An industrial security protection gateway system based on artificial intelligence technology

Abstract

The present invention relates to the technical field of virus detection, and discloses an industrial security protection gateway system based on artificial intelligence technology, including: a data acquisition module; a data preprocessing module; a data processing module; a hazard detection module; The present invention can effectively screen for dangers in the data packet to be verified. By screening out the abnormal code fragments inserted into the data packet, and then preprocessing all the abnormal code fragments and inputting them into the complete code generation model, the complete abnormal software code is generated by the complete code generation model, and the generated software code is subjected to hazard detection. Based on the detection results, it is judged whether the data packet to be verified contains malicious attack viruses, thereby effectively increasing the screening and interception of malicious attack viruses by the gateway, and also effectively reducing the misjudgment probability of some harmless scripts.

Description

Technical Field

[0001] The present invention relates to the technical field of virus detection, and more specifically, it relates to an industrial security protection gateway system based on artificial intelligence technology. Background Art

[0002] A security gateway can effectively protect the secure access to network resources, the transmission encryption of data, and the classification and threat detection of data.

[0003] However, some current network attack methods may split the code of malware into multiple parts and insert them into a normal software installation package. Each part is a harmless file or data, thus evading the screening of the security gateway. Then, it is transmitted to the target system along with the software installation package, recombined and run through a remote script, and evades the detection of abnormal resource calls along with the normal software installation, thereby achieving the malicious attack on the target system. Currently, the security gateway cannot identify and determine these split parts. Summary of the Invention

[0004] The purpose of the present invention is to provide an industrial security protection gateway system based on artificial intelligence technology to solve the above problems.

[0005] The present invention provides an industrial security protection gateway system based on artificial intelligence technology, including:

[0006] A data acquisition module for acquiring the official version of the software installation package to be verified;

[0007] A data preprocessing module for traversing and comparing the software installation package to be verified with the official version of the software installation package, screening out abnormal code segments, and preprocessing all abnormal code segments. The preprocessing is to convert the abnormal code segments into token sequences;

[0008] A data processing module for constructing a complete code generation model, processing all preprocessed abnormal code segments through the complete code generation model, and generating a complete abnormal software code;

[0009] Generating a complete abnormal software code includes:

[0010] Step 1.1, constructing a graph structure of the abnormal code segments:

[0011] Nodes represent the token sequences converted from the abnormal code segments;

[0012] Directed edges represent the syntactic and semantic relationships between the token sequences;

[0013] Step 1.2, initializing the generation process and setting the initial state;

[0014] Step 1.3, enter the loop and repeat the following steps 2.1 - 2.3 until all abnormal code snippets are added to obtain the generated complete abnormal software code;

[0015] Step 2.1, according to the current state, use the complete code generation model to select the action with the largest Q - value. The Q - value is the Q - value of all optional actions output by inputting the global representation of the graph structure into the fully - connected layer;

[0016] Step 2.2, execute the action to add an abnormal code snippet;

[0017] Step 2.3, update the state;

[0018] The hazard detection module is used to detect the hazard of the abnormal software code output by the data processing module. If there is a hazard, the software installation package to be verified is deleted. If there is no hazard, the software installation package to be verified is transmitted to the target system.

[0019] Furthermore, the steps for obtaining the Q - values of all optional actions by inputting the global representation of the graph structure into the fully - connected layer include:

[0020] Generate a token embedding vector for each node as the initial embedding vector of the node;

[0021] Encode the token information into a vector and concatenate or fuse it with the initial embedding vector of the node;

[0022] Perform message passing on the graph structure to aggregate the embedding vectors of the neighbor nodes of each node to obtain the aggregated embedding vector;

[0023] Use a feed - forward neural network to fuse the current embedding vector and the aggregated embedding vector of each node to obtain a new embedding representation of the node;

[0024] Perform a pooling operation on the final new embedding representations of all nodes to obtain the global representation of the graph structure;

[0025] Input the global representation of the graph structure into the fully - connected layer;

[0026] Output the Q - values of all optional actions.

[0027] Furthermore, the training of the complete code generation model includes:

[0028] Step 3.1, construct the state space:

[0029] Each state is represented by the token sequence of the currently generated abnormal code snippets;

[0030] The initial state is an empty sequence;

[0031] Step 3.2, construct the action space:

[0032] Each action represents adding a new exception code snippet in the current state;

[0033] The size of the action space is equal to the size of the vocabulary plus 1;

[0034] Step 3.3, for each training sample of the complete exception software code:

[0035] Initialize the generation process and set the current state as an empty sequence;

[0036] Enter a loop and repeat the following steps 4.1 - 4.5 until the generation terminates;

[0037] Step 4.1, according to the current state , use the complete code generation model to select the action with the maximum Q - value ;

[0038] Execute the action Add an exception code snippet, obtain the reward and the next state ;

[0039] Step 4.2, put , , , into the experience replay pool;

[0040] Step 4.3, randomly sample a batch of data from the experience replay pool;

[0041] Step 4.4, use the loss function of the Q - learning algorithm to update the parameters of the complete code generation model;

[0042] Step 4.5, update to .

[0043] An industrial safety protection method based on artificial intelligence technology, using the aforementioned industrial safety protection gateway system based on artificial intelligence technology, includes the following steps:

[0044] Step 100, scan the software installation package to be verified and obtain the name, version number, and official website link of the software, visit the official website of the software and download the corresponding version of the software installation package;

[0045] Step 200, compare the software installation package to be verified with the official version of the software installation package in a traversal manner, and screen out the exception code snippets;

[0046] Step 300: Build a complete code generation model, preprocess the abnormal code snippets and input them into the complete code generation model to generate a complete abnormal software code;

[0047] Step 400: Detect the harmfulness of the generated abnormal software code. If there is harmfulness, delete the software installation package to be verified. If there is no harmfulness, transmit the software installation package to be verified to the target system.

[0048] A storage medium stores non - transient computer - readable instructions, which when executed by a computer, can execute the steps in the foregoing industrial security protection method based on artificial intelligence technology.

[0049] The beneficial effects of the present invention are as follows: The present invention can effectively screen for dangers in the data packet to be verified. By screening out the abnormal code snippets inserted in the data packet, then preprocessing all the abnormal code snippets and inputting them into the complete code generation model, generating a complete abnormal software code through the complete code generation model, and detecting the harmfulness of the generated software code, and judging whether the data packet to be verified contains malicious attack viruses according to the detection results, thereby effectively increasing the screening and interception of malicious attack viruses by the gateway and effectively reducing the misjudgment probability of some harmless scripts. Description of the Drawings

[0050] Figure 1 is a block diagram of a module of an industrial security protection gateway system based on artificial intelligence technology of the present invention;

[0051] Figure 2 is a flowchart of an industrial security protection method based on artificial intelligence technology of the present invention;

[0052] Figure 3 is a block diagram of the identity authentication module of the present invention. Detailed Embodiments

[0053] Now, the subject matter described herein will be discussed with reference to exemplary embodiments. It should be understood that discussing these embodiments is only to enable those skilled in the art to better understand and thus implement the subject matter described herein. Additionally, features described relative to some examples can be combined in other examples.

[0054] As Figure 1 shown, an industrial security protection gateway system based on artificial intelligence technology includes:

[0055] A data acquisition module for acquiring the official version of the software installation package to be verified;

[0056] A data preprocessing module, which is used to compare the software installation package to be verified with the official version of the software installation package in a traversal manner, screen out abnormal code segments, and preprocess all abnormal code segments;

[0057] A data processing module, which is used to build a complete code generation model, process all preprocessed abnormal code segments through the complete code generation model, and generate a complete abnormal software code;

[0058] A hazard detection module, which is used to detect the hazards of the abnormal software code output by the data processing module. If there are hazards, the software installation package to be verified will be deleted. If there are no hazards, the software installation package to be verified will be transmitted to the target system.

[0059] In an embodiment of the present invention, as Figure 3 shown, it further includes an identity authentication module. The identity authentication module includes: a quantum random number generator, a cryptographic algorithm module, a PCI-E bus interface, and further includes: an FPGA master control chip with a NIOS soft core processor. The master control chip integrates a PCI-E IP core and an algorithm state machine inside. The cryptographic algorithm module includes: chips based on the national cryptographic algorithms SM2, SM3, and SM4 algorithms can implement relevant cryptographic operations;

[0060] A special API function set for PCI cryptographic card product detection;

[0061] The special API function set for PCI cryptographic card product detection is provided in the form of a dynamic library, which can be used for self-testing by product development units and testing by testing institutions, and can also be used for debugging and verification during the research and development of cryptographic devices using PCI cryptographic cards.

[0062] Generate random numbers:

[0063] Prototype: int SDF GenerateRandom(

[0064] void * hSessionHandle,

[0065] unsigned int uiLength,

[0066] unsigned char *pucRandom);

[0067] Description: Obtain random numbers of a specified length.

[0068] Parameters:

[0069] hSessionHandle[in] The session handle established with the device;

[0070] uiLength[in] The length of the random number to be obtained;

[0071] pucRandom_[out] Buffer pointer for storing the obtained random number;

[0072] Return value: 0 Success;

[0073] Non - zero Failure, return the error code;

[0074] Obtaining the usage right of the private key:

[0075] Prototype: int SDF GetPrivateKeyAccessRight(

[0076] void * hSessionHandle,

[0077] unsigned int uiKeyIndex,

[0078] unsigned char * pucPassword,

[0079] unsigned int uiPwdLength),

[0080] Description: Obtain the usage right of the private key with the specified index stored inside the password device.

[0081] Parameters:

[0082] hSessionHandle[in] Session handle established with the device;

[0083] uiKeyIndex[in] Index value of the private key stored in the password device;

[0084] pucPassword[in] Identification code for using the private key right;

[0085] uiPwdLength[in] Length of the private key access control code, not less than 8 bytes;

[0086] Return value: 0 Success;

[0087] Non - zero Failure, return the error code;

[0088] Remark: The starting index value of the key pair index value stored in the password device involved in this standard is 1, and the maximum is determined by the actual storage capacity of the password device, n value,

[0089] Symmetric encryption:

[0090] Prototype: int SDF_Encrypt(

[0091] void * hSessionHandle,

[0092] void * hKeyHandle,

[0093] unsigned int uiAlgID,

[0094] unsigned char * pucIV,

[0095] unsigned char * pucData,

[0096] unsigned int uiDataLength,

[0097] unsigned char * pucEncData,

[0098] unsigned int * puiEncDataLength);

[0099] Description: Performs a symmetric encryption operation on the data using the specified key handle and IV.

[0100] hSessionHandle[in] Session handle established with the device;

[0101] hKeyHandle[in] Specified key handle;

[0102] uiAlgID[in] Algorithm identifier, specifying the symmetric encryption algorithm;

[0103] pucIV[inlout] Buffer pointer for storing the input and returned IV data;

[0104] pucData[in] Buffer pointer for storing the input data plaintext;

[0105] uiDataLength[in] Length of the input data plaintext;

[0106] pucEncData[out] Buffer pointer for storing the output data ciphertext;

[0107] puiEncDataLengthf[out] Length of the output data ciphertext;

[0108] Return value: 0 Success;

[0109] Non-zero Failure, returns an error code;

[0110] Calculate MAC:

[0111] Prototype: int SDF_CalculateMAC(

[0112] void * hSessionHandle.

[0113] void * hKeyHandle,

[0114] unsigned int uiAlglD,

[0115] unsigned char * puclV,

[0116] unsigned char * pucData,

[0117] unsigned int uiDataLength,

[0118] unsigned char * pucMAC,

[0119] unsigned int * puiMACLength);

[0120] Description: Performs a MAC operation on data using the specified key handle and IV.

[0121] Parameters:

[0122] hSessionHandle[in] Session handle established with the device;

[0123] hKeyHandlef[in] Specified key handle;

[0124] uiAlgID[in] Algorithm identifier, specifying the MAC encryption algorithm;

[0125] pucIV[in|out] Buffer pointer for storing input and returned IV data;

[0126] pucData[in] Buffer pointer for storing the output data plaintext;

[0127] uiDatalength[in] Length of the output data plaintext;

[0128] pucMAC[out] Buffer pointer for storing the output MAC value;

[0129] puiMACLength[out] Length of the output MAC value;

[0130] Return value: 0 for success;

[0131] non-zero for failure, returning an error code;

[0132] Read file:

[0133] Prototype: int SDFReadFile(

[0134] void *hSessionHandle,

[0135] unsigned char *pucFileName,

[0136] unsigned int uiNameLen,

[0137] unsigned int uiOffset,

[0138] unsigned int *puiFilelength,

[0139] unsigned char *pucBuffer);

[0140] Description: Reads the content of the file that stores user data inside the cryptographic device;

[0141] Parameters:

[0142] hSessionHandle[in] Session handle established with the device;

[0143] pucFileName[in] Buffer pointer for storing the input file name, with a maximum length of 128 bytes;

[0144] uiName en[in] File name length;

[0145] uiOffset[in] Specifies the offset value when reading the file;

[0146] puiFilel ength[in|out] Specifies the length of the file content to be read when used as an input parameter; returns the actual length of the file content read when used as an output parameter;

[0147] pucBuffer[out] Buffer pointer for storing the read file data;

[0148] Return value: 0 for success;

[0149] non-zero for failure, returning an error code.

[0150] It should be noted that an identity authentication module is set up in the security gateway system server. By means of a built-in PCI quantum random number generator, software is independently developed, and random numbers are transmitted to the national secret PCI cryptographic card through the PCI bus, which is used to generate highly secure quantum keys within the industrial control system, and combined with the quantum keys and the national secret algorithms to protect the security of the PLC system;

[0151] Combined with the national secret algorithms and quantum keys, the symmetric cryptographic algorithm verifies the identities of internal industrial control devices such as PLCs, and uses quantum USBKeys to authenticate remote operators, ensuring the secure transmission of internal data and the identification of external operators;

[0152] Based on the encryption of important transmitted data with quantum keys, the important communication data between the PLC and the server after identity authentication is encrypted and transmitted through the quantum keys and the national secret algorithms, effectively ensuring the security of important transmitted data.

[0153] Such as Figure 2 shown, an industrial security protection method based on artificial intelligence technology includes the following steps:

[0154] Step 100: Scan the software installation package to be verified and obtain the name, version number, and official website link of the software, visit the official website of the software and download the corresponding version of the software installation package;

[0155] Step 200: Compare the software installation package to be verified with the official version of the software installation package in a traversal manner, and screen out the abnormal code segments;

[0156] Step 300: Build a complete code generation model, preprocess the abnormal code segments and input them into the complete code generation model to generate a complete abnormal software code;

[0157] Specifically:

[0158] Data preprocessing:

[0159] Convert the abnormal code segments into token sequences; split the code into tokens according to symbols such as spaces, operators, and punctuation marks;

[0160] Build a vocabulary, and map each unique token to a unique ID;

[0161] Represent each abnormal code segment as a sequence of IDs;

[0162] Example:

[0163] For abnormal code segment 1: def func(x):\n if x>0:\n return x * 2\n else:\nreturn -x;

[0164] The first step is tokenization, and the resulting token sequence is:

[0165] [def, func, (, x, ), :, if, x, >, 0, :, return, x, *, 2, else, :, return, -, x].

[0166] Suppose the constructed vocabulary is as follows:

[0167] vocab = {def: 0, func: 1, (: 2, x: 3, ): 4, : : 5, if: 6, >: 7, 0: 8, return: 9, *: 10, 2: 11, else: 12, -: 13}.

[0168] Then this abnormal code snippet can be represented as an ID sequence:

[0169] [0, 1, 2, 3, 4, 5, 6, 3, 7, 8, 5, 9, 3, 10, 11, 12, 5, 9, 13, 3].

[0170] Construct the state space:

[0171] Each state is represented by the ID sequence of the currently generated abnormal code snippet;

[0172] The initial state is an empty sequence;

[0173] Construct the action space:

[0174] Each action represents adding a new abnormal code snippet in the current state;

[0175] The size of the action space is equal to the size of the vocabulary plus 1 (representing the termination action);

[0176] Construct the complete code generation model:

[0177] Construct the graph structure representation of the abnormal code snippet:

[0178] Regard each abnormal code snippet as a directed graph;

[0179] The nodes represent the tokens in the code;

[0180] The directed edges represent the syntactic and semantic relationships between tokens, such as control flow, data flow, etc.;

[0181] Node embedding representation:

[0182] Randomly initialize the embedding representation:

[0183] Assign a random embedding vector to each token;

[0184] During the model training process, the embedding vectors are also optimized simultaneously;

[0185] Use a pre-trained code embedding model:

[0186] Pre-train a code embedding model on a large amount of code data in a self-supervised or unsupervised manner;

[0187] Common models such as code2vec, CodeBERT, etc.;

[0188] Directly use the token embedding vectors generated by the code embedding model as the initial embedding vectors of the nodes;

[0189] Combine token information:

[0190] In addition to the token itself, information such as the type of the token (keyword, variable, etc.), context, and position can also be combined;

[0191] Encode this information into vectors and concatenate or fuse them with the token embedding vectors;

[0192] Example:

[0193] Suppose there is the following simple code:

[0194] x = 5

[0195] if x>0:

[0196] y = x * 2

[0197] In the corresponding directed graph, there are the following nodes (tokens):

[0198] x, =, 5, if, >, 0, :, y, *, 2

[0199] Randomly initialize the embedding representation;

[0200] Suppose the dimension of the embedding representation is 4, then each token will get a 4-dimensional random vector, such as:

[0201] x: [-0.2, 0.7, -0.3, 0.1]

[0202] =: [0.4, -0.6, 0.2, -0.5] ...

[0204] Use a pre-trained model;

[0205] Suppose the code2vec model is used, then the embedding representation of each token is as follows:

[0206] x: [0.02, -0.15, 0.34, -0.21]

[0207] =: [-0.37, 0.08, -0.03, 0.26] ...

[0209] Combine the token information;

[0210] Encode the token type (such as variable, constant, etc.) and location information into a vector;

[0211] Concatenate or fuse with the token embedding vector;

[0212] Message passing:

[0213] Perform message passing on the graph, aggregating the embedding vectors of the neighbor nodes of each node to the current node;

[0214] Different aggregation functions can be used, such as average, max, RNN, etc.;

[0215] The formula for average aggregation is:

[0216]

[0217] Where, is the embedding vector of node v at the k-th layer;

[0218] is the set of neighbor nodes of node v;

[0219] is the operation of taking the average;

[0220] is a learnable weight matrix;

[0221] is a non-linear activation function, such as the ReLU activation function;

[0222] Node update:

[0223] Use a feed-forward neural network to fuse the current embedding vector and the aggregated embedding vector of each node to obtain a new embedding representation of the node;

[0224] Specifically:

[0225] For node v, we concatenate its current embedding vector and the aggregated embedding vector and then input them into a feed-forward neural network:

[0226]

[0227] Where:

[0228] is the new embedding representation of node v at the k-th layer;

[0229] is the aggregated embedding vector of node v;

[0230] is the vector concatenation operation;

[0231] is a feed-forward neural network, usually containing several fully-connected layers and non-linear activation functions;

[0232] Example:

[0233] Suppose we have a node v with its current embedding vector being , and the aggregated embedding vector being ;

[0234] Fuse using a feed-forward neural network:

[0235] ;

[0236] ;

[0237] ;

[0238] where are all trainable parameters;

[0239] Global pooling:

[0240] Perform a pooling operation on the final new embedding representations of all nodes to obtain the global representation of the entire graph;

[0241] Output layer:

[0242] Input the global graph representation into a fully-connected layer;

[0243] Output the Q-values of all optional actions;

[0244] Train the complete code generation model:

[0245] Initialize the experience replay pool:

[0246] Used to store the current state , the current action , the current reward , the next state transition samples;

[0247] Allows repeated learning from previous experiences to improve data utilization efficiency;

[0248] For each training sample of the complete abnormal software code:

[0249] Initialize the generation process and set the current state as an empty sequence;

[0250] Enter a loop and repeat the following steps until generation termination;

[0251] According to the current state , use the complete code generation model to select the action with the largest Q value (i.e., add a new exception code snippet);

[0252] Execute the action , obtain the reward and the next state ;

[0253] Store ( , , , ) in the experience replay pool;

[0254] Randomly sample a batch of data from the experience replay pool;

[0255] Use the loss function of the Q-learning algorithm to update the parameters of the complete code generation model;

[0256] Set to , and enter the next loop;

[0257] Optimize the complete code generation model:

[0258] Adopt some techniques to improve training stability, such as target network, double Q-learning, etc.;

[0259] For different code samples, adjust the reward function according to the generation effect;

[0260] Generate the final complete code:

[0261] For each new exception code sample;

[0262] Initialize the generation process and set the initial state;

[0263] Repeatedly execute the greedy action (select the action with the largest Q value);

[0264] Until the termination condition is reached, obtain the generated final complete code;

[0265] Example:

[0266] Suppose we have the following 3 exception code snippets:

[0267] # Snippet 1

[0268] x = 5

[0269] if x > 0:

[0270] # Fragment 2

[0271] y = x * 2

[0272] # Fragment 3

[0273] else:

[0274] y = -x

[0275] During the training process, for the above samples:

[0276] The initial state is an empty sequence;

[0277] The complete code generation model selects the action to add Fragment 1, forming a new state x = 5\nif x > 0:

[0278] The model then adds Fragment 2, forming x = 5\nif x > 0:\n y = x * 2;

[0279] Adding Fragment 3 again to complete the entire code x = 5\nif x > 0:\n y = x * 2\nelse:\n y = -x;

[0280] During this process, all state, action, reward, and next state transitions are stored in the experience pool;

[0281] Sampling data from the experience pool and using the Q-learning algorithm to update the parameters of the complete code generation model;

[0282] Generating abnormal software code:

[0283] For each training sample of the new complete abnormal software code;

[0284] Initialize the generation process and set the current state as an empty sequence;

[0285] Repeat the following steps until the termination condition is reached:

[0286] Using the trained complete code generation model, based on the current state Select the action with the largest Q value (i.e., add a new abnormal code fragment);

[0287] Execute the action , adding the corresponding abnormal code fragment to the current generated sequence to obtain the next state ;

[0288] Update the current state = ;

[0289] The termination condition can be that the generated sequence reaches the maximum length, the complete abnormal software code is output, there are no optional actions, etc.;

[0290] Output the finally generated complete abnormal software code.

[0291] Example:

[0292] Suppose that after training, we obtain a relatively optimal complete code generation model. Now, it is necessary to generate a training sample of a new complete abnormal software code.

[0293] The given abnormal code snippet is:

[0294] # Fragment 1

[0295] def func(x, y):

[0296] z = x + y

[0297] # Fragment 2

[0298] return z * 2

[0299] # Fragment 3

[0300] a = 3

[0301] b = 7

[0302] c = func(a, b)

[0303] print(c)

[0304] The generation process is as follows:

[0305] Initial state is empty;

[0306] The Q value of adding Fragment 1 output by the model is the largest, and the action is executed, and the generated sequence becomes def func(x, y):\n z = x + y;

[0307] New state is the above-generated sequence, and the Q value of adding Fragment 2 output by the model is the largest;

[0308] Execute , and the generated sequence becomes def func(x, y):\n z = x + y\n return z * 2;

[0309] New state , and the Q value of adding Fragment 3 output by the model is the largest;

[0310] Execute , the finally generated sequence is:

[0311] def func(x, y):

[0312] z = x + y

[0313] return z * 2

[0314] a = 3

[0315] b = 7

[0316] c = func(a, b)

[0317] print(c).

[0318] Step 400: Detect the harmfulness of the generated abnormal software code. If there is harmfulness, delete the software installation package to be verified. If there is no harmfulness, transmit the software installation package to be verified to the target system;

[0319] The methods of harmfulness detection include:

[0320] Static analysis:

[0321] Conduct syntax and semantic analysis on the generated code to detect potential security vulnerabilities and malicious behaviors;

[0322] Existing static code analysis tools such as LGTM, Findbugs, etc. can be used;

[0323] Custom static analysis rules can also be written for specific types of abnormal behaviors;

[0324] Dynamic analysis:

[0325] Execute the generated code in a sandbox or virtual environment and monitor its runtime behavior;

[0326] Detect whether there are dangerous API calls, system calls, network communications, etc.;

[0327] Dynamic detection tools such as Strace, Cuckoo Sandbox, etc. can be used;

[0328] Machine learning detection:

[0329] Collect a large number of known benign code and malicious code samples;

[0330] Use a machine learning model to train on the static features and dynamic behaviors of the code;

[0331] Input the generated code into the trained machine learning model to determine whether it is malicious code.

[0332] It should be noted that for the data packet to be verified, a risk screening is carried out. By screening out the abnormal code segments inserted into the data packet, and then preprocessing all the abnormal code segments and inputting them into the complete code generation model. The complete abnormal software code is generated by the complete code generation model, and the generated software code is subjected to harmfulness detection. Based on the detection results, it is judged whether the data packet to be verified contains malicious attack viruses, thus effectively increasing the screening and interception of malicious attack viruses by the gateway, and also effectively reducing the misjudgment probability of some harmless scripts.

[0333] The present invention also provides a storage medium that stores non-temporary computer-readable instructions. When the non-temporary computer-readable instructions are executed by a computer, the steps in an industrial security protection method based on artificial intelligence technology as described above can be executed.

[0334] The above describes the present embodiment, but the present embodiment is not limited to the above specific implementation manners. The above specific implementation manners are merely illustrative and not restrictive. Under the inspiration of the present embodiment, those of ordinary skill in the art can also make many forms, all of which fall within the protection scope of the present embodiment.

Claims

1. An industrial security protection gateway system based on artificial intelligence technology, characterized in that: It includes: A data acquisition module for acquiring the official version of the software installation package to be verified; A data preprocessing module for traversing and comparing the software installation package to be verified with the official version of the software installation package, screening out abnormal code fragments, and preprocessing all abnormal code fragments. The preprocessing is to convert the abnormal code fragments into token sequences; A data processing module for constructing a complete code generation model, processing all preprocessed abnormal code fragments through the complete code generation model, and generating a complete abnormal software code; Generating a complete abnormal software code includes: Step 1.1, constructing a graph structure of the abnormal code fragments: Nodes represent token sequences converted from abnormal code fragments; Directed edges represent the syntactic and semantic relationships between token sequences; Step 1.2, initializing the generation process and setting the initial state; Step 1.3, entering a loop, repeating the following steps 2.1 - 2.3 until all abnormal code fragments are added, and obtaining the generated complete abnormal software code; Step 2.1, according to the current state, using the complete code generation model to select the action with the largest Q value. The Q value is the Q value of all optional actions output by inputting the global representation of the graph structure into the fully connected layer; Step 2.2, executing the action to add an abnormal code fragment; Step 2.3, updating the state; A hazard detection module for detecting the hazard of the abnormal software code output by the data processing module. If there is a hazard, the software installation package to be verified is deleted. If there is no hazard, the software installation package to be verified is transmitted to the target system.

2. The industrial safety protection gateway system based on artificial intelligence technology according to claim 1, characterized in that, The Q values of all optional actions output by inputting the global representation of the graph structure into the fully connected layer include the following steps: Generating a token embedding vector for each node as the initial embedding vector of the node; Encoding the token information into a vector and concatenating or fusing it with the initial embedding vector of the node; Performing message passing on the graph structure to aggregate the embedding vectors of the neighbor nodes of each node to obtain an aggregated embedding vector; Using a feed - forward neural network to fuse the current embedding vector and the aggregated embedding vector of each node to obtain a new embedding representation of the node; Performing a pooling operation on the final new embedding representations of all nodes to obtain the global representation of the graph structure; Inputting the global representation of the graph structure into the fully connected layer; Outputting the Q values of all optional actions.

3. The industrial safety protection gateway system based on artificial intelligence technology according to claim 1, wherein The training of the complete code generation model includes: Step 3.1, constructing a state space: Each state is represented by the token sequence of the abnormal code fragments that have been generated currently; The initial state is an empty sequence; Step 3.2, constructing an action space: Each action represents adding a new abnormal code fragment in the current state; The size of the action space is equal to the size of the vocabulary plus 1; Step 3.3, for each training sample of the complete abnormal software code: Initialize the generation process and set the current state s t is an empty sequence; Entering a loop, repeating the following steps 4.1 - 4.5 until the generation terminates; Step 4.1, according to the current state s t , use the complete code generation model to select the action a with the largest Q value t ; Execute action a t Add an exception code snippet and obtain reward r t and the next state s t+1 ; Step 4.2, store s t , a t , r t , s t+1 in the experience replay pool; Step 4.3, randomly sampling a batch of data from the experience replay pool; Step 4.4, using the loss function of the Q - learning algorithm to update the parameters of the complete code generation model; Step 4.5, update s t to s t+1 .

4. An industrial safety protection method based on artificial intelligence technology, characterized in that: Adopt an industrial security protection gateway system based on artificial intelligence technology as described in claim 1, including the following steps: Step 100: Scan the software installation package to be verified and obtain the name, version number, and official website link of the software. Access the official website of the software and download the software installation package of the corresponding version; Step 200: Compare the software installation package to be verified with the official version of the software installation package in a traversal manner, and screen out abnormal code segments; Step 300: Build a complete code generation model, preprocess the abnormal code segments, and input them into the complete code generation model to generate a complete abnormal software code; Step 400: Detect the harmfulness of the generated abnormal software code. If there is harmfulness, delete the software installation package to be verified. If there is no harmfulness, transmit the software installation package to be verified to the target system.

5. A storage medium, characterized in that It stores non-transitory computer-readable instructions, which when executed by a computer, can execute the steps in an industrial security protection method based on artificial intelligence technology as described in claim 4.

Images