flow chart showing a method for discovering vulnerabilities in a power monitoring system according to an exemplary embodiment;

[0058] Figure 2 1 is a schematic structural diagram of a device for discovering vulnerabilities in a power monitoring system according to an exemplary embodiment;

[0059] Figure 3 It is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0060] The following description and accompanying drawings sufficiently illustrate the specific embodiments herein to enable those skilled in the art to practice them. Portions and features of some embodiments may be included in or substituted for portions and features of other embodiments. The scope of the embodiments herein includes the entire scope of the claims, including all available equivalents thereof. Herein, the terms "first," "second," and the like are used solely to distinguish one element from another and do not require or imply any actual relationship or order between these elements. In practice, the first element can also be referred to as the second element, and vice versa. Furthermore, the terms "comprise," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a structure, device, or apparatus comprising a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such structure, device, or apparatus. Without further limitation, an element defined by the phrase "comprising a..." does not preclude the presence of other identical elements in the structure, device, or apparatus comprising the element. The various embodiments herein are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Similar or identical parts between the various embodiments can be referenced to each other.

[0061] The terms "longitudinal", "transverse", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like used herein to indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are intended only to facilitate the description of this document and simplify the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on the present invention. In the description herein, unless otherwise specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, they can be mechanical or electrical connections, or they can be internal connections between two elements, they can be directly connected, or they can be indirectly connected through an intermediate medium. For those of ordinary skill in the art, the specific meanings of the above terms can be understood according to the specific circumstances.

[0062] As used herein, unless otherwise specified, the term "plurality" means two or more.

[0063] In this document, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0064] In this article, the term "and / or" is used to describe the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0065] In the absence of conflict, the embodiments of the present invention and the features thereof may be combined with each other.

[0066] A method for discovering vulnerabilities in a power monitoring system comprises the following steps:

[0067] Encode test cases and eliminate abnormal samples in test cases;

[0068] Determine whether there are valid cases in the population of test cases and determine the individual fitness function;

[0069] Select test cases based on the fitness function, perform multi-point cross-mutation on randomly selected locations of the test cases, use the new test cases after multi-point cross-mutation as test input for fuzz testing, and mark valid test cases; set termination conditions. When the termination conditions are not met, repeat the above actions in this step. When the termination conditions are met, determine the system vulnerability.

[0070] Optionally, a termination condition is set. When the termination condition is not met, the above steps of this step are repeated 400-600 times.

[0071] In one embodiment, a termination condition is set. When the termination condition is not met, the above-mentioned actions in this step are repeated 500 times.

[0072] In one embodiment, the step of encoding the test case includes: representing the test case with a vector, expressed as:

[0073] G=[g1,g2,...,g m ] (1)

[0074] Among them, G represents the test case, g i represents the i-th attribute value of a test case, where i = 1, 2, ···, m, and m represents the dimension of the test case attribute. The population is represented by a set of test cases consisting of m-dimensional vectors. Since the format of industrial control protocol data packets is an ordered sequence, a vector is used to represent each individual in the data packet.

[0075] In one embodiment, the step of eliminating abnormal samples in the test case population includes performing zero-mean normalization processing on the test cases to eliminate abnormal samples.

[0076] Optionally, the test case is subjected to zero-mean normalization, and the calculation method of the processing is as follows:

[0077]

[0078]

[0079]

[0080] Among them, g i * Represents the normalized value of the i-th attribute of the test case, represents the average value of the i-th attribute of all test cases in the population, g n,i represents the i-th attribute value of the n-th test case in the population, s represents the number of test cases in the population, and σ represents the standard deviation of the test cases.

[0081] In one embodiment, the step of determining whether there is a valid test case includes calculating the distance between the central individual of the population and the test case.

[0082] Optionally, calculate the central individual of the population as follows:

[0083]

[0084] The distance between test cases is calculated as follows:

[0085]

[0086] Among them, c represents the central individual of the population, d a,b Indicates the distance between test case a and test case b in the population, L sum Represents the sum of the lengths of test case a and test case b, N step Indicates the minimum number of steps required to transform one of test case a and test case b into the other test case. Common test case transformation methods include but are not limited to bit addition, deletion, and modification operations.

[0087] In one embodiment, the step of determining whether there is a valid test case in the test case population includes: for an abnormal test case message, when a normal server response occurs, or a subsequent normal request test case message server response times out, does not respond, the server is shut down and / or the server denies service, marking the test case as a valid test case.

[0088] Optionally, when it is determined that there are no valid use cases in the population, the individual fitness of the population is calculated as follows:

[0089]

[0090] Among them, f N (x) represents the central fitness value of test case x, d x,c Indicates the distance between the test case x and the population center individual c, d max Indicates the maximum distance between all test cases and the population center individual c, d avg represents the average distance between all test cases and the population center individual c; and,

[0091] When it is determined that there are valid test cases in the population, all test cases in the population are clustered to find the cluster center individual. At this time, the individual fitness of the population is calculated as follows:

[0092]

[0093] Among them, f Y (x) represents the clustering fitness value of test case x, d x,k Denotes the distance between the test case x and its nearest cluster center individual k, d max,k Indicates the maximum distance between all test cases in the cluster where test case x is located and the cluster center individual k, d avg,k It represents the average distance between all test cases in the cluster where the test case x is located and the cluster center individual k.

[0094] Optionally, the step of determining the selection of test cases according to the fitness function includes calculating the individual fitness values ​​of all test cases in the population and calculating the individual genetic probabilities of the population, and the calculation method is as follows:

[0095]

[0096] Among them, P n represents the individual genetic probability of the nth test case in the population, n=1,2,...,s,f n Represents the individual fitness value of the nth test case in the population, generates a random value r in the interval [0,1], if r<P n , then the test case is selected and a new population is generated through the individual selection operation of the test case.

[0097] In one embodiment, the step of selecting test cases according to the fitness function further includes: setting an N-generation survival period for all test case individuals in the new population generated by the individual selection operation, and abandoning the individual if it has not been selected when the N-generation survival period is reached.

[0098] Optionally, the N-generation survival period is 20-40 generations.

[0099] In one embodiment, a 30-generation survival period is set for all test case individuals in the new population generated by the individual selection operation. If the individual has not been selected after the 30-generation survival period is reached, it will be abandoned.

[0100] Optionally, perform multi-point crossover mutation on randomly selected locations of the test case, including:

[0101] Calculate the crossover probability and mutation probability of the selected test case in the population. The calculation formulas are as follows:

[0102]

[0103]

[0104] Among them, P cro is the crossover probability, P mut is the mutation probability, f max Represents the maximum individual fitness value of all test cases in the population, f cro represents the larger value of the individual fitness values ​​of the two test cases to be crossed, f avg represents the average individual fitness value of all test cases in the population, f mut Indicates the individual fitness value of the test case to be mutated, k1 and k2 are constants in the interval [0,1].

[0105] In one embodiment, a new use case after multi-point cross-mutation is used as a test input for fuzzy testing, and valid use cases are marked. When marking valid use cases, it is necessary to monitor the server response status and the test case message. For abnormal test case messages, when the server responds normally, or the server response of the subsequent normal request test case message times out, does not respond, the server is closed and / or the server denies service, the test case is marked as a valid use case.

[0106] In one embodiment, a power monitoring system vulnerability mining device is provided, whose structure is as follows: Figure 2 As shown, the power monitoring system vulnerability mining device adopts the power monitoring system vulnerability mining method provided in any of the above embodiments to mine vulnerabilities in the power monitoring system.

[0107] In one embodiment, the power monitoring system vulnerability mining device includes: a preprocessing unit, a calculation unit and an execution unit; wherein,

[0108] A preprocessing unit, used to encode test cases and eliminate abnormal samples in test cases;

[0109] A calculation unit, used to determine whether there are valid test cases in the population of test cases and determine the individual fitness function;

[0110] The execution unit is used to select test cases according to the fitness function, perform multi-point cross mutation on randomly selected positions of the test cases, use the new test cases after the multi-point cross mutation as test input for fuzz testing, and mark valid test cases; set a termination condition, and when the termination condition is not met, repeat the above-mentioned actions of this step, and when the termination condition is met, determine the system vulnerability.

[0111] In one embodiment, an electronic device is provided. The electronic device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the electronic device is used to store static information and dynamic information data. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the steps in the above method embodiment are implemented.

[0112] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the electronic device to which the solution of the present invention is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0113] In one embodiment, an electronic device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiment when executing the computer program.

[0114] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above method embodiment are implemented.

[0115] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0116] It should be noted that the above description is only an illustration of some embodiments of the present disclosure and the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosure concept. For example, the above-mentioned features can be replaced with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0117] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0118] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A method for discovering vulnerabilities in a power monitoring system, characterized in that: The following steps are involved: Encode test cases and eliminate abnormal samples in test cases; Determine whether there are valid cases in the population of test cases and determine the individual fitness function; Select test cases based on the fitness function, perform multi-point crossover mutation on randomly selected test cases, use the new test cases after multi-point crossover mutation as test input for fuzz testing, and mark valid test cases; Set the termination condition. When the termination condition is not met, repeat the above steps. When the termination condition is met, determine the system vulnerability.

2. The power monitoring system vulnerability mining method according to claim 1 is characterized in that: The termination condition is set. When the termination condition is not met, the steps of the above-mentioned actions in this step are repeated 400-600 times.

3. The power monitoring system vulnerability mining method according to claim 1 is characterized in that: The step of encoding the test case includes: representing the test case with a vector, which is expressed as: G=[g1,g2,...,g m ] (1) Among them, G represents the test case, g i represents the i-th attribute value of the test case, i = 1, 2, ···, m, m represents the dimension of the test case attribute, and the population is represented by a set of test cases of a set of m-dimensional vectors.

4. The method for mining vulnerabilities in a power monitoring system according to claim 3, characterized in that: The step of eliminating abnormal samples in the test case population includes performing zero-mean normalization processing on the test cases to eliminate abnormal samples.

5. The method for mining vulnerabilities in a power monitoring system according to claim 4, characterized in that: The step of performing zero-mean normalization on the test case is calculated as follows: Among them, g i * Represents the normalized value of the i-th attribute of the test case, represents the average value of the i-th attribute of all test cases in the population, g n,i represents the i-th attribute value of the n-th test case in the population, s represents the number of test cases in the population, and σ represents the standard deviation of the test cases.

6. The power monitoring system vulnerability mining method according to claim 5 is characterized in that: The step of determining whether there is a valid test case includes: calculating the distance between the central individual of the population and the test case.

7. The power monitoring system vulnerability mining method according to claim 6, characterized in that: The steps of calculating the central individual of the population are calculated as follows: The distance between test cases is calculated as follows: Among them, c represents the central individual of the population, d a,b Indicates the distance between test case a and test case b in the population, L sum Represents the sum of the lengths of test case a and test case b, N step Indicates the minimum number of steps required to transform one of test case a and test case b into the other test case.

8. The method for mining vulnerabilities in a power monitoring system according to claim 7, characterized in that: The step of determining whether there is a valid use case in the test case population includes: for an abnormal test case message, when a normal server response occurs, or the server response to a subsequent normal request test case message is in at least one of the following states: timeout, no response, server shutdown and / or server denial of service, marking the test case as a valid use case.

9. The power monitoring system vulnerability mining method according to claim 8, characterized in that: When it is determined that there are no valid use cases in the population, the individual fitness of the population is calculated as follows: Among them, f N (x) represents the central fitness value of test case x, d x,c Indicates the distance between the test case x and the central individual c in the population, d max represents the maximum distance between all test cases and the central individual c in the population, d avg represents the average distance between all test cases and the central individual c in the population; and When it is determined that there are valid test cases in the population, all test cases in the population are clustered to find the cluster center individual. At this time, the individual fitness of the population is calculated as follows: Among them, f Y (x) represents the clustering fitness value of test case x, d x,k Denotes the distance between the test case x and its nearest cluster center individual k, d max,k Indicates the maximum distance between all test cases in the cluster where test case x is located and the cluster center individual k, d avg,k It represents the average distance between all test cases in the cluster where the test case x is located and the cluster center individual k.

10. The power monitoring system vulnerability mining method according to claim 9, characterized in that: The step of determining the selected test case according to the fitness function includes calculating the individual fitness values ​​of all test cases in the population and calculating the individual genetic probability of the population, and the calculation method is as follows: Among them, P n represents the individual genetic probability of the nth test case in the population, n=1,2,...,s,f n Represents the individual fitness value of the nth test case in the population, generates a random value r in the interval [0,1], if r<P n , then the test case is selected and a new population is generated through the individual selection operation of the test case.

11. The method for mining vulnerabilities in a power monitoring system according to claim 10, characterized in that: The step of selecting test cases according to the fitness function also includes: setting an N-generation survival period for all test case individuals in the new population generated by the individual selection operation, and abandoning the individual if it has not been selected when the N-generation survival period is reached.

12. The method for mining vulnerabilities in a power monitoring system according to claim 11, characterized in that: The N-generation survival cycle is 20 to 40 generations.

13. The method for mining loopholes in a power monitoring system according to claim 12, characterized in that: The step of randomly selecting positions for test cases and performing multi-point crossover mutation includes: Calculate the crossover probability and mutation probability of the selected test case in the population. The calculation formulas are as follows: Among them, P cro is the crossover probability, P mut is the mutation probability, f max Represents the maximum individual fitness value of all test cases in the population, f cro represents the larger value of the individual fitness values ​​of the two test cases to be crossed, f avg represents the average individual fitness value of all test cases in the population, f mut Indicates the individual fitness value of the test case to be mutated, k1 and k2 are constants in the interval [0,1].

14. A device for discovering vulnerabilities in a power monitoring system, characterized in that: include: Preprocessing unit, calculation unit and execution unit; wherein, The preprocessing unit is used to encode the test case and eliminate abnormal samples in the test case; The computing unit is configured to determine whether there are valid test cases in the population of test cases and determine an individual fitness function; The execution unit is used to select test cases according to the fitness function, perform multi-point cross mutation on randomly selected positions of the test cases, perform fuzz testing on the new test cases after the multi-point cross mutation as test input, and mark valid test cases; set a termination condition, and when the termination condition is not met, repeat the above-mentioned actions of this step, and when the termination condition is met, determine the system vulnerability.

15. A medium having a program stored thereon, characterized in that: When the program is executed by a processor, the steps of the power monitoring system vulnerability mining method according to any one of claims 1 to 14 are implemented.

16. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the power monitoring system vulnerability mining method according to any one of claims 1 to 14 are implemented.

Images